AWS eks documentation change
Summary
Updated networking documentation with NodeClass formatting, added network policy support, and clarified pod subnet isolation capabilities
Security assessment
The changes document security-adjacent features like network policy enforcement (Calico/Cilium) and pod traffic isolation via subnets, but do not address specific vulnerabilities. These are general security best practice implementations.
Diff
diff --git a/eks/latest/userguide/auto-networking.md b/eks/latest/userguide/auto-networking.md index 7bd24ab7e..d3ce21e17 100644 --- a//eks/latest/userguide/auto-networking.md +++ b//eks/latest/userguide/auto-networking.md @@ -13 +13 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -This topic explains how to configure Virtual Private Cloud (VPC) networking and load balancing features in EKS Auto Mode. While EKS Auto Mode manages most networking components automatically, you can still customize certain aspects of your cluster’s networking configuration through NodeClass resources and load balancer annotations. +This topic explains how to configure Virtual Private Cloud (VPC) networking and load balancing features in EKS Auto Mode. While EKS Auto Mode manages most networking components automatically, you can still customize certain aspects of your cluster’s networking configuration through `NodeClass` resources and load balancer annotations. @@ -15 +15 @@ This topic explains how to configure Virtual Private Cloud (VPC) networking and -When you use EKS Auto Mode, AWS manages the VPC Container Network Interface (CNI) configuration and load balancer provisioning for your cluster. You can influence networking behaviors by defining NodeClass objects and applying specific annotations to your Service and Ingress resources, while maintaining the automated operational model that EKS Auto Mode provides. +When you use EKS Auto Mode, AWS manages the VPC Container Network Interface (CNI) configuration and load balancer provisioning for your cluster. You can influence networking behaviors by defining `NodeClass` objects and applying specific annotations to your Service and Ingress resources, while maintaining the automated operational model that EKS Auto Mode provides. @@ -23 +23 @@ Configuration options for the previous AWS VPC CNI will not apply to EKS Auto Mo -### Configure networking with NodeClass +### Configure networking with a `NodeClass` @@ -25 +25 @@ Configuration options for the previous AWS VPC CNI will not apply to EKS Auto Mo -The NodeClass resource in EKS Auto Mode allows you to customize certain aspects of the networking capability. Through NodeClass, you can specify security group selections, control node placement across VPC subnets, set SNAT policies, configure network policies, and enable network event logging. This approach maintains the automated operational model of EKS Auto Mode while providing flexibility for network customization. +The `NodeClass` resource in EKS Auto Mode allows you to customize certain aspects of the networking capability. Through `NodeClass`, you can specify security group selections, control node placement across VPC subnets, set SNAT policies, configure network policies, and enable network event logging. This approach maintains the automated operational model of EKS Auto Mode while providing flexibility for network customization. @@ -27 +27 @@ The NodeClass resource in EKS Auto Mode allows you to customize certain aspects -You can use a NodeClass to: +You can use a `NodeClass` to: @@ -34,0 +35,2 @@ You can use a NodeClass to: + * Enable Kubernetes _network policies_ including: + @@ -38,0 +41,2 @@ You can use a NodeClass to: + * Isolate pod traffic from the node traffic by attaching pods to different subnets. + @@ -52 +56 @@ EKS Auto Mode supports: - * Pods in public or private subnets. + * Nodes and Pods in public or private subnets. @@ -63 +67 @@ EKS Auto Mode does **not** support: - * Custom Networking. The IP Addresses of Pods and Nodes must be from the same CIDR Block. + * Custom Networking in the `ENIConfig`. You can put pods in multiple subnets or exclusively isolate them from the node traffic with [Subnet selection for Pods](./create-node-class.html#pod-subnet-selector). @@ -71 +75 @@ EKS Auto Mode does **not** support: - * Other configurations supported by the open-source AWS CNI. + * Other configurations supported by the open source AWS VPC CNI.