AWS eks: Add optional ACK settings (cross-namespace refs, disabled services) to console steps
Summary
Updates the ACK capability creation console workflow: changes tab navigation wording and adds an optional configuration step for enabling cross-namespace references and disabling specific ACK service controllers, plus a note that settings can be reviewed/changed later.
Security assessment
Cross-namespace references affect Kubernetes namespace isolation boundaries; documenting that it is off by default and opt-in is security-relevant hardening guidance, but no specific vulnerability or incident is referenced.
Evidence
+ 1. Select **Enable cross-namespace references** if you want ACK resources to resolve references to resources in other Kubernetes namespaces. This checkbox is cleared by default, and the capability is created with cross-namespace references turned off unless you select it. For more information, see [Cross-namespace resource references](./ack-concepts.html#ack-cross-namespace-references).
Diff
diff --git a/eks/latest/userguide/ack-create-console.md b/eks/latest/userguide/ack-create-console.md index b1a4f47..6806450 100644 --- a//eks/latest/userguide/ack-create-console.md +++ b//eks/latest/userguide/ack-create-console.md @@ -23 +23 @@ Create an ACK capability on your Amazon EKS cluster using the AWS Management Con - 3. Choose the **Capabilities** tab. + 3. In the left navigation pane, choose **Capabilities**. @@ -43 +43,9 @@ The suggested `AdministratorAccess` policy grants broad permissions and is inten - 7. Choose **Create**. + 7. **(Optional) Configure ACK settings** : + +The **AWS Controllers for Kubernetes (ACK) configuration** section includes two optional settings. For a description of each setting and its constraints, see [ACK capability configuration options](./create-ack-capability.html#ack-configuration-options). + + 1. Select **Enable cross-namespace references** if you want ACK resources to resolve references to resources in other Kubernetes namespaces. This checkbox is cleared by default, and the capability is created with cross-namespace references turned off unless you select it. For more information, see [Cross-namespace resource references](./ack-concepts.html#ack-cross-namespace-references). + + 2. For **Disabled services** , enter an ACK service name, for example `s3`, and then choose **Add service**. Repeat this for each service whose controller you want to turn off, and choose the remove icon on a service to take it back off the list. Leave the list empty to run the controllers for all supported ACK services. + + 8. Choose **Create**. @@ -49,0 +58,2 @@ The capability creation process begins. +You can review both settings on the capability detail page after the capability is created, and change them at any time. For the steps to change them, see [Update ACK capability configuration](./working-with-capabilities.html#ack-update-configuration). + @@ -52 +62 @@ The capability creation process begins. - 1. On the **Capabilities** tab, view the ACK capability status. + 1. On the **Capabilities** page, view the ACK capability status. @@ -71 +81 @@ After the capability is active, verify that ACK custom resources are available i - 2. Choose the **Resources** tab + 2. In the left navigation pane, choose **Resources**