AWS eks: EKS capabilities: nav wording updates and ACK config update guidance
Summary
Updates console navigation steps (Capabilities now in left navigation pane, Cluster monitoring instead of Observability tab) and adds a new section describing how to update ACK capability configuration after creation, including enableCrossNamespace and replacing disabledServices (example disables iam).
Security assessment
The substantive new content documents mutating an ACK capability's configuration, specifically enabling cross-namespace reference resolution and scoping which AWS services the capability's controllers may manage via disabledServices (e.g. iam). No vulnerability or incident is referenced, so this is not a fix, but the settings do affect blast radius of AWS API permissions granted indirectly through ACK controllers; most of the remaining diff is pure UI-navigation wording.
Evidence
+ "enableCrossNamespace": true,
Diff
diff --git a/eks/latest/userguide/working-with-capabilities.md b/eks/latest/userguide/working-with-capabilities.md index 7181473..e50851c 100644 --- a//eks/latest/userguide/working-with-capabilities.md +++ b//eks/latest/userguide/working-with-capabilities.md @@ -48 +48 @@ Capability resources have a status that indicates their current state. You can v - 3. Choose the **Capabilities** tab to view status for all capabilities. + 3. In the left navigation pane, choose **Capabilities** to view status for all capabilities. @@ -50 +50 @@ Capability resources have a status that indicates their current state. You can v - 4. For detailed health information, choose the **Observability** tab, then **Monitor cluster** , then the **Capabilities** tab. + 4. For detailed health information, choose **Cluster monitoring** in the left navigation pane, then the **Capabilities** tab. @@ -128 +128 @@ You can list all capability resources on a cluster. - 3. Choose the **Capabilities** tab. + 3. In the left navigation pane, choose **Capabilities**. @@ -187 +187 @@ Get detailed information about a specific capability, including its configuratio - 3. Choose the **Capabilities** tab. + 3. In the left navigation pane, choose **Capabilities**. @@ -252,0 +253,24 @@ Not all capability properties can be updated after creation. Refer to the capabi +### Update ACK capability configuration + +For an ACK capability, you can change the type-specific settings in the `ack` object of the `configuration` after creation. For a description of each field and its constraints, see [ACK capability configuration options](./create-ack-capability.html#ack-configuration-options). + +The following example turns cross-namespace reference resolution on and replaces the set of disabled services with a single service (`iam`). Replace `region-code` with the AWS Region that your cluster is in, replace `my-cluster` with the name of your cluster, and replace `my-ack` with the name of your ACK capability. + + + aws eks update-capability \ + --region region-code \ + --cluster-name my-cluster \ + --capability-name my-ack \ + --configuration '{ + "ack": { + "enableCrossNamespace": true, + "disabledServices": ["iam"] + } + }' + +###### Note + +Omitting a field leaves its current value unchanged. When you do specify `disabledServices`, the list replaces the previous list instead of merging with it, so include every service that you want turned off. To turn all services back on, specify an empty list. To turn a single service back on, specify the list of services that you want to remain turned off, without that service. For details, see [ACK capability configuration options](./create-ack-capability.html#ack-configuration-options). + +The capability status changes to `UPDATING` while EKS applies the change, and returns to `ACTIVE` when the update is complete. + @@ -284 +308 @@ You may optionally choose to retain AWS resources associated with ACK Kubernetes - 3. Choose the **Capabilities** tab. + 3. In the left navigation pane, choose **Capabilities**.