AWS eks low security documentation change
Summary
Restructured installation documentation with expanded step-by-step instructions for kubectl across multiple platforms, added checksum verification guidance, and clearer path configuration steps
Security assessment
Added explicit instructions for SHA-256 checksum verification of kubectl binaries, which helps prevent MITM attacks and ensure binary integrity. While optional, this security best practice helps verify authenticity of downloaded software.
Diff
diff --git a/eks/latest/userguide/install-kubectl.md b/eks/latest/userguide/install-kubectl.md index 12f7937ce..6adf0eb4b 100644 --- a//eks/latest/userguide/install-kubectl.md +++ b//eks/latest/userguide/install-kubectl.md @@ -13 +13 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -`Kubectl` is a command line tool that you use to communicate with the Kubernetes API server. The `kubectl` binary is available in many operating system package managers. Using a package manager for your installation is often easier than a manual download and install process. The `eksctl` command lets you create and modify Amazon EKS clusters. +Once the AWS CLI is installed, there are two other tools you should install to create and manage your Kubernetes clusters: @@ -15 +15 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -Topics on this page help you install and set up these tools: + * `kubectl`: The `kubectl` command line tool is the main tool you will use to manage resources within your Kubernetes cluster. This page describes how to download and set up the `kubectl` binary that matches the version of your Kubernetes cluster. See Install or update kubectl. @@ -17,3 +17 @@ Topics on this page help you install and set up these tools: - * Install or update kubectl - - * Install eksctl + * `eksctl`: The `eksctl` command line tool is made for creating EKS clusters in the AWS cloud or on-premises (with EKS Anywhere), as well as modifying and deleting those clusters. See Install eksctl. @@ -66,0 +65,17 @@ If downloads are slow to your region from the regions used in this section, cons +Follow the steps below to install `kubectl` on macOS. The steps include: + + * Choosing and downloading the binary for the Kubernetes version you want. + + * Optionally checking the binary’s checksum. + + * Adding execute to the binary’s permissions. + + * Copying the binary to a folder in your PATH. + + * Optionally adding the binary’s directory to your PATH. + + + + +Procedure: + @@ -191,0 +207,17 @@ If downloads are slow to your region from the regions used in this section, cons +Follow the steps below to install `kubectl` on Linux (amd64). The steps include: + + * Choosing and downloading the binary for the Kubernetes version you want. + + * Optionally checking the binary’s checksum. + + * Adding execute to the binary’s permissions. + + * Copying the binary to a folder in your PATH. + + * Optionally adding the binary’s directory to your PATH. + + + + +Procedure: + @@ -324,0 +357,17 @@ This step assumes you are using the Bash shell; if you are using another shell, +Follow the steps below to install `kubectl` on Linux (arm64). The steps include: + + * Choosing and downloading the binary for the Kubernetes version you want. + + * Optionally checking the binary’s checksum. + + * Adding execute to the binary’s permissions. + + * Copying the binary to a folder in your PATH. + + * Optionally adding the binary’s directory to your PATH. + + + + +Procedure: + @@ -326,0 +376,2 @@ This step assumes you are using the Bash shell; if you are using another shell, + 2. Download the `kubectl` binary for your cluster’s Kubernetes version from Amazon S3. + @@ -375 +426 @@ This step assumes you are using the Bash shell; if you are using another shell, - 2. (Optional) Verify the downloaded binary with the `SHA-256` checksum for your binary. + 3. (Optional) Verify the downloaded binary with the `SHA-256` checksum for your binary. @@ -437 +488 @@ or - 3. Apply execute permissions to the binary. + 4. Apply execute permissions to the binary. @@ -441 +492 @@ or - 4. Copy the binary to a folder in your `PATH`. If you have already installed a version of `kubectl`, then we recommend creating a `$HOME/bin/kubectl` and ensuring that `$HOME/bin` comes first in your `$PATH`. + 5. Copy the binary to a folder in your `PATH`. If you have already installed a version of `kubectl`, then we recommend creating a `$HOME/bin/kubectl` and ensuring that `$HOME/bin` comes first in your `$PATH`. @@ -445 +496 @@ or - 5. (Optional) Add the `$HOME/bin` path to your shell initialization file so that it is configured when you open a shell. + 6. (Optional) Add the `$HOME/bin` path to your shell initialization file so that it is configured when you open a shell. @@ -457,0 +509,15 @@ This step assumes you are using the Bash shell; if you are using another shell, +Follow the steps below to install `kubectl` on Windows. The steps include: + + * Choosing and downloading the binary for the Kubernetes version you want. + + * Optionally checking the binary’s checksum. + + * Copying the binary to a folder in your PATH. + + * Optionally adding the binary’s directory to your PATH. + + + + +Procedure: + @@ -593 +659 @@ This step assumes you are using the Bash shell; if you are using another shell, -The `eksctl` CLI is used to work with EKS clusters. It automates many individual tasks. See [Installation](https://eksctl.io/installation) in the `eksctl` documentation for instructions on installing `eksctl`. +The `eksctl` CLI is used to work with EKS clusters. It automates many individual tasks. See [Installation](https://eksctl.io/installation) in the `eksctl` documentation for instructions on installing `eksctl`. For Linux, use the UNIX instructions.