AWS eks documentation change
Summary
Updated EKS Pod Identity Agent documentation with Bottlerocket-specific requirements and credential management instructions
Security assessment
Adds documentation about secure credential handling for hybrid nodes without IMDS, including specific version requirements and configuration steps to prevent credential exposure. While security-related, there's no explicit mention of resolving a specific vulnerability.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-add-ons.md b/eks/latest/userguide/hybrid-nodes-add-ons.md index 691660d24..189f244da 100644 --- a//eks/latest/userguide/hybrid-nodes-add-ons.md +++ b//eks/latest/userguide/hybrid-nodes-add-ons.md @@ -23 +23,6 @@ CloudWatch Observability agent | v2.2.1-eksbuild.1 and above -EKS Pod Identity Agent | v1.3.3-eksbuild.1 and above +EKS Pod Identity Agent | + + * v1.3.3-eksbuild.1 and above, except for Bottlerocket + * v1.3.7-eksbuild.2 and above for Bottlerocket + + @@ -115 +120 @@ For load balancing with NLB, you must specify the annotations below. See [Route -The EKS Pod Identity Agent add-on is not compatible with hybrid nodes running Bottlerocket. +To successfully deploy the EKS Pod Identity Agent add-on on hybrid nodes running Bottlerocket, ensure your Bottlerocket version is at least v1.39.0. The Pod Identity Agent is not supported on earlier Bottlerocket versions in hybrid node environments. @@ -117 +122 @@ The EKS Pod Identity Agent add-on is not compatible with hybrid nodes running Bo -The original Amazon EKS Pod Identity Agent DaemonSet relies on the availability of EC2 IMDS on the node to obtain the required AWS credentials. As IMDS isn’t available on hybrid nodes, starting in add-on version `1.3.3-eksbuild.1`, the Pod Identity Agent add-on optionally deploys a second DaemonSet that specifically targets hybrid nodes. This DaemonSet mounts the required credentials to the pods created by the Pod Identity Agent add-on. +The original Amazon EKS Pod Identity Agent DaemonSet relies on the availability of EC2 IMDS on the node to obtain the required AWS credentials. As IMDS isn’t available on hybrid nodes, starting with version 1.3.3-eksbuild.1, the Pod Identity Agent add-on optionally deploys a DaemonSet that mounts the required credentials. Hybrid nodes running Bottlerocket require a different method to mount the credentials, and starting in version 1.3.7-eksbuild.2, the Pod Identity Agent add-on optionally deploys a DaemonSet that specifically targets Bottlerocket hybrid nodes. The following sections describe the process for enabling the optional DaemonSets. @@ -119 +124,3 @@ The original Amazon EKS Pod Identity Agent DaemonSet relies on the availability - 1. To use the Pod Identity agent on hybrid nodes, set `enableCredentialsFile: true` in the hybrid section of `nodeadm` config as shown below: +### Ubuntu/RHEL/AL2023 + + 1. To use the Pod Identity agent on Ubuntu/RHEL/Al2023 hybrid nodes, set `enableCredentialsFile: true` in the hybrid section of `nodeadm` config as shown below: @@ -133 +140 @@ This will configure `nodeadm` to create a credentials file to be configured on t - 3. Install `eks-pod-identity-agent` with support for hybrid nodes enabled, by either using the AWS CLI or AWS Management Console. + 3. Install `eks-pod-identity-agent` with support for hybrid nodes enabled, by using either the AWS CLI or AWS Management Console. @@ -142 +149 @@ This will configure `nodeadm` to create a credentials file to be configured on t - 2. AWS Management Console: If you are installing the Pod Identity Agent add-on through the AWS console, add the following to the optional configuration to deploy the daemonset that targets hybrid nodes. + 2. AWS Management Console: If you are installing the Pod Identity Agent add-on through the AWS console, add the following to the optional configuration to deploy the DaemonSet that targets hybrid nodes. @@ -148,0 +156,30 @@ This will configure `nodeadm` to create a credentials file to be configured on t +### Bottlerocket + + 1. To use the Pod Identity agent on Bottlerocket hybrid nodes, add the `--enable-credentials-file=true` flag to the command used for the Bottlerocket bootstrap container user data, as described in [Connect hybrid nodes with Bottlerocket](./hybrid-nodes-bottlerocket.html). + + 1. If you are using the SSM credential provider, your command should look like this: + + eks-hybrid-ssm-setup --activation-id=<activation-id> --activation-code=<activation-code> --region=<region> --enable-credentials-file=true + + 2. If you are using the IAM Roles Anywhere credential provider, your command should look like this: + + eks-hybrid-iam-ra-setup --certificate=<certificate> --key=<private-key> --enable-credentials-file=true + +This will configure the bootstrap script to create a credentials file on the node under `/var/eks-hybrid/.aws/credentials`, which will be used by `eks-pod-identity-agent` pods. This credentials file will contain temporary AWS credentials that will be refreshed periodically. + + 2. Install `eks-pod-identity-agent` with support for Bottlerocket hybrid nodes enabled, by using either the AWS CLI or AWS Management Console. + + 1. AWS CLI: From the machine that you’re using to administer the cluster, run the following command to install `eks-pod-identity-agent` with support for Bottlerocket hybrid nodes enabled. Replace `my-cluster` with the name of your cluster. + + aws eks create-addon \ + --cluster-name my-cluster \ + --addon-name eks-pod-identity-agent \ + --configuration-values '{"daemonsets":{"hybrid-bottlerocket":{"create": true}}}' + + 2. AWS Management Console: If you are installing the Pod Identity Agent add-on through the AWS console, add the following to the optional configuration to deploy the DaemonSet that targets Bottlerocket hybrid nodes. + + {"daemonsets":{"hybrid-bottlerocket":{"create": true}}} + + + +