AWS eks documentation change
Summary
Added BGP configuration details for Cilium, including operator restart requirements and ASN parameter clarifications.
Security assessment
Operational guidance for BGP setup without security-specific context. Changes focus on network configuration rather than security controls.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-cni.md b/eks/latest/userguide/hybrid-nodes-cni.md index 1d916f146..7186df1e5 100644 --- a//eks/latest/userguide/hybrid-nodes-cni.md +++ b//eks/latest/userguide/hybrid-nodes-cni.md @@ -129 +129,9 @@ BGP | Yes (Cilium Control Plane) | Yes - 6. To use BGP with Cilium to advertise your pod addresses with your on-premises network, you must have installed Cilium with `bgpControlPlane.enabled: true`. To configure BGP in Cilium, first create a file called `cilium-bgp-cluster.yaml` with a `CiliumBGPClusterConfig` with the `peerAddress` set to your on-premises router IP that you are peering with. Configure the `localASN` and `peerASN` based on your on-premises router configuration, which you might have to obtain from your network administrator. + 6. To use BGP with Cilium to advertise your pod addresses with your on-premises network, you must have installed Cilium with `bgpControlPlane.enabled: true`. If you are enabling BGP for an existing Cilium deployment, you must restart the Cilium operator to apply the BGP configuration if BGP was not previously enabled. You can set `operator.rollOutPods` to `true` in your Helm values to restart the Cilium operator as part of the Helm install/upgrade process. + +To configure BGP in Cilium, first create a file called `cilium-bgp-cluster.yaml` with a `CiliumBGPClusterConfig` definition. You may need to obtain the following information from your network administrator. + + * Configure `localASN` with the ASN for the nodes running Cilium. + + * Configure `peerASN` with the ASN for your on-premises router. + + * Configure the `peerAddress` with the on-premises router IP that each node running Cilium will peer with. @@ -144 +152 @@ BGP | Yes (Cilium Control Plane) | Yes - localASN: ONPREM_ROUTER_ASN + localASN: NODES_ASN @@ -147 +155 @@ BGP | Yes (Cilium Control Plane) | Yes - peerASN: PEER_ASN + peerASN: ONPREM_ROUTER_ASN