AWS eks documentation change
Summary
Updated documentation to emphasize Cilium as the supported CNI, expanded application networking capabilities (BGP, Ingress, Load Balancing, Network Policies), and added new configuration guides for hybrid nodes
Security assessment
The change adds documentation for Kubernetes Network Policies configuration, which is a security control mechanism for pod communication. However, there is no evidence of addressing a specific security vulnerability. The removal of Calico support and focus on Cilium appears to be a compatibility/maintenance change rather than security-related.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-configure.md b/eks/latest/userguide/hybrid-nodes-configure.md index 3a6cbfcaa..ebec5ca12 100644 --- a//eks/latest/userguide/hybrid-nodes-configure.md +++ b//eks/latest/userguide/hybrid-nodes-configure.md @@ -9 +9 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -# Configure CNI, add-ons, and webhooks for hybrid nodes +# Configure application networking, add-ons, and webhooks for hybrid nodes @@ -11 +11 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -After you configure a cluster for hybrid nodes, Hybrid nodes requires configuration for Container Network Interfaces (CNI), add-ons, webhooks, and possibleproxy settings. For the complete list of the EKS and community add-ons that are compatible with hybrid nodes, see [Configure add-ons for hybrid nodes](./hybrid-nodes-add-ons.html). +After you create an EKS cluster for hybrid nodes, configure additional capabilities for application networking (CNI, BGP, Ingress, Load Balancing, Network Policies), add-ons, webhooks, and proxy settings. For the complete list of the EKS and community add-ons that are compatible with hybrid nodes, see [Configure add-ons for hybrid nodes](./hybrid-nodes-add-ons.html). @@ -13 +13 @@ After you configure a cluster for hybrid nodes, Hybrid nodes requires configurat -**EKS cluster insights** EKS includes insight checks for misconfigurations in your EKS Hybrid Nodes setup that could impair functionality of your cluster or workloads. For more information on cluster insights, see [Prepare for Kubernetes version upgrades and troubleshoot misconfigurations with cluster insights](./cluster-insights.html). +**EKS cluster insights** EKS includes insight checks for misconfigurations in your hybrid nodes setup that could impair functionality of your cluster or workloads. For more information on cluster insights, see [Prepare for Kubernetes version upgrades and troubleshoot misconfigurations with cluster insights](./cluster-insights.html). @@ -15 +15 @@ After you configure a cluster for hybrid nodes, Hybrid nodes requires configurat -The following lists the add-ons and other components that have different configuration for hybrid nodes: +The following lists the common capabilities and add-ons that you can use with hybrid nodes: @@ -17 +17 @@ The following lists the add-ons and other components that have different configu - * **Container Networking Interface (CNI)** : The core capabilities of [Cilium](https://docs.cilium.io/en/stable/index.html) and [Calico](https://docs.tigera.io/calico/latest/about/) are supported for use with hybrid nodes. You can manage your CNI on hybrid nodes with your choice of tooling such as Helm. The AWS VPC CNI can’t be used with hybrid nodes. For more information, see [Configure a CNI for hybrid nodes](./hybrid-nodes-cni.html). + * **Container Networking Interface (CNI)** : AWS supports [Cilium](https://docs.cilium.io/en/stable/index.html) as the CNI for hybrid nodes. For more information, see [Configure CNI for hybrid nodes](./hybrid-nodes-cni.html). Note that the AWS VPC CNI can’t be used with hybrid nodes. @@ -21 +21 @@ The following lists the add-ons and other components that have different configu - * **Ingress and Load Balancing** : You can use the AWS Load Balancer Controller and Application Load Balancer (ALB) or Network Load Balancer (NLB) with the target type `ip` for workloads on hybrid nodes connected with AWS Direct Connect or AWS Site-to-Site VPN. You can alternatively use your choice of Ingress controller or load balancer for application traffic that stays local to your on-premises environment. + * **Ingress and Load Balancing** : You can use the AWS Load Balancer Controller and Application Load Balancer (ALB) or Network Load Balancer (NLB) with the target type `ip` for workloads running on hybrid nodes. AWS supports Cilium’s built-in Ingress, Gateway, and Kubernetes Service load balancing features for workloads running on hybrid nodes. For more information, see [Configure Kubernetes Ingress for hybrid nodes](./hybrid-nodes-ingress.html) and [Configure Services of type LoadBalancer for hybrid nodes](./hybrid-nodes-load-balancing.html). @@ -38 +38 @@ The following lists the add-ons and other components that have different configu - * [Configure a CNI for hybrid nodes](./hybrid-nodes-cni.html) + * [Configure CNI for hybrid nodes](./hybrid-nodes-cni.html) @@ -45,0 +46,8 @@ The following lists the add-ons and other components that have different configu + * [Configure Cilium BGP for hybrid nodes](./hybrid-nodes-cilium-bgp.html) + + * [Configure Kubernetes Ingress for hybrid nodes](./hybrid-nodes-ingress.html) + + * [Configure Services of type LoadBalancer for hybrid nodes](./hybrid-nodes-load-balancing.html) + + * [Configure Kubernetes Network Policies for hybrid nodes](./hybrid-nodes-network-policies.html) +