AWS eks documentation change
Summary
Updated documentation for multi-NIC feature: corrected capitalization consistency, added IPv6 considerations section, clarified IAM policy requirements, and noted incompatibility with security groups for pods.
Security assessment
The changes clarify security-related configurations (e.g., IAM policies for IPv6 clusters) and explicitly state incompatibility with security groups for pods, which is a security feature. However, there is no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/eks/latest/userguide/pod-multiple-network-interfaces.md b/eks/latest/userguide/pod-multiple-network-interfaces.md index 4cc670c5d..364b288e7 100644 --- a//eks/latest/userguide/pod-multiple-network-interfaces.md +++ b//eks/latest/userguide/pod-multiple-network-interfaces.md @@ -23 +23 @@ On Amazon EC2, an _elastic network interface_ is a logical networking component -If the Multi-NIC feature is enabled, the VPC CNI doesn’t assign IP addresses in bulk, which is does by default. Instead, the VPC CNI assigns one IP address to a network interface on each network card on-demand when a new pod starts. This behavior reduces the rate of IP address exhaustion, which is increased by using multi-homed pods. Because the VPC CNI is assigning IP address on-demand, pods might take longer to start on instances with the Multi-NIC feature enabled. +If the multi-NIC feature is enabled, the VPC CNI doesn’t assign IP addresses in bulk, which it does by default. Instead, the VPC CNI assigns one IP address to a network interface on each network card on-demand when a new pod starts. This behavior reduces the rate of IP address exhaustion, which is increased by using multi-homed pods. Because the VPC CNI is assigning IP address on-demand, pods might take longer to start on instances with the multi-NIC feature enabled. @@ -27 +27 @@ If the Multi-NIC feature is enabled, the VPC CNI doesn’t assign IP addresses i - * Ensure that your Kubernetes cluster is running VPC CNI version `1.20.0` and later. The Multi-NIC feature is only available in version `1.20.0` of the VPC CNI or later. + * Ensure that your Kubernetes cluster is running VPC CNI version `1.20.0` and later. The multi-NIC feature is only available in version `1.20.0` of the VPC CNI or later. @@ -35 +35 @@ If the Multi-NIC feature is enabled, the VPC CNI doesn’t assign IP addresses i - * If the Multi-NIC feature is enabled, the VPC CNI doesn’t assign IP addresses in bulk, which is does by default. Because the VPC CNI is assigning IP address on-demand, pods might take longer to start on instances with the Multi-NIC feature enabled. For more information, see the previous section Background. + * If the multi-NIC feature is enabled, the VPC CNI doesn’t assign IP addresses in bulk, which it does by default. Because the VPC CNI is assigning IP address on-demand, pods might take longer to start on instances with the multi-NIC feature enabled. For more information, see the previous section Background. @@ -37 +37 @@ If the Multi-NIC feature is enabled, the VPC CNI doesn’t assign IP addresses i - * With the Multi-NIC feature enabled, pods don’t have multiple network interfaces by default. You must configure each workload to use multi-NIC. Add the `k8s.amazonaws.com/nicConfig: multi-nic-attachment` annotation to workloads that should have multiple network interfaces. + * With the multi-NIC feature enabled, pods don’t have multiple network interfaces by default. You must configure each workload to use multi-NIC. Add the `k8s.amazonaws.com/nicConfig: multi-nic-attachment` annotation to workloads that should have multiple network interfaces. @@ -39 +39,6 @@ If the Multi-NIC feature is enabled, the VPC CNI doesn’t assign IP addresses i - * `IPv6` \- For `IPv6` clusters, create and use the following custom IAM policy for the VPC CNI. This policy is specific to multi-NIC. For more general information about using the VPC CNI with `IPv6` clusters, see [Learn about IPv6 addresses to clusters, Pods, and services](./cni-ipv6.html). + + + +### `IPv6` Considerations + + * **Custom IAM policy** \- For `IPv6` clusters, create and use the following custom IAM policy for the VPC CNI. This policy is specific to multi-NIC. For more general information about using the VPC CNI with `IPv6` clusters, see [Learn about IPv6 addresses to clusters, Pods, and services](./cni-ipv6.html). @@ -71,0 +77,2 @@ If the Multi-NIC feature is enabled, the VPC CNI doesn’t assign IP addresses i + * `IPv6` **transition mechanism not available** \- If you use the multi-NIC feature, the VPC CNI doesn’t assign an `IPv4` address to pods on an `IPv6` cluster. Otherwise, the VPC CNI assigns a host-local `IPv4` address to each pod so that a pod can communicate with external `IPv4` resources in another Amazon VPC or the internet. + @@ -77 +84 @@ If the Multi-NIC feature is enabled, the VPC CNI doesn’t assign IP addresses i -After the Multi-NIC feature is enabled in the VPC CNI and the `aws-node` pods have restarted, you can configure each workload to be multi-homed. The following example of a YAML configuration with the required annotation: +After the multi-NIC feature is enabled in the VPC CNI and the `aws-node` pods have restarted, you can configure each workload to be multi-homed. The following example of a YAML configuration with the required annotation: @@ -95 +102 @@ After the Multi-NIC feature is enabled in the VPC CNI and the `aws-node` pods ha - **k8s****.amazonaws.com/nicConfig: multi-nic-attachment** + k8s.amazonaws.com/nicConfig: multi-nic-attachment @@ -181 +188 @@ No. When your workload is configured to use multiple NICs on a supported instanc -Network cards that _only_ have an **EFA-only** device attached to it is skipped by the VPC CNI. +Network cards that _only_ have an **EFA-only** device attached to it are skipped by the VPC CNI. @@ -190,0 +198,2 @@ Yes, the multi-NIC feature in the VPC CNI works with both _custom networking_ an +The multi-NIC feature in the VPC CNI doesn’t work with and can’t be combined with _security groups for pods_. +