AWS eks documentation change
Summary
Added an Important note clarifying that nodes running the EKS Pod Identity Agent must have network access to the EKS Auth API, specifically requiring an AWS PrivateLink interface endpoint for nodes in private subnets. Removed a redundant bullet point stating the same requirement.
Security assessment
The change adds documentation about a security feature (AWS PrivateLink) and clarifies network access requirements for secure communication between nodes and the EKS Auth API. It does not address a specific security vulnerability but rather provides guidance on secure configuration.
Diff
diff --git a/eks/latest/userguide/pod-id-agent-setup.md b/eks/latest/userguide/pod-id-agent-setup.md index 447ab07e5..9f9f9a8ef 100644 --- a//eks/latest/userguide/pod-id-agent-setup.md +++ b//eks/latest/userguide/pod-id-agent-setup.md @@ -35,0 +36,4 @@ You do not need to install the EKS Pod Identity Agent on EKS Auto Mode Clusters. +###### Important + +The nodes where the EKS Pod Identity Agent runs must be able to access the EKS Auth API. If you are using private subnets for your nodes, you must set up an AWS PrivateLink interface endpoint for the EKS Auth API. For more information, see [Access Amazon EKS using AWS PrivateLink](./vpc-interface-endpoints.html). + @@ -59,2 +62,0 @@ Note that you can change the image location and provide `imagePullSecrets` for E - * The nodes can reach the Amazon EKS Auth API. For private clusters, the `eks-auth` endpoint in AWS PrivateLink is required. -