AWS eks documentation change
Summary
Added section about IP address optimization through prefix delegation to improve pod launch times and scalability
Security assessment
The changes focus on network performance optimization and IP address management rather than addressing security vulnerabilities. While IP exhaustion prevention improves reliability, there's no evidence of patching a security flaw or addressing a specific vulnerability.
Diff
diff --git a/eks/latest/best-practices/aiml-networking.md b/eks/latest/best-practices/aiml-networking.md index 5475d2854..b914d2418 100644 --- a//eks/latest/best-practices/aiml-networking.md +++ b//eks/latest/best-practices/aiml-networking.md @@ -5 +5 @@ -Consider Higher Network Bandwidth or Elastic Fabric Adapter For Applications with High Inter-Node Communication +Consider Higher Network Bandwidth or Elastic Fabric Adapter For Applications with High Inter-Node CommunicationIncrease the number of IP addresses available to enable faster pod launch times @@ -34,0 +35,15 @@ Ensure tools like MPI and NCCL are installed in your container image to leverage +## Increase the number of IP addresses available to enable faster pod launch times + +In EKS, each pod needs an IP address from the VPC CIDR block. As your cluster scales with more nodes and pods, you risk IP address exhaustion or slower performance, but enabling prefix delegation can mitigate these issues by pre-allocating IP ranges and reducing EC2 API calls, resulting in faster pod launch times and improved scalability. + +Enabling prefix delegation after creating your cluster allows the VPC Container Network Interface (CNI) to assign IP prefixes (/28, each giving 16 IP addresses) to network interfaces on EC2 instances. This means each node can support more pods, reducing the risk of IP shortages. For example, on a `c5.4xlarge` instance, you can support up to 110 pods with prefix delegation. + +While prefix delegation is crucial for optimizing IP usage in environments with many small pods, AI/ML workloads often use fewer, larger pods (e.g., one pod per GPU). Enabling prefix delegation allows the VPC CNI to pre-allocate a prefix for faster pod startup by maintaining a warm pool. This means IP addresses are readily available, reducing the time needed for pod initialization compared to on-demand allocation in non-prefix mode. In such cases, the IP savings from enabling prefix delegation offers performance benefits for AI/ML workloads. By reducing the number of EC2 API calls required for IP address configuration and pre-allocating IP ranges, using prefix delegation enables faster pod launch times, which is particularly beneficial for quickly scaling AI/ML workloads. + +To enable prefix delegation: + + + kubectl set env daemonset/aws-node -n kube-system ENABLE_PREFIX_DELEGATION=true + +Ensure proper planning for VPC subnets to avoid IP address exhaustion, especially in large deployments, and manage CIDR blocks to avoid overlaps across VPCs. To learn more, see [Optimizing IP Address Utilization](./ip-opt.html) and [Assign more IP addresses to Amazon EKS nodes with prefixes](https://docs.aws.amazon.com/eks/latest/best-practices/ip-opt.html#_plan_for_growth). + @@ -43 +58 @@ Compute -Storage +Security