AWS eks medium security documentation change
Summary
Updated documentation to add Kubernetes 1.32 support, including breaking changes, new features, and deprecation notices. Added a new section on anonymous authentication restrictions and moved previous version content down.
Security assessment
The change explicitly documents a security enhancement: starting with EKS 1.32, anonymous authentication is restricted to specific health check endpoints only. This prevents unintended cluster access due to misconfigured RBAC policies. The change also mentions deprecation of ServiceAccount annotation for mountable secrets, which is a security-related feature. The documentation of these security changes provides concrete evidence of addressing potential security weaknesses.
Diff
diff --git a/eks/latest/userguide/kubernetes-versions-extended.md b/eks/latest/userguide/kubernetes-versions-extended.md index 9681dfe67..d9a59fdd8 100644 --- a//eks/latest/userguide/kubernetes-versions-extended.md +++ b//eks/latest/userguide/kubernetes-versions-extended.md @@ -5 +5 @@ -Kubernetes 1.31Kubernetes 1.30Kubernetes 1.29 +Kubernetes 1.32Kubernetes 1.31Kubernetes 1.30 @@ -17 +17 @@ This topic gives important changes to be aware of for each Kubernetes version in -## Kubernetes 1.31 +## Kubernetes 1.32 @@ -19 +19 @@ This topic gives important changes to be aware of for each Kubernetes version in -Kubernetes `1.31` is now available in Amazon EKS. For more information about Kubernetes `1.31`, see the [official release announcement](https://kubernetes.io/blog/2024/08/13/kubernetes-v1-31-release/). +Kubernetes `1.32` is now available in Amazon EKS. For more information about Kubernetes `1.32`, see the [official release announcement](https://kubernetes.io/blog/2024/12/11/kubernetes-v1-32-release/). @@ -23 +23 @@ Kubernetes `1.31` is now available in Amazon EKS. For more information about Kub - * The kubelet flag `--keep-terminated-pod-volumes` deprecated since 2017 has been removed as part of the version `1.31` release. This change impacts how terminated pod volumes are handled by the kubelet. If you are using this flag in your node configurations, you must update your bootstrap scripts and launch templates to remove it before upgrading. + * The `flowcontrol.apiserver.k8s.io/v1beta3` API version of FlowSchema and PriorityLevelConfiguration has been removed in version `1.32`. If you are using these APIs, you must update your configurations to use the latest supported version before upgrading. @@ -24,0 +25 @@ Kubernetes `1.31` is now available in Amazon EKS. For more information about Kub + * ServiceAccount `metadata.annotations[kubernetes.io/enforce-mountable-secrets]` has been deprecated in version `1.32` and will be removed in a future Kubernetes minor version release. It is recommended to use separate namespaces to isolate access to mounted secrets. @@ -25,0 +27 @@ Kubernetes `1.31` is now available in Amazon EKS. For more information about Kub + * Kubernetes version `1.32` is the last version for which Amazon EKS will release Amazon Linux 2 (AL2) AMIs. From version `1.33` onwards, Amazon EKS will continue to release Amazon Linux 2023 (AL2023) and Bottlerocket based AMIs. @@ -28 +29,0 @@ Kubernetes `1.31` is now available in Amazon EKS. For more information about Kub - * The beta `VolumeAttributesClass` feature gate and API resource is enabled in Amazon EKS version `1.31`. This feature allows cluster operators to modify mutable properties of Persistent Volumes (PVs) managed by compatible CSI Drivers, including the Amazon EBS CSI Driver. To leverage this feature, ensure that your CSI Driver supports the `VolumeAttributesClass` feature (for the Amazon EBS CSI Driver, upgrade to version `1.35.0` or later to automatically enable the feature). You will be able to create `VolumeAttributesClass` objects to define the desired volume attributes, such as volume type and throughput, and associate them with your Persistent Volume Claims (PVCs). See the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/) as well as the documentation of your CSI driver for more information. @@ -30 +30,0 @@ Kubernetes `1.31` is now available in Amazon EKS. For more information about Kub - * For more information about the Amazon EBS CSI Driver, see [Use Kubernetes volume storage with Amazon EBS](./ebs-csi.html). @@ -32 +32 @@ Kubernetes `1.31` is now available in Amazon EKS. For more information about Kub - * Kubernetes support for [AppArmor](https://apparmor.net/) has graduated to stable and is now generally available for public use. This feature allows you to protect your containers with AppArmor by setting the `appArmorProfile.type` field in the container’s `securityContext`. Prior to Kubernetes version `1.30`, AppArmor was controlled by annotations. Starting with version `1.30`, it is controlled using fields. To leverage this feature, we recommend migrating away from annotations and using the `appArmorProfile.type` field to ensure that your workloads are compatible. + * The Memory Manager feature has graduated to Generally Available (GA) status in Kubernetes version `1.32`. This enhancement provides more efficient and predictable memory allocation for containerized applications, particularly beneficial for workloads with specific memory requirements. @@ -34 +34 @@ Kubernetes `1.31` is now available in Amazon EKS. For more information about Kub - * The PersistentVolume last phase transition time feature has graduated to stable and is now generally available for public use in Kubernetes version `1.31`. This feature introduces a new field, `.status.lastTransitionTime`, in the PersistentVolumeStatus, which provides a timestamp of when a PersistentVolume last transitioned to a different phase. This enhancement allows for better tracking and management of PersistentVolumes, particularly in scenarios where understanding the lifecycle of volumes is important. + * PersistentVolumeClaims (PVCs) created by StatefulSets now include automatic cleanup functionality. When PVCs are no longer needed, they will be automatically deleted while maintaining data persistence during StatefulSet updates and node maintenance operations. This feature simplifies storage management and helps prevent orphaned PVCs in your cluster. @@ -35,0 +36 @@ Kubernetes `1.31` is now available in Amazon EKS. For more information about Kub + * Custom Resource Field Selector functionality has been introduced, allowing developers to add field selectors to custom resources. This feature provides the same filtering capabilities available for built-in Kubernetes objects to custom resources, enabling more precise and efficient resource filtering and promoting better API design practices. @@ -39 +39,0 @@ Kubernetes `1.31` is now available in Amazon EKS. For more information about Kub -For the complete Kubernetes `1.31` changelog, see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.31.md @@ -41 +41 @@ For the complete Kubernetes `1.31` changelog, see https://github.com/kubernetes/ -## Kubernetes 1.30 +For the complete Kubernetes `1.32` changelog, see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.32.md @@ -43 +43 @@ For the complete Kubernetes `1.31` changelog, see https://github.com/kubernetes/ -Kubernetes `1.30` is now available in Amazon EKS. For more information about Kubernetes `1.30`, see the [official release announcement](https://kubernetes.io/blog/2024/04/17/kubernetes-v1-30-release/). +### Anonymous authentication changes @@ -45 +45 @@ Kubernetes `1.30` is now available in Amazon EKS. For more information about Kub - * Starting with Amazon EKS version `1.30` or newer, any newly created managed node groups will automatically default to using Amazon Linux 2023 (AL2023) as the node operating system. For more information about specifiying the operating system for a managed node group, see [Create a managed node group for your cluster](./create-managed-node-group.html). +Starting with Amazon EKS `1.32`, anonymous authentication is restricted to the following API server health check endpoints: @@ -47 +47 @@ Kubernetes `1.30` is now available in Amazon EKS. For more information about Kub - * With Amazon EKS `1.30`, the `topology.k8s.aws/zone-id` label is added to worker nodes. You can use Availability Zone IDs (AZ IDs) to determine the location of resources in one account relative to the resources in another account. For more information, see [Availability Zone IDs for your AWS resources](https://docs.aws.amazon.com/ram/latest/userguide/working-with-az-ids.html) in the _AWS RAM User Guide_. + * `/healthz` @@ -49 +49 @@ Kubernetes `1.30` is now available in Amazon EKS. For more information about Kub - * Starting with `1.30`, Amazon EKS no longer includes the `default` annotation on the `gp2 StorageClass` resource applied to newly created clusters. This has no impact if you are referencing this storage class by name. You must take action if you were relying on having a default `StorageClass` in the cluster. You should reference the `StorageClass` by the name `gp2`. Alternatively, you can deploy the Amazon EBS recommended default storage class by setting the `defaultStorageClass.enabled` parameter to true when installing version `1.31.0` or later of the `aws-ebs-csi-driver add-on`. + * `/livez` @@ -51 +51 @@ Kubernetes `1.30` is now available in Amazon EKS. For more information about Kub - * The minimum required IAM policy for the Amazon EKS cluster IAM role has changed. The action `ec2:DescribeAvailabilityZones` is required. For more information, see [Amazon EKS cluster IAM role](./cluster-iam-role.html). + * `/readyz` @@ -56 +56 @@ Kubernetes `1.30` is now available in Amazon EKS. For more information about Kub -For the complete Kubernetes `1.30` changelog, see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md. +Requests to any other endpoint using the `system:unauthenticated` user will receive a `401 Unauthorized` HTTP response. This security enhancement helps prevent unintended cluster access that could occur due to misconfigured RBAC policies. @@ -58 +58 @@ For the complete Kubernetes `1.30` changelog, see https://github.com/kubernetes/ -## Kubernetes 1.29 +###### Note @@ -60 +60,9 @@ For the complete Kubernetes `1.30` changelog, see https://github.com/kubernetes/ -Kubernetes `1.29` is now available in Amazon EKS. For more information about Kubernetes `1.29`, see the [official release announcement](https://kubernetes.io/blog/2023/12/13/kubernetes-v1-29-release/). +The `public-info-viewer` RBAC role continues to apply for the health check endpoints listed above. + +### Amazon Linux 2 AMI deprecation + +Kubernetes version `1.32` is the last version for which Amazon EKS released AL2 AMIs. From version `1.33` onwards, Amazon EKS will continue to release AL2023 and Bottlerocket based AMIs. For more information, see [Guide to EKS AL2 & AL2-Accelerated AMIs transition features](./eks-ami-deprecation-faqs.html). + +## Kubernetes 1.31 + +Kubernetes `1.31` is now available in Amazon EKS. For more information about Kubernetes `1.31`, see the [official release announcement](https://kubernetes.io/blog/2024/08/13/kubernetes-v1-31-release/). @@ -64 +72 @@ Kubernetes `1.29` is now available in Amazon EKS. For more information about Kub - * The deprecated `flowcontrol.apiserver.k8s.io/v1beta2` API version of `FlowSchema` and `PriorityLevelConfiguration` are no longer served in Kubernetes version `1.29`. If you have manifests or client software that uses the deprecated beta API group, you should change these before you upgrade to version `1.29`. + * The kubelet flag `--keep-terminated-pod-volumes` deprecated since 2017 has been removed as part of the version `1.31` release. This change impacts how terminated pod volumes are handled by the kubelet. If you are using this flag in your node configurations, you must update your bootstrap scripts and launch templates to remove it before upgrading. @@ -69 +77 @@ Kubernetes `1.29` is now available in Amazon EKS. For more information about Kub - * The `.status.kubeProxyVersion` field for node objects is now deprecated, and the Kubernetes project is proposing to remove that field in a future release. The deprecated field is not accurate and has historically been managed by `kubelet` \- which does not actually know the `kube-proxy` version, or even whether `kube-proxy` is running. If you’ve been using this field in client software, stop - the information isn’t reliable and the field is now deprecated. + * The beta `VolumeAttributesClass` feature gate and API resource is enabled in Amazon EKS version `1.31`. This feature allows cluster operators to modify mutable properties of Persistent Volumes (PVs) managed by compatible CSI Drivers, including the Amazon EBS CSI Driver. To leverage this feature, ensure that your CSI Driver supports the `VolumeAttributesClass` feature (for the Amazon EBS CSI Driver, upgrade to version `1.35.0` or later to automatically enable the feature). You will be able to create `VolumeAttributesClass` objects to define the desired volume attributes, such as volume type and throughput, and associate them with your Persistent Volume Claims (PVCs). See the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/) as well as the documentation of your CSI driver for more information. @@ -71 +79,12 @@ Kubernetes `1.29` is now available in Amazon EKS. For more information about Kub - * In Kubernetes `1.29` to reduce potential attack surface, the `LegacyServiceAccountTokenCleanUp` feature labels legacy auto-generated secret-based tokens as invalid if they have not been used for a long time (1 year by default), and automatically removes them if use is not attempted for a long time after being marked as invalid (1 additional year by default). To identify such tokens, a you can run: + * For more information about the Amazon EBS CSI Driver, see [Use Kubernetes volume storage with Amazon EBS](./ebs-csi.html). + + * Kubernetes support for [AppArmor](https://apparmor.net/) has graduated to stable and is now generally available for public use. This feature allows you to protect your containers with AppArmor by setting the `appArmorProfile.type` field in the container’s `securityContext`. Prior to Kubernetes version `1.30`, AppArmor was controlled by annotations. Starting with version `1.30`, it is controlled using fields. To leverage this feature, we recommend migrating away from annotations and using the `appArmorProfile.type` field to ensure that your workloads are compatible. + + * The PersistentVolume last phase transition time feature has graduated to stable and is now generally available for public use in Kubernetes version `1.31`. This feature introduces a new field, `.status.lastTransitionTime`, in the PersistentVolumeStatus, which provides a timestamp of when a PersistentVolume last transitioned to a different phase. This enhancement allows for better tracking and management of PersistentVolumes, particularly in scenarios where understanding the lifecycle of volumes is important. + + + + +For the complete Kubernetes `1.31` changelog, see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.31.md + +## Kubernetes 1.30 @@ -73 +92 @@ Kubernetes `1.29` is now available in Amazon EKS. For more information about Kub - kubectl get cm kube-apiserver-legacy-service-account-token-tracking -n kube-system +Kubernetes `1.30` is now available in Amazon EKS. For more information about Kubernetes `1.30`, see the [official release announcement](https://kubernetes.io/blog/2024/04/17/kubernetes-v1-30-release/). @@ -74,0 +94 @@ Kubernetes `1.29` is now available in Amazon EKS. For more information about Kub + * Starting with Amazon EKS version `1.30` or newer, any newly created managed node groups will automatically default to using Amazon Linux 2023 (AL2023) as the node operating system. For more information about specifiying the operating system for a managed node group, see [Create a managed node group for your cluster](./create-managed-node-group.html). @@ -75,0 +96 @@ Kubernetes `1.29` is now available in Amazon EKS. For more information about Kub + * With Amazon EKS `1.30`, the `topology.k8s.aws/zone-id` label is added to worker nodes. You can use Availability Zone IDs (AZ IDs) to determine the location of resources in one account relative to the resources in another account. For more information, see [Availability Zone IDs for your AWS resources](https://docs.aws.amazon.com/ram/latest/userguide/working-with-az-ids.html) in the _AWS RAM User Guide_. @@ -76,0 +98 @@ Kubernetes `1.29` is now available in Amazon EKS. For more information about Kub + * Starting with `1.30`, Amazon EKS no longer includes the `default` annotation on the `gp2 StorageClass` resource applied to newly created clusters. This has no impact if you are referencing this storage class by name. You must take action if you were relying on having a default `StorageClass` in the cluster. You should reference the `StorageClass` by the name `gp2`. Alternatively, you can deploy the Amazon EBS recommended default storage class by setting the `defaultStorageClass.enabled` parameter to true when installing version `1.31.0` or later of the `aws-ebs-csi-driver add-on`. @@ -78 +100,6 @@ Kubernetes `1.29` is now available in Amazon EKS. For more information about Kub -For the complete Kubernetes `1.29` changelog, see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1280. + * The minimum required IAM policy for the Amazon EKS cluster IAM role has changed. The action `ec2:DescribeAvailabilityZones` is required. For more information, see [Amazon EKS cluster IAM role](./cluster-iam-role.html). + + + + +For the complete Kubernetes `1.30` changelog, see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md.