AWS eks documentation change
Summary
Added documentation for AWS Private CA Connector for Kubernetes, updated GuardDuty agent details, revised storage add-on links, and clarified Pod Identity Agent IAM role usage.
Security assessment
The addition of AWS Private CA Connector documentation introduces a security feature for certificate management using AWS Private CA. The GuardDuty agent update clarifies runtime monitoring capabilities. These changes enhance security documentation but do not address a specific disclosed vulnerability.
Diff
diff --git a/eks/latest/userguide/workloads-add-ons-available-eks.md b/eks/latest/userguide/workloads-add-ons-available-eks.md index e88493e40..2ca95119b 100644 --- a//eks/latest/userguide/workloads-add-ons-available-eks.md +++ b//eks/latest/userguide/workloads-add-ons-available-eks.md @@ -5 +5 @@ -Amazon VPC CNI plugin for KubernetesCoreDNSKube-proxyAmazon EBS CSI driverAmazon EFS CSI driverAmazon FSx CSI driverMountpoint for Amazon S3 CSI DriverCSI snapshot controllerAmazon SageMaker HyperPod task governanceAWS Network Flow Monitor AgentNode monitoring agentAWS Distro for OpenTelemetryAmazon GuardDuty agentAmazon CloudWatch Observability agentEKS Pod Identity Agent +Amazon VPC CNI plugin for KubernetesCoreDNSKube-proxyAmazon EBS CSI driverAmazon EFS CSI driverAmazon FSx CSI driverMountpoint for Amazon S3 CSI DriverCSI snapshot controllerAmazon SageMaker HyperPod task governanceAWS Network Flow Monitor AgentNode monitoring agentAWS Distro for OpenTelemetryAmazon GuardDuty agentAmazon CloudWatch Observability agentAWS Private CA Connector for KubernetesEKS Pod Identity Agent @@ -33,0 +34 @@ Ability to manage credentials for your applications, similar to the way that EC2 +Enable cert-manager to issue X.509 certificates from AWS Private CA. Requires cert-manager. | AWS Private CA Connector for Kubernetes | EC2, Fargate, EKS Auto Mode, EKS Hybrid Nodes @@ -132 +133 @@ This add-on utilizes the IAM roles for service accounts capability of Amazon EKS -To learn more about the add-on, see [Store Kubernetes volumes with Amazon EBS](./ebs-csi.html). +To learn more about the add-on, see [Use Kubernetes volume storage with Amazon EBS](./ebs-csi.html). @@ -161 +162 @@ The Amazon EKS add-on name is `aws-efs-csi-driver`. -To learn more about the add-on, see [Store an elastic file system with Amazon EFS](./efs-csi.html). +To learn more about the add-on, see [Use elastic file system storage with Amazon EFS](./efs-csi.html). @@ -196 +197 @@ This add-on utilizes the IAM roles for service accounts capability of Amazon EKS -To learn more about the add-on, see [Store high-performance apps with Amazon FSx for Lustre](./fsx-csi.html). +To learn more about the add-on, see [Use high-performance app storage with Amazon FSx for Lustre](./fsx-csi.html). @@ -324 +325 @@ For more information, see [Getting Started with AWS Distro for OpenTelemetry usi -ADOT requires that `cert-manager` is deployed on the cluster as a prerequisite, otherwise this add-on won’t work if deployed directly using the [https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest](https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest) `cluster_addons` property. For more requirements, see [Requirements for Getting Started with AWS Distro for OpenTelemetry using EKS Add-Ons](https://aws-otel.github.io/docs/getting-started/adot-eks-add-on/requirements) in the AWS Distro for OpenTelemetry documentation. +ADOT requires that the `cert-manager` add-on is deployed on the cluster as a prerequisite, otherwise this add-on won’t work if deployed directly using the [https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest](https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest) `cluster_addons` property. For more requirements, see [Requirements for Getting Started with AWS Distro for OpenTelemetry using EKS Add-Ons](https://aws-otel.github.io/docs/getting-started/adot-eks-add-on/requirements) in the AWS Distro for OpenTelemetry documentation. @@ -328 +329 @@ ADOT requires that `cert-manager` is deployed on the cluster as a prerequisite, -The Amazon GuardDuty agent Amazon EKS add-on is a security monitoring service that analyzes and processes [foundational data sources](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html) including AWS CloudTrail management events and Amazon VPC flow logs. Amazon GuardDuty also processes [features](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-features-activation-model.html), such as Kubernetes audit logs and runtime monitoring. +The Amazon GuardDuty agent Amazon EKS add-on collects [runtime events](https://docs.aws.amazon.com/guardduty/latest/ug/runtime-monitoring-collected-events.html) (file access, process execution, network connections) from your EKS cluster nodes for analysis by GuardDuty Runtime Monitoring. GuardDuty itself (not the agent) is the security monitoring service that analyzes and processes [foundational data sources](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html) including AWS CloudTrail management events and Amazon VPC flow logs, as well as [features](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-features-activation-model.html), such as Kubernetes audit logs and runtime monitoring. @@ -369,0 +371,29 @@ For more information, see [Install the CloudWatch agent](https://docs.aws.amazon +## AWS Private CA Connector for Kubernetes + +The AWS Private CA Connector for Kubernetes is an add-on for cert-manager that enables users to obtain Certificates from AWS Private Certificate Authority (AWS Private CA). + + * The Amazon EKS add-on name is `aws-privateca-connector-for-kubernetes`. + + * The add-on namespace is `aws-privateca-issuer`. + + + + +This add-on requires the `cert-manager` community add-on. For more information about this add-on, see [Cert Manager](./community-addons.html#addon-cert-manager). For more information about installing add-ons, see [Create an Amazon EKS add-on](./creating-an-add-on.html). + +### Required IAM permissions + +This add-on requires IAM permissions. + +Use EKS Pod Identities to attach the `AWSPrivateCAConnectorForKubernetesPolicy` IAM Policy to the `aws-privateca-issuer` Kubernetes Service Account. For more information, see [Use Pod Identities to assign an IAM role to an Amazon EKS add-on](./update-addon-role.html). + +For information about the required permissions, see [AWSPrivateCAConnectorForKubernetesPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPrivateCAConnectorForKubernetesPolicy.html) in the AWS Managed Policy Reference. + +### Additional information + +For more information, see the [AWS Private CA Issuer for Kubernetes GitHub repository](https://github.com/cert-manager/aws-privateca-issuer). + +For more information about configuring the add-on, see [values.yaml](https://github.com/cert-manager/aws-privateca-issuer/blob/main/charts/aws-pca-issuer/values.yaml) in the `aws-privateca-issuer` GitHub repo. Confirm the version of values.yaml matches the version of the add-on installed on your cluster. + +This add-on tolerates the `CriticalAddonsOnly` taint used by the `system` NodePool of EKS Auto Mode. For more information, see [Run critical add-ons on dedicated instances](./critical-workload.html). + @@ -382 +412 @@ The Amazon EKS add-on name is `eks-pod-identity-agent`. -This add-on users permissions from the [Amazon EKS node IAM role](./create-node-role.html). +The Pod Identity Agent add-on itself does not require an IAM role. It uses permissions from the [Amazon EKS node IAM role](./create-node-role.html) to function, but does not need a dedicated IAM role for the add-on. @@ -386 +416 @@ This add-on users permissions from the [Amazon EKS node IAM role](./create-node- -You can only update one minor version at a time. For example, if your current version is `1.28.x-eksbuild.y` and you want to update to `1.30.x-eksbuild.y`, then you must update your current version to `1.29.x-eksbuild.y` and then update it again to `1.30.x-eksbuild.y`. For more information about updating the add-on, see [Update the Amazon VPC CNI (Amazon EKS add-on)](./vpc-add-on-update.html). +You can only update one minor version at a time. For example, if your current version is `1.28.x-eksbuild.y` and you want to update to `1.30.x-eksbuild.y`, then you must update your current version to `1.29.x-eksbuild.y` and then update it again to `1.30.x-eksbuild.y`. For more information about updating the add-on, see [Update an Amazon EKS add-on](./updating-an-add-on.html).