AWS eks: EKS Auto Mode IngressClassParams ALB field reference expanded
Summary
Expands the IngressClassParams field table with new fields (loadBalancerName, sslPolicy, inboundCIDRs, prefixListsIDs, targetType, listeners, minimumLoadBalancerCapacity, ipamConfiguration), documents valid ipAddressType values, renames subnets.tags to subnets.matchTags, updates the migration table (listeners.listenerAttributes -> listeners.attributes, sslRedirectPort/wafv2AclArn/wafv2AclName now via annotations) and notes OIDC auth-type is supported with additional RBAC granting the controller get access to the OIDC Secret.
Security assessment
The added reference documents security-relevant ALB configuration: TLS security policy for HTTPS listeners, inboundCIDRs/prefixListsIDs to restrict who can reach the ALB, ipAddressType dualstack-without-public-ipv4 to reduce public IPv4 exposure, and OIDC RBAC requiring the controller to be granted get access to the OIDC Secret. This is hardening/best-practice guidance rather than a fix for a specific vulnerability or incident, so severity is medium.
Evidence
+`sslPolicy` | Sets the security policy for HTTPS listeners. Overrides the `alb.ingress.kubernetes.io/ssl-policy` annotation. | `ELBSecurityPolicy-TLS13-1-2-2021-06`
Diff
diff --git a/eks/latest/userguide/auto-configure-alb.md b/eks/latest/userguide/auto-configure-alb.md index a210382c1..8c99aa1e1 100644 --- a//eks/latest/userguide/auto-configure-alb.md +++ b//eks/latest/userguide/auto-configure-alb.md @@ -215 +215 @@ EKS Auto Mode will automatically delete the associated load balancer in your AWS -The table below is a quick reference for commonly used configuration options. +The following table lists the fields that you can set in an `IngressClassParams` resource. The settings apply to all Ingresses that use the IngressClass. @@ -219,0 +220 @@ Field | Description | Example value +`loadBalancerName` | Sets the name of the ALB. The name can be up to 32 characters. Overrides the `alb.ingress.kubernetes.io/load-balancer-name` annotation. | `my-alb` @@ -222 +223 @@ Field | Description | Example value -`ipAddressType` | Sets IP address type for the ALB | `dualstack` +`ipAddressType` | Sets the IP address type for the ALB. Valid values are `ipv4`, `dualstack`, and `dualstack-without-public-ipv4`. | `dualstack` @@ -224 +225 @@ Field | Description | Example value -`subnets.tags` | Tag filters to select subnets for ALB | `Environment: prod` +`subnets.matchTags` | Tag filters to select subnets for ALB. Each filter has a `key` and a list of `values`. | `key: Environment, values: [prod]` @@ -225,0 +227,4 @@ Field | Description | Example value +`sslPolicy` | Sets the security policy for HTTPS listeners. Overrides the `alb.ingress.kubernetes.io/ssl-policy` annotation. | `ELBSecurityPolicy-TLS13-1-2-2021-06` +`inboundCIDRs` | CIDR blocks that are allowed to access the ALB. Overrides the `alb.ingress.kubernetes.io/inbound-cidrs` annotation. | `10.0.0.0/16, 192.168.0.0/24` +`prefixListsIDs` | IDs of managed prefix lists that are allowed to access the ALB. Overrides the `alb.ingress.kubernetes.io/security-group-prefix-lists` annotation. | `pl-00000000, pl-11111111` +`targetType` | Sets the target type for target groups. Valid values are `instance` and `ip`. The default is `ip`. | `instance` @@ -227,0 +233,3 @@ Field | Description | Example value +`listeners` | Sets [listener attributes](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ListenerAttribute.html) on listeners that your Ingresses define. Each entry matches a listener by `port` and `protocol` (`HTTP` or `HTTPS`) and lists `attributes` as `key` and `value` pairs. This field doesn’t create listeners. Overrides the `alb.ingress.kubernetes.io/listener-attributes.${Protocol}-${Port}` annotation for the same attribute key. | `port: 443, protocol: HTTPS, attributes: routing.http.response.server.enabled: "false"` +`minimumLoadBalancerCapacity.capacityUnits` | Reserves a minimum capacity for the ALB, in load balancer capacity units (LCUs). Set to `0` to remove the reservation. Overrides the `alb.ingress.kubernetes.io/minimum-load-balancer-capacity` annotation. | `1000` +`ipamConfiguration.ipv4IPAMPoolId` | ID of the Amazon VPC IP Address Manager (IPAM) pool that an internet-facing ALB uses for its public IPv4 addresses. Overrides the `alb.ingress.kubernetes.io/ipam-ipv4-pool-id` annotation. | `ipam-pool-0123456789abcdef0` @@ -233 +241 @@ Field | Description | Example value - * You cannot set [ListenerAttribute](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ListenerAttribute.html) with EKS Auto Mode. + * To set [ListenerAttribute](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ListenerAttribute.html) values for all Ingresses in an IngressClass, use the `listeners` field in IngressClassParams. For more information, see IngressClassParams Reference. @@ -255 +263,5 @@ Previous | New | Description -`spec.listeners.listenerAttributes` | Not supported | Not yet supported by EKS Auto Mode +`spec.listeners.listenerAttributes` | `spec.listeners.attributes` | Renamed field for listener attributes +`spec.PrefixListsIDs` | `spec.prefixListsIDs` | Only the `prefixListsIDs` spelling is supported +`spec.sslRedirectPort` | Not supported | Use the `alb.ingress.kubernetes.io/ssl-redirect` annotation on Ingress objects +`spec.wafv2AclArn` | Not supported | Use the `alb.ingress.kubernetes.io/wafv2-acl-arn` annotation on Ingress objects +`spec.wafv2AclName` | Not supported | Use the `alb.ingress.kubernetes.io/wafv2-acl-name` annotation on Ingress objects @@ -265 +276,0 @@ Previous | New | Description -`alb.ingress.kubernetes.io/wafv2-acl-name` | Not supported | Upcoming soon @@ -269 +280 @@ Previous | New | Description -`alb.ingress.kubernetes.io/auth-type: oidc` | Not supported | OIDC Auth Type is currently not supported +`alb.ingress.kubernetes.io/auth-type: oidc` | Supported with additional RBAC | Grant the load balancer controller `get` access to the OIDC `Secret`. For more information, see [Grant the EKS Auto Mode load balancer controller access to a specific Secret](./auto-managed-rbac-example.html).