AWS eks documentation change
Summary
Updated documentation to use inline code formatting for Kubernetes subnet tags instead of hyperlinks
Security assessment
Changes are purely formatting updates (removing hyperlinks from tags like 'kubernetes.io/role/elb'). No security content was modified or added. The existing security context about private clusters remains unchanged.
Diff
diff --git a/eks/latest/best-practices/subnets.md b/eks/latest/best-practices/subnets.md index daee08d1d..f95017950 100644 --- a//eks/latest/best-practices/subnets.md +++ b//eks/latest/best-practices/subnets.md @@ -86 +86 @@ In the IPv6 world, every address is internet routable. The IPv6 addresses associ -In the same public subnets, both nodes and ingress resources (such as load balancers) are created. Tag the public subnet with [`kubernetes.io/role/elb`](http://kubernetes.io/role/elb) to construct load balancers that face the internet. In this configuration, the cluster endpoint can be configured to be public, private, or both (public and private). +In the same public subnets, both nodes and ingress resources (such as load balancers) are created. Tag the public subnet with `kubernetes.io/role/elb` to construct load balancers that face the internet. In this configuration, the cluster endpoint can be configured to be public, private, or both (public and private). @@ -94 +94 @@ Nodes are created on private subnets, whereas Ingress resources are instantiated -Both nodes and ingress are created in private subnets. Using the [`kubernetes.io/role/internal-elb`](http://kubernetes.io/role/internal-elb:1) subnet tag to construct internal load balancers. Accessing your cluster’s endpoint will require a VPN connection. You must activate [AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-service.html) for EC2 and all Amazon ECR and S3 repositories. Only the private endpoint of the cluster should be enabled. We suggest going through the [EKS private cluster requirements](https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html) before provisioning private clusters. +Both nodes and ingress are created in private subnets. Using the `kubernetes.io/role/internal-elb` subnet tag to construct internal load balancers. Accessing your cluster’s endpoint will require a VPN connection. You must activate [AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-service.html) for EC2 and all Amazon ECR and S3 repositories. Only the private endpoint of the cluster should be enabled. We suggest going through the [EKS private cluster requirements](https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html) before provisioning private clusters. @@ -163 +163 @@ Instantiating nodes in private subnets offers maximal control over traffic to th -Consider private only mode if you demand strict security and network isolation. In this configuration, three private subnets are deployed in distinct Availability Zones within the AWS Region’s VPC. The resources deployed to the subnets cannot access the internet, nor can the internet access the resources in the subnets. In order for your Kubernetes application to access other AWS services, you must configure PrivateLink interfaces and/or gateway endpoints. You may setup internal load balancers to redirect traffic to Pods using AWS Load Balancer Controller. The private subnets must be tagged ([`kubernetes.io/role/internal-elb: 1`](http://kubernetes.io/role/internal-elb)) for the controller to provision load balancers. For nodes to register with the cluster, the cluster endpoint must be set to private mode. Please visit [private cluster guide](https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html) for complete requirements and considerations. +Consider private only mode if you demand strict security and network isolation. In this configuration, three private subnets are deployed in distinct Availability Zones within the AWS Region’s VPC. The resources deployed to the subnets cannot access the internet, nor can the internet access the resources in the subnets. In order for your Kubernetes application to access other AWS services, you must configure PrivateLink interfaces and/or gateway endpoints. You may setup internal load balancers to redirect traffic to Pods using AWS Load Balancer Controller. The private subnets must be tagged (`kubernetes.io/role/internal-elb: 1`) for the controller to provision load balancers. For nodes to register with the cluster, the cluster endpoint must be set to private mode. Please visit [private cluster guide](https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html) for complete requirements and considerations.