AWS eks documentation change
Summary
Added guidance about Kubernetes service CIDR selection and recommendations to avoid network conflicts in hybrid clusters
Security assessment
Focuses on network configuration best practices to prevent IP conflicts. While network segmentation impacts security, this is operational guidance without specific security features or vulnerability fixes.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-cluster-create.md b/eks/latest/userguide/hybrid-nodes-cluster-create.md index cf376a8e8..8c40f2fcc 100644 --- a//eks/latest/userguide/hybrid-nodes-cluster-create.md +++ b//eks/latest/userguide/hybrid-nodes-cluster-create.md @@ -41,0 +42,2 @@ If you are not planning to use EKS Hybrid Nodes, see the primary Amazon EKS crea + * If you don’t explicitly specify a Kubernetes service IPv4 CIDR when creating a hybrid nodes-enabled cluster, Amazon EKS automatically selects a service CIDR that doesn’t overlap with your configured remote node and pod networks. The assigned CIDR may differ from the standard defaults (`10.100.0.0/16` or `172.20.0.0/16`). For example, if your remote node or pod networks overlap with these default ranges, Amazon EKS selects an alternative CIDR from the private IP ranges such as `172.16.0.0/16`. We recommend that you explicitly specify a service IPv4 CIDR during cluster creation to ensure a predictable configuration. You can find the assigned service CIDR after cluster creation by running `aws eks describe-cluster --name CLUSTER_NAME --query “cluster.kubernetesNetworkConfig.serviceIpv4Cidr”`. + @@ -322 +324 @@ Cluster provisioning takes several minutes. You can check the status of your sta - 5. (Optional) Choose **Configure Kubernetes Service IP address range** and specify a **Service IPv4 range**. + 5. (Optional) Choose **Configure Kubernetes Service IP address range** and specify a **Service IPv4 range**. We recommend specifying an explicit service CIDR for hybrid nodes-enabled clusters. If you don’t specify one, Amazon EKS selects a CIDR that avoids conflicts with your remote node and pod networks, which may differ from the standard defaults (`10.100.0.0/16` or `172.20.0.0/16`).