AWS eks documentation change
Summary
Updated node group creation instructions to use Amazon Linux 2023 and NodeConfig YAML configuration instead of bootstrap.sh arguments for maxPods configuration. Added nodeadm documentation reference and structured YAML examples.
Security assessment
The changes focus on updating procedures to use newer Amazon Linux versions and a more structured configuration format (NodeConfig). While proper configuration reduces misconfiguration risks, there's no explicit mention of addressing vulnerabilities or security incidents. The removal of direct bootstrap.sh usage improves maintainability but isn't explicitly security-motivated.
Diff
diff --git a/eks/latest/userguide/cni-increase-ip-addresses-procedure.md b/eks/latest/userguide/cni-increase-ip-addresses-procedure.md index d9e3d69e1..61fb6208e 100644 --- a//eks/latest/userguide/cni-increase-ip-addresses-procedure.md +++ b//eks/latest/userguide/cni-increase-ip-addresses-procedure.md @@ -82,5 +82,17 @@ You can replace the example values with a value greater than zero. - 4. Create one of the following types of node groups with at least one Amazon EC2 Nitro Amazon Linux 2 instance type. For a list of Nitro instance types, see [Instances built on the Nitro System](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances) in the Amazon EC2 User Guide. This capability is not supported on Windows. For the options that include `110`, replace it with either the value from step 3 (recommended), or your own value. - - * **Self-managed** – Deploy the node group using the instructions in [Create self-managed Amazon Linux nodes](./launch-workers.html). Specify the following text for the **BootstrapArguments** parameter. - - --use-max-pods false --kubelet-extra-args '--max-pods=110' + 4. Create one of the following types of node groups with at least one Amazon EC2 Nitro Amazon Linux 2023 instance type. For a list of Nitro instance types, see [Instances built on the Nitro System](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances) in the Amazon EC2 User Guide. This capability is not supported on Windows. For the options that include `110`, replace it with either the value from step 3 (recommended), or your own value. + + * **Self-managed** – Deploy the node group using the instructions in [Create self-managed Amazon Linux nodes](./launch-workers.html). Before creating the CloudFormation stack, open the template file and adjust the `UserData` in the `NodeLaunchTemplate` to be like the following + + ... + apiVersion: node.eks.aws/v1alpha1 + kind: NodeConfig + spec: + cluster: + name: ${ClusterName} + apiServerEndpoint: ${ApiServerEndpoint} + certificateAuthority: ${CertificateAuthorityData} + cidr: ${ServiceCidr} + kubelet: + config: + maxPods: 110 + ... @@ -96,5 +108,21 @@ If you’re using `eksctl` to create the node group, you can use the following c - * **With a launch template with a specified AMI ID** – In your launch template, specify an Amazon EKS optimized AMI ID, or a custom AMI built off the Amazon EKS optimized AMI, then [deploy the node group using a launch template](./launch-templates.html) and provide the following user data in the launch template. This user data passes arguments into the `bootstrap.sh` file. For more information about the bootstrap file, see [bootstrap.sh](https://github.com/awslabs/amazon-eks-ami/blob/main/templates/al2/runtime/bootstrap.sh) on GitHub. - - /etc/eks/bootstrap.sh my-cluster \ - --use-max-pods false \ - --kubelet-extra-args '--max-pods=110' + * **With a launch template with a specified AMI ID** – In your launch template, specify an Amazon EKS optimized AMI ID, or a custom AMI built off the Amazon EKS optimized AMI, then [deploy the node group using a launch template](./launch-templates.html) and provide the following user data in the launch template. This user data passes a `NodeConfig` object to be read by the `nodeadm` tool on the node. For more information about `nodeadm`, see [the nodeadm documentation](https://awslabs.github.io/amazon-eks-ami/nodeadm). + + MIME-Version: 1.0 + Content-Type: multipart/mixed; boundary="//" + + --// + Content-Type: application/node.eks.aws + + --- + apiVersion: node.eks.aws/v1alpha1 + kind: NodeConfig + spec: + cluster: + apiServerEndpoint: [.replaceable]`my-cluster` + certificateAuthority: [.replaceable]`LS0t...` + cidr: [.replaceable]`10.100.0.0/16` + name: [.replaceable]`my-cluster + kubelet: + config: + maxPods: [.replaceable]`110` + --//--