AWS eks documentation change
Summary
Updated documentation to standardize capitalization of 'Pod' (from 'pod') and 'AZs' (from 'AZ'), added clarification about Pod subnet AZ requirements
Security assessment
Changes are primarily grammatical/style improvements (capitalization consistency) and clarifications about subnet/AZ relationships. While the documentation discusses security policies and network controls, these were pre-existing concepts and the changes do not introduce new security-related content or address specific vulnerabilities.
Diff
diff --git a/eks/latest/userguide/create-node-class.md b/eks/latest/userguide/create-node-class.md index a251d6d50..396134e1b 100644 --- a//eks/latest/userguide/create-node-class.md +++ b//eks/latest/userguide/create-node-class.md @@ -142 +142 @@ For information about deploying CloudFormation stacks, see [Getting started with - # must include pod security group selector also + # must include Pod security group selector also @@ -222 +222 @@ For information about deploying CloudFormation stacks, see [Getting started with - * **maximum pod density** \- EKS limits the maximum number of pods on a node to 110. This limit is applied after the existing max pods calculation. For more information, see [Choose an optimal Amazon EC2 node instance type](./choosing-instance-type.html). + * **maximum Pod density** \- EKS limits the maximum number of Pods on a node to 110. This limit is applied after the existing max Pods calculation. For more information, see [Choose an optimal Amazon EC2 node instance type](./choosing-instance-type.html). @@ -230 +230 @@ For information about deploying CloudFormation stacks, see [Getting started with - * If the subnets are in different Availability Zones (AZ), you can use Kubernetes features like [Pod topology spread constraints ](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#pod-topology-spread-constraints) and [Topology Aware Routing](https://kubernetes.io/docs/concepts/services-networking/topology-aware-routing/) to spread pods and traffic across the zones, respectively. + * If the subnets are in different Availability Zones (AZs), you can use Kubernetes features like [Pod topology spread constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#pod-topology-spread-constraints) and [Topology Aware Routing](https://kubernetes.io/docs/concepts/services-networking/topology-aware-routing/) to spread Pods and traffic across the zones, respectively. @@ -232 +232 @@ For information about deploying CloudFormation stacks, see [Getting started with - * If there are multiple subnets _in the same AZ_ that match the `subnetSelectorTerms`, EKS Auto Mode creates pods on each node distributed across the subnets in that AZ. EKS Auto Mode creates secondary network interfaces on each node in the other subnets in the same AZ. It chooses based on the number of available IP addresses in each subnet, to use the subnets more efficiently. However, you can’t specify which subnet EKS Auto Mode uses for each pod; if you need pods to run in specific subnets, use Subnet selection for Pods instead. + * If there are multiple subnets _in the same AZ_ that match the `subnetSelectorTerms`, EKS Auto Mode creates Pods on each node distributed across the subnets in that AZ. EKS Auto Mode creates secondary network interfaces on each node in the other subnets in the same AZ. It chooses based on the number of available IP addresses in each subnet, to use the subnets more efficiently. However, you can’t specify which subnet EKS Auto Mode uses for each Pod; if you need Pods to run in specific subnets, use Subnet selection for Pods instead. @@ -239 +239 @@ For information about deploying CloudFormation stacks, see [Getting started with -The `podSubnetSelectorTerms` and `podSecurityGroupSelectorTerms` fields enables advanced networking configurations by allowing pods to run in different subnets than their nodes. This separation provides enhanced control over network traffic routing and security policies. Note that `podSecurityGroupSelectorTerms` are required with the `podSubnetSelectorTerms`. +The `podSubnetSelectorTerms` and `podSecurityGroupSelectorTerms` fields enables advanced networking configurations by allowing Pods to run in different subnets than their nodes. This separation provides enhanced control over network traffic routing and security policies. Note that `podSecurityGroupSelectorTerms` are required with the `podSubnetSelectorTerms`. @@ -245 +245 @@ Use `podSubnetSelectorTerms` when you need to: - * Separate infrastructure traffic (node-to-node communication) from application traffic (pod-to-pod communication) + * Separate infrastructure traffic (node-to-node communication) from application traffic (Pod-to-Pod communication) @@ -247 +247 @@ Use `podSubnetSelectorTerms` when you need to: - * Apply different network configurations to node subnets than pod subnets. + * Apply different network configurations to node subnets than Pod subnets. @@ -249 +249 @@ Use `podSubnetSelectorTerms` when you need to: - * Implement different security policies or routing rules for nodes and pods. + * Implement different security policies or routing rules for nodes and Pods. @@ -251 +251 @@ Use `podSubnetSelectorTerms` when you need to: - * Configure reverse proxies or network filtering specifically for node traffic without affecting pod traffic. Use `advancedNetworking` and `certificateBundles` to define your reverse proxy and any self-signed or private certificates for the proxy. + * Configure reverse proxies or network filtering specifically for node traffic without affecting Pod traffic. Use `advancedNetworking` and `certificateBundles` to define your reverse proxy and any self-signed or private certificates for the proxy. @@ -276 +276 @@ Use `podSubnetSelectorTerms` when you need to: - # Separate subnets for pods + # Separate subnets for Pods @@ -286 +286 @@ Use `podSubnetSelectorTerms` when you need to: -### Considerations for subnet selectors for pods +### Considerations for subnet selectors for Pods @@ -288 +288 @@ Use `podSubnetSelectorTerms` when you need to: - * **Reduced pod density** : Fewer pods can run on each node when using `podSubnetSelectorTerms`, because the primary network interface of the node is in the node subnet, and can’t be used for pods in the pod subnet. + * **Reduced Pod density** : Fewer Pods can run on each node when using `podSubnetSelectorTerms`, because the primary network interface of the node is in the node subnet, and can’t be used for Pods in the Pod subnet. @@ -290 +290 @@ Use `podSubnetSelectorTerms` when you need to: - * **Subnet selector limitations** : The standard `subnetSelectorTerms` and `securityGroupSelectorTerms` configurations don’t apply to pod subnet selection. + * **Subnet selector limitations** : The standard `subnetSelectorTerms` and `securityGroupSelectorTerms` configurations don’t apply to Pod subnet selection. @@ -292 +292 @@ Use `podSubnetSelectorTerms` when you need to: - * **Network planning** : Ensure adequate IP address space in both node and pod subnets to support your workload requirements. + * **Network planning** : Ensure adequate IP address space in both node and Pod subnets to support your workload requirements. @@ -294 +294,3 @@ Use `podSubnetSelectorTerms` when you need to: - * **Routing configuration** : Verify that route table and network Access Control List (ACL) of the pod subnets are properly configured for communication between node and pod subnets. + * **Routing configuration** : Verify that route table and network Access Control List (ACL) of the Pod subnets are properly configured for communication between node and Pod subnets. + + * **Availability Zones** : Verify that you’ve created Pod subnets across multiple AZs. If you are using specific Pod subnet, it must be in the same AZ as the node subnet AZ.