AWS eks documentation change
Summary
Clarified CIDR block recognition timeline and operational impacts
Security assessment
The update explains network configuration timing constraints but doesn't address security controls or vulnerabilities.
Diff
diff --git a/eks/latest/userguide/network-reqs.md b/eks/latest/userguide/network-reqs.md index aa0e7c8e0..e1bc00019 100644 --- a//eks/latest/userguide/network-reqs.md +++ b//eks/latest/userguide/network-reqs.md @@ -29 +29,3 @@ For example, assume that you made a cluster and specified four subnets. In the o -If you need more IP addresses than the CIDR blocks in the VPC have, you can add additional CIDR blocks by [associating additional Classless Inter-Domain Routing (CIDR) blocks](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-vpcs.html#add-ipv4-cidr) with your VPC. You can associate private (RFC 1918) and public (non-RFC 1918) CIDR blocks to your VPC either before or after you create your cluster. It can take a cluster up to five hours for a CIDR block that you associated with a VPC to be recognized. +If you need more IP addresses than the CIDR blocks in the VPC have, you can add additional CIDR blocks by [associating additional Classless Inter-Domain Routing (CIDR) blocks](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-vpcs.html#add-ipv4-cidr) with your VPC. You can associate private (RFC 1918) and public (non-RFC 1918) CIDR blocks to your VPC either before or after you create your cluster. + +You can use the new CIDR block immediately after you add it. However, because the control plane recognizes the new CIDR block only after the reconciliation is complete, it can take a cluster up to five hours for a CIDR block that you associated with a VPC to be recognized. Then you can run the `kubectl exec` and `kubectl logs` commands. Also, if you have Pods that operate as a webhook backend, then you must wait for the control plane reconciliation to complete.