AWS eks high security documentation change
Summary
Added documentation for new policyendpoints CRD, RBAC permissions, network policy logging details, troubleshooting steps, and known issues including CVE fixes.
Security assessment
The changes include a 'Known issues and solutions' section explicitly addressing CVE vulnerabilities in the Multus CNI image (CVE-XXXX-XXXX) and providing remediation steps. This directly references a security vulnerability. Additionally, the documentation adds details about required RBAC permissions and ClusterRoles for network policy enforcement, which are security-related configurations.
Diff
diff --git a/eks/latest/userguide/network-policies-troubleshooting.md b/eks/latest/userguide/network-policies-troubleshooting.md index 93462e8f6..34a6c1c70 100644 --- a//eks/latest/userguide/network-policies-troubleshooting.md +++ b//eks/latest/userguide/network-policies-troubleshooting.md @@ -1 +1 @@ -[](/pdfs/eks/latest/userguide/eks-ug.pdf#network-policies-troubleshooting "Open PDF")[](https://github.com/awsdocs/amazon-eks-user-guide/tree/mainline/latest/ug/networking/network-policies-troubleshooting.adoc "Edit this page on GitHub") +[](/pdfs/eks/latest/userguide/eks-ug.pdf#network-policies-troubleshooting "Open PDF")[](https://github.com/awsdocs/amazon-eks-user-guide/tree/mainline/latest/ug/network-policies-troubleshooting.xml "Edit this page on GitHub") @@ -5 +5 @@ -Network policy logsSend network policy logs to Amazon CloudWatch LogsIncluded eBPF SDK +New policyendpoints CRD and permissionsNetwork policy logsIncluded eBPF SDKKnown issues and solutions @@ -12,0 +13,19 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t +This is the troubleshooting guide for network policy feature of the Amazon VPC CNI. + +This guide covers: + + * Install information, CRD and RBAC permissions New policyendpoints CRD and permissions + + * Logs to examine when diagnosing network policy problems Network policy logs + + * Running the eBPF SDK collection of tools to troubleshoot + + * Known issues and solutions Known issues and solutions + + + + +###### Note + +Note that network policies are only applied to pods that are made by Kubernetes _Deployments_. For more limitations of the network policies in the VPC CNI, see [Considerations](./cni-network-policy.html#cni-network-policy-considerations). + @@ -14,0 +34,174 @@ You can troubleshoot and investigate network connections that use network polici +## New `policyendpoints` CRD and permissions + + * CRD: `policyendpoints.networking.k8s.aws` + + * Kubernetes API: `apiservice` called `v1.networking.k8s.io` + + * Kubernetes resource: `Kind: NetworkPolicy` + + * RBAC: `ClusterRole` called `aws-node` (VPC CNI), `ClusterRole` called `eks:network-policy-controller` (network policy controller in EKS cluster control plane) + + + + +For network policy, the VPC CNI creates a new `CustomResourceDefinition` (CRD) called `policyendpoints.networking.k8s.aws`. The VPC CNI must have permissions to create the CRD and create CustomResources (CR) of this and the other CRD installed by the VPC CNI (`eniconfigs.crd.k8s.amazonaws.com`). Both of the CRDs are available in the [`crds.yaml` file](https://github.com/aws/amazon-vpc-cni-k8s/blob/master/charts/aws-vpc-cni/crds/customresourcedefinition.yaml) on GitHub. Specifically, the VPC CNI must have "get", "list", and "watch" verb permissions for `policyendpoints`. + +The Kubernetes _Network Policy_ is part of the `apiservice` called `v1.networking.k8s.io`, and this is `apiversion: networking.k8s.io/v1` in your policy YAML files. The VPC CNI `DaemonSet` must have permissions to use this part of the Kubernetes API. + +The VPC CNI permissions are in a `ClusterRole` called `aws-node`. Note that `ClusterRole` objects aren’t grouped in namespaces. The following shows the `aws-node` of a cluster: + + + kubectl get clusterrole aws-node -o yaml + + + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + labels: + app.kubernetes.io/instance: aws-vpc-cni + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: aws-node + app.kubernetes.io/version: v1.19.4 + helm.sh/chart: aws-vpc-cni-1.19.4 + k8s-app: aws-node + name: aws-node + rules: + - apiGroups: + - crd.k8s.amazonaws.com + resources: + - eniconfigs + verbs: + - list + - watch + - get + - apiGroups: + - "" + resources: + - namespaces + verbs: + - list + - watch + - get + - apiGroups: + - "" + resources: + - pods + verbs: + - list + - watch + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - watch + - get + - apiGroups: + - "" + - events.k8s.io + resources: + - events + verbs: + - create + - patch + - list + - apiGroups: + - networking.k8s.aws + resources: + - policyendpoints + verbs: + - get + - list + - watch + - apiGroups: + - networking.k8s.aws + resources: + - policyendpoints/status + verbs: + - get + - apiGroups: + - vpcresources.k8s.aws + resources: + - cninodes + verbs: + - get + - list + - watch + - patch + +Also, a new controller runs in the control plane of each EKS cluster. The controller uses the permissions of the `ClusterRole` called `eks:network-policy-controller`. The following shows the `eks:network-policy-controller` of a cluster: + + + kubectl get clusterrole eks:network-policy-controller -o yaml + + + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + labels: + app.kubernetes.io/name: amazon-network-policy-controller-k8s + name: eks:network-policy-controller + rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - networking.k8s.aws + resources: + - policyendpoints + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - networking.k8s.aws + resources: + - policyendpoints/finalizers + verbs: + - update + - apiGroups: + - networking.k8s.aws + resources: + - policyendpoints/status + verbs: + - get + - patch + - update + - apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - get