AWS eks documentation change
Summary
Updated documentation links and phrasing regarding CNI configuration, CoreDNS recommendations, and AWS Load Balancer Controller installation steps
Security assessment
Changes involve documentation link updates, formatting fixes (adding backticks around 'ip'), and revised installation instructions. No security vulnerabilities or security feature enhancements are mentioned. The CoreDNS replica recommendation relates to availability best practices rather than security.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-add-ons.md b/eks/latest/userguide/hybrid-nodes-add-ons.md index fcc9d94c8..4c204ebb5 100644 --- a//eks/latest/userguide/hybrid-nodes-add-ons.md +++ b//eks/latest/userguide/hybrid-nodes-add-ons.md @@ -44 +44 @@ In addition to the Amazon EKS add-ons in the tables above, the [Amazon Managed S -There are AWS add-ons and community add-ons that aren’t compatible with Amazon EKS Hybrid Nodes. The latest versions of these add-ons have an anti-affinity rule for the default `eks.amazonaws.com/compute-type: hybrid` label applied to hybrid nodes. This prevents them from running on hybrid nodes when deployed in your clusters. If you have clusters with both hybrid nodes and nodes running in AWS Cloud, you can deploy these add-ons in your cluster to nodes running in AWS Cloud. The Amazon VPC CNI is not compatible with hybrid nodes, and Cilium and Calico are supported as the Container Networking Interfaces (CNIs) for Amazon EKS Hybrid Nodes. See [Configure a CNI for hybrid nodes](./hybrid-nodes-cni.html) for more information. +There are AWS add-ons and community add-ons that aren’t compatible with Amazon EKS Hybrid Nodes. The latest versions of these add-ons have an anti-affinity rule for the default `eks.amazonaws.com/compute-type: hybrid` label applied to hybrid nodes. This prevents them from running on hybrid nodes when deployed in your clusters. If you have clusters with both hybrid nodes and nodes running in AWS Cloud, you can deploy these add-ons in your cluster to nodes running in AWS Cloud. The Amazon VPC CNI is not compatible with hybrid nodes, and Cilium and Calico are supported as the Container Networking Interfaces (CNIs) for Amazon EKS Hybrid Nodes. See [Configure CNI for hybrid nodes](./hybrid-nodes-cni.html) for more information. @@ -52 +52 @@ The sections that follow describe differences between running compatible AWS add -EKS installs kube-proxy and CoreDNS as self-managed add-ons by default when you create an EKS cluster with the AWS API and AWS SDKs, including from the AWS CLI. You can overwrite these add-ons with Amazon EKS add-ons after cluster creation. Reference the EKS documentation for details on [Manage kube-proxy in Amazon EKS clusters](./managing-kube-proxy.html) and [Manage CoreDNS for DNS in Amazon EKS clusters](./managing-coredns.html). If you are running a mixed mode cluster with both hybrid nodes and nodes in AWS Cloud, we recommend that you have at least one CoreDNS replica on hybrid nodes and at least one CoreDNS replica on your nodes in AWS Cloud. See [Configure CoreDNS replicas](./hybrid-nodes-webhooks.html#hybrid-nodes-mixed-coredns) for configuration steps. +EKS installs kube-proxy and CoreDNS as self-managed add-ons by default when you create an EKS cluster with the AWS API and AWS SDKs, including from the AWS CLI. You can overwrite these add-ons with Amazon EKS add-ons after cluster creation. Reference the EKS documentation for details on [Manage kube-proxy in Amazon EKS clusters](./managing-kube-proxy.html) and [Manage CoreDNS for DNS in Amazon EKS clusters](./managing-coredns.html). If you are running a mixed mode cluster with both hybrid nodes and nodes in AWS Cloud, AWS recommends to have at least one CoreDNS replica on hybrid nodes and at least one CoreDNS replica on your nodes in AWS Cloud. See [Configure CoreDNS replicas](./hybrid-nodes-webhooks.html#hybrid-nodes-mixed-coredns) for configuration steps. @@ -102 +102 @@ Follow the steps in [Getting Started with AWS Distro for OpenTelemetry using EKS -You can use the [AWS Load Balancer Controller](./aws-load-balancer-controller.html) and Application Load Balancer (ALB) or Network Load Balancer (NLB) with the target type ip for workloads on hybrid nodes connected with AWS Direct Connect or AWS Site-to-Site VPN. The IP target(s) used with the ALB or NLB must be routable from AWS. The AWS Load Balancer controller also uses [webhooks](https://kubernetes.io/docs/reference/access-authn-authz/webhook/). If you run the AWS Load Balancer Controller operator on hybrid nodes, your on-premises pod CIDR must be routable on your on-premises network and you must configure your EKS cluster with your remote pod network. For more information, see [Configure webhooks for hybrid nodes](./hybrid-nodes-webhooks.html). +You can use the [AWS Load Balancer Controller](./aws-load-balancer-controller.html) and Application Load Balancer (ALB) or Network Load Balancer (NLB) with the target type `ip` for workloads on hybrid nodes The IP target(s) used with the ALB or NLB must be routable from AWS. The AWS Load Balancer controller also uses [webhooks](https://kubernetes.io/docs/reference/access-authn-authz/webhook/). If you run the AWS Load Balancer Controller operator on hybrid nodes, your on-premises pod CIDR must be routable on your on-premises network and you must configure your EKS cluster with your remote pod network. For more information, see [Configure webhooks for hybrid nodes](./hybrid-nodes-webhooks.html). @@ -104 +104 @@ You can use the [AWS Load Balancer Controller](./aws-load-balancer-controller.ht -To install the AWS Load Balancer Controller, follow the steps at [Install AWS Load Balancer Controller with Helm](./lbc-helm.html) or [Install AWS Load Balancer Controller with manifests](./lbc-manifest.html). +To install the AWS Load Balancer Controller, follow the steps at [AWS Application Load Balancer](./hybrid-nodes-ingress.html#hybrid-nodes-ingress-alb) or [AWS Network Load Balancer](./hybrid-nodes-load-balancing.html#hybrid-nodes-service-lb-nlb). @@ -106 +106 @@ To install the AWS Load Balancer Controller, follow the steps at [Install AWS Lo -For ingress with ALB, you must specify the annotations below. See [Route application and HTTP traffic with Application Load Balancers](./alb-ingress.html) for instructions. +For ingress with ALB, you must specify the annotations below. See [Route application and HTTP traffic with Application Load Balancers](./alb-ingress.html) for more information. @@ -111 +111 @@ For ingress with ALB, you must specify the annotations below. See [Route applica -For load balancing with NLB, you must specify the annotations below. See [Route TCP and UDP traffic with Network Load Balancers](./network-load-balancing.html) for instructions. +For load balancing with NLB, you must specify the annotations below. See [Route TCP and UDP traffic with Network Load Balancers](./network-load-balancing.html) for more information.