AWS eks medium security documentation change
Summary
Added ECR credential provider configuration details and TLS bootstrap settings to Bottlerocket hybrid node documentation
Security assessment
The addition of 'server-tls-bootstrap = true' enables secure TLS certificate bootstrapping for node authentication. The new ECR credential provider configuration with image patterns ensures proper authentication for container image pulls from approved registries, addressing potential unauthorized access risks. These changes directly implement security controls for node communication and image provenance.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-bottlerocket.md b/eks/latest/userguide/hybrid-nodes-bottlerocket.md index fdf21b6b4..a9632c657 100644 --- a//eks/latest/userguide/hybrid-nodes-bottlerocket.md +++ b//eks/latest/userguide/hybrid-nodes-bottlerocket.md @@ -15 +15 @@ This topic describes how to connect hybrid nodes running Bottlerocket to an Amaz -Only VMware variants of Bottlerocket version v1.37.0 and above are supported with EKS Hybrid Nodes. VMware variants of Bottlerocket are available for Kubernetes versions v1.28 and above. The OS images for these variants include the kubelet, containerd, aws-iam-authenticator and other software prerequisites for EKS Hybrid Nodes. You can configure these components using a Bottlerocket [settings](https://github.com/bottlerocket-os/bottlerocket?tab=readme-ov-file#settings) file that includes base64 encoded user-data for the Bottlerocket bootstrap and admin containers. Configuring these settings enables Bottlerocket to use your hybrid nodes credentials provider to authenticate hybrid nodes to your cluster. After your hybrid nodes join the cluster, they will appear with status `Not Ready` in the Amazon EKS console and in Kubernetes-compatible tooling such as `kubectl`. After completing the steps on this page, proceed to [Configure CNI for hybrid nodes](./hybrid-nodes-cni.html) to make your hybrid nodes ready to run applications. +Only VMware variants of Bottlerocket version v1.37.0 and above are supported with EKS Hybrid Nodes. VMware variants of Bottlerocket are available for Kubernetes versions v1.28 and above. The OS images for these variants include the kubelet, containerd, aws-iam-authenticator and other software prerequisites for EKS Hybrid Nodes. You can configure these components using a Bottlerocket [settings](https://github.com/bottlerocket-os/bottlerocket#settings) file that includes base64 encoded user-data for the Bottlerocket bootstrap and admin containers. Configuring these settings enables Bottlerocket to use your hybrid nodes credentials provider to authenticate hybrid nodes to your cluster. After your hybrid nodes join the cluster, they will appear with status `Not Ready` in the Amazon EKS console and in Kubernetes-compatible tooling such as `kubectl`. After completing the steps on this page, proceed to [Configure CNI for hybrid nodes](./hybrid-nodes-cni.html) to make your hybrid nodes ready to run applications. @@ -35,0 +36,4 @@ To configure Bottlerocket for hybrid nodes, you need to create a `settings.toml` +###### Note + +The TOML files provided below only represent the minimum required settings for initializing a Bottlerocket VMWare machine as a node on an EKS cluster. Bottlerocket provides a wide range of settings to address several different use cases, so for further configuration options beyond hybrid node initialization, please refer to the [Bottlerocket documentation](https://bottlerocket.dev/en) for the comprehensive list of all documented settings for the Bottlerocket version you are using (for example, [here](https://bottlerocket.dev/en/os/1.51.x/api/settings-index) are all the settings available for Bottlerocket 1.51.x). + @@ -48,0 +53 @@ If you are using AWS Systems Manager as your credential provider, create a `sett + server-tls-bootstrap = true @@ -55,0 +61,12 @@ If you are using AWS Systems Manager as your credential provider, create a `sett + [settings.kubernetes.credential-providers.ecr-credential-provider] + enabled = true + cache-duration = "12h" + image-patterns = [ + "*.dkr.ecr.*.amazonaws.com", + "*.dkr.ecr.*.amazonaws.com.cn", + "*.dkr.ecr.*.amazonaws.eu", + "*.dkr.ecr-fips.*.amazonaws.com", + "*.dkr.ecr-fips.*.amazonaws.eu", + "public.ecr.aws" + ] + @@ -118,0 +136 @@ If you are using AWS IAM Roles Anywhere as your credential provider, create a `s + server-tls-bootstrap = true @@ -126,0 +145,12 @@ If you are using AWS IAM Roles Anywhere as your credential provider, create a `s + [settings.kubernetes.credential-providers.ecr-credential-provider] + enabled = true + cache-duration = "12h" + image-patterns = [ + "*.dkr.ecr.*.amazonaws.com", + "*.dkr.ecr.*.amazonaws.com.cn", + "*.dkr.ecr.*.amazonaws.eu", + "*.dkr.ecr-fips.*.amazonaws.com", + "*.dkr.ecr-fips.*.amazonaws.eu", + "public.ecr.aws" + ] +