AWS eks documentation change
Summary
Added documentation for pod subnet selection, including configuration examples and considerations for separating node/pod traffic. Enhanced IAM permission notes and networking best practices.
Security assessment
The changes introduce podSubnetSelectorTerms and podSecurityGroupSelectorTerms to enable network segmentation between nodes and pods. While this supports security best practices (like traffic isolation and separate security policies), there's no evidence of addressing a specific vulnerability. The documentation explains security-relevant features rather than patching a security issue.
Diff
diff --git a/eks/latest/userguide/create-node-class.md b/eks/latest/userguide/create-node-class.md index 6ec1ad3f4..0587192be 100644 --- a//eks/latest/userguide/create-node-class.md +++ b//eks/latest/userguide/create-node-class.md @@ -5 +5 @@ -Create a Node ClassCreate node class access entryNode Class SpecificationConsiderations +Create a Node ClassCreate node class access entryNode Class SpecificationConsiderationsSubnet selection for Pods @@ -13 +13 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -Amazon EKS Node Classes offer granular control over the configuration of your EKS Auto Mode managed nodes. A Node Class defines infrastructure-level settings that apply to groups of nodes in your EKS cluster, including network configuration, storage settings, and resource tagging. This topic explains how to create and configure a Node Class to meet your specific operational requirements. +Amazon EKS Node Classes are templates that offer granular control over the configuration of your EKS Auto Mode managed nodes. A Node Class defines infrastructure-level settings that apply to groups of nodes in your EKS cluster, including network configuration, storage settings, and resource tagging. This topic explains how to create and configure a Node Class to meet your specific operational requirements. @@ -19 +19 @@ When you need to customize how EKS Auto Mode provisions and configures EC2 insta -To create a Node Class, follow these steps: +To create a `NodeClass`, follow these steps: @@ -127,0 +128,8 @@ For information about deploying CloudFormation stacks, see [Getting started with + # Optional: Pod subnet selector for advanced networking + podSubnetSelectorTerms: + - tags: + Name: "pod-subnet" + kubernetes.io/role/pod: "1" + # Alternative using direct subnet ID + # - id: "subnet-0987654321fedcba0" + @@ -162 +170 @@ For information about deploying CloudFormation stacks, see [Getting started with - # Optional: Custom certificate bundles + # Optional: Custom certificate bundles. @@ -181 +189,67 @@ For information about deploying CloudFormation stacks, see [Getting started with - * If you change the Node IAM Role associated with a NodeClass, you will need to create a new Access Entry. EKS automatically creates an Access Entry for the Node IAM Role during cluster creation. The Node IAM Role requires the `AmazonEKSAutoNodePolicy` EKS Access Policy. For more information, see [Grant IAM users access to Kubernetes with EKS access entries](./access-entries.html). + * **Replace the node IAM role** \- If you change the node IAM role associated with a `NodeClass`, you will need to create a new Access Entry. EKS automatically creates an Access Entry for the node IAM role during cluster creation. The node IAM role requires the `AmazonEKSAutoNodePolicy` EKS Access Policy. For more information, see [Grant IAM users access to Kubernetes with EKS access entries](./access-entries.html). + + * **maximum pod density** \- EKS limits the maximum number of pods on a node to 110. This limit is applied after the existing max pods calculation. For more information, see [Choose an optimal Amazon EC2 node instance type](./choosing-instance-type.html). + + * **Tags** \- If you want to propagate tags from Kubernetes to EC2, you need to configure additional IAM permissions. For more information, see [Learn about identity and access in EKS Auto Mode](./auto-learn-iam.html). + + * **Default node class** \- Do not name your custom node class `default`. This is because EKS Auto Mode includes a `NodeClass` called `default` that is automatically provisioned when you enable at least one built-in `NodePool`. For information about enabling built-in `NodePools`, see [Enable or Disable Built-in NodePools](./set-builtin-node-pools.html). + + * **`subnetSelectorTerms` behavior with multiple subnets** \- If there are multiple subnets that match the `subnetSelectorTerms` conditions or that you provide by ID, EKS Auto Mode creates nodes distributed across the subnets. + + * If the subnets are in different Availability Zones (AZ), you can use Kubernetes features like [Pod topology spread constraints ](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#pod-topology-spread-constraints) and [Topology Aware Routing](https://kubernetes.io/docs/concepts/services-networking/topology-aware-routing/) to spread pods and traffic across the zones, respectively. + + * If there are multiple subnets _in the same AZ_ that match the `subnetSelectorTerms`, EKS Auto Mode creates pods on each node distributed across the subnets in that AZ. EKS Auto Mode creates secondary network interfaces on each node in the other subnets in the same AZ. It chooses based on the number of available IP addresses in each subnet, to use the subnets more efficiently. However, you can’t specify which subnet EKS Auto Mode uses for each pod; if you need pods to run in specific subnets, use Subnet selection for Pods instead. + + + + +## Subnet selection for Pods + +The `podSubnetSelectorTerms` and `podSecurityGroupSelectorTerms` fields enables advanced networking configurations by allowing pods to run in different subnets than their nodes. This separation provides enhanced control over network traffic routing and security policies. Note that `podSecurityGroupSelectorTerms` are required with the `podSubnetSelectorTerms`. + +### Use cases + +Use `podSubnetSelectorTerms` when you need to: + + * Separate infrastructure traffic (node-to-node communication) from application traffic (pod-to-pod communication) + + * Apply different network configurations to node subnets than pod subnets. + + * Implement different security policies or routing rules for nodes and pods. + + * Configure reverse proxies or network filtering specifically for node traffic without affecting pod traffic. Use `advancedNetworking` and `certificateBundles` to define your reverse proxy and any self-signed or private certificates for the proxy. + + + + +### Example configuration + + + apiVersion: eks.amazonaws.com/v1 + kind: NodeClass + metadata: + name: advanced-networking + spec: + role: MyNodeRole + + # Subnets for EC2 instances (nodes) + subnetSelectorTerms: + - tags: + Name: "node-subnet" + kubernetes.io/role/internal-elb: "1" + + securityGroupSelectorTerms: + - tags: + Name: "eks-cluster-sg" + + # Separate subnets for pods + podSubnetSelectorTerms: + - tags: + Name: "pod-subnet" + kubernetes.io/role/pod: "1" + + podSecurityGroupSelectorTerms: + - tags: + Name: "eks-pod-sg" + +### Considerations for subnet selectors for pods @@ -183 +257 @@ For information about deploying CloudFormation stacks, see [Getting started with - * EKS limits the maximum number of pods on a node to 110. This limit is applied after the existing max pods calculation. For more information, see [Choose an optimal Amazon EC2 node instance type](./choosing-instance-type.html). + * **Reduced pod density** : Fewer pods can run on each node when using `podSubnetSelectorTerms`, because the primary network interface of the node is in the node subnet, and can’t be used for pods in the pod subnet. @@ -185 +259 @@ For information about deploying CloudFormation stacks, see [Getting started with - * If you want to propagate tags from Kubernetes to EC2, you need to configure additional IAM permissions. For more information, see [Learn about identity and access in EKS Auto Mode](./auto-learn-iam.html). + * **Subnet selector limitations** : The standard `subnetSelectorTerms` and `securityGroupSelectorTerms` configurations don’t apply to pod subnet selection. @@ -187 +261 @@ For information about deploying CloudFormation stacks, see [Getting started with - * Do not name your custom node class `default`. + * **Network planning** : Ensure adequate IP address space in both node and pod subnets to support your workload requirements. @@ -189 +263 @@ For information about deploying CloudFormation stacks, see [Getting started with - * EKS Auto Mode includes a `default` NodeClass that is automatically provisioned when at least one built-in NodePool is enabled. For information about enabling built-in NodePools, see [Enable or Disable Built-in NodePools](./set-builtin-node-pools.html). + * **Routing configuration** : Verify that route table and network Access Control List (ACL) of the pod subnets are properly configured for communication between node and pod subnets.