Skip to content

Commit ee916c9

Browse files
pgascapgasca
committed
Split Security chapter pages into separate files.
1 parent e9070dc commit ee916c9

31 files changed

+2273
-2187
lines changed

‎latest/ug/networking/cni-increase-ip-addresses.adoc‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
//!!NODE_ROOT <section>
12
[.topic]
23
[[cni-increase-ip-addresses,cni-increase-ip-addresses.title]]
34
= Assign more IP addresses to Amazon EKS nodes with prefixes
@@ -61,5 +62,3 @@ Consider the following when you use this feature:
6162
If you're also using <<security-groups-for-pods,security groups for Pods>>, with `POD_SECURITY_GROUP_ENFORCING_MODE`=``strict``, when your `Pods` communicate with endpoints outside of your VPC, the `Pod's` security groups are used.
6263

6364

64-
[.topic]
65-

‎latest/ug/security/cert-signing.adoc‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
//!!NODE_ROOT <section>
2+
[.topic]
3+
[[cert-signing,cert-signing.title]]
4+
= Secure workloads with [.noloc]`Kubernetes` certificates
5+
:info_titleabbrev: Certificate signing
6+
7+
include::../attributes.txt[]
8+
9+
[abstract]
10+
--
11+
Learn how to request and obtain X.509 certificates from the Certificate Authority (CA) using Certificate Signing Requests (CSRs) in Amazon EKS, including details on migrating from legacy signers, generating CSRs, approving requests, and handling certificate signing considerations before upgrading to Kubernetes 1.24.
12+
--
13+
14+
The [.noloc]`Kubernetes` Certificates API automates https://www.itu.int/rec/T-REC-X.509[X.509] credential provisioning. The API features a command line interface for [.noloc]`Kubernetes` API clients to request and obtain https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/[X.509 certificates] from a Certificate Authority (CA). You can use the `CertificateSigningRequest` (CSR) resource to request that a denoted signer sign the certificate. Your requests are either approved or denied before they're signed. [.noloc]`Kubernetes` supports both built-in signers and custom signers with well-defined behaviors. This way, clients can predict what happens to their CSRs. To learn more about certificate signing, see https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/[signing requests].
15+
16+
One of the built-in signers is `kubernetes.io/legacy-unknown`. The `v1beta1` API of CSR resource honored this legacy-unknown signer. However, the stable `v1` API of CSR doesn't allow the `signerName` to be set to `kubernetes.io/legacy-unknown`.
17+
18+
Amazon EKS version `1.21` and earlier allowed the `legacy-unknown` value as the `signerName` in `v1beta1` CSR API. This API enables the Amazon EKS Certificate Authority (CA) to generate certificates. However, in [.noloc]`Kubernetes` version `1.22`, the `v1beta1` CSR API was replaced by the `v1` CSR API. This API doesn't support the signerName of "`legacy-unknown.`" If you want to use Amazon EKS CA for generating certificates on your clusters, you must use a custom signer. It was introduced in Amazon EKS version `1.22`. To use the CSR `v1` API version and generate a new certificate, you must migrate any existing manifests and API clients. Existing certificates that were created with the existing `v1beta1` API are valid and function until the certificate expires. This includes the following:
19+
20+
21+
22+
* Trust distribution: None. There's no standard trust or distribution for this signer in a [.noloc]`Kubernetes` cluster.
23+
* Permitted subjects: Any
24+
* Permitted x509 extensions: Honors subjectAltName and key usage extensions and discards other extensions
25+
* Permitted key usages: Must not include usages beyond ["key encipherment", "digital signature", "server auth"]
26+
+
27+
NOTE: Client certificate signing is not supported.
28+
* Expiration/certificate lifetime: 1 year (default and maximum)
29+
* CA bit allowed/disallowed: Not allowed
30+
31+
32+
[[csr-example,csr-example.title]]
33+
== Example CSR generation with signerName
34+
35+
These steps shows how to generate a serving certificate for DNS name `myserver.default.svc` using `signerName: beta.eks.amazonaws.com/app-serving`. Use this as a guide for your own environment.
36+
37+
. Run the `openssl genrsa -out myserver.key 2048` command to generate an RSA private key.
38+
+
39+
[source,bash,subs="verbatim,attributes"]
40+
----
41+
openssl genrsa -out myserver.key 2048
42+
----
43+
. Run the following command to generate a certificate request.
44+
+
45+
[source,bash,subs="verbatim,attributes"]
46+
----
47+
openssl req -new -key myserver.key -out myserver.csr -subj "/CN=myserver.default.svc"
48+
----
49+
. Generate a `base64` value for the CSR request and store it in a variable for use in a later step.
50+
+
51+
[source,bash,subs="verbatim,attributes"]
52+
----
53+
base_64=$(cat myserver.csr | base64 -w 0 | tr -d "
54+
")
55+
----
56+
. Run the following command to create a file named `mycsr.yaml`. In the following example, `beta.eks.amazonaws.com/app-serving` is the `signerName`.
57+
+
58+
[source,yaml,subs="verbatim,attributes"]
59+
----
60+
cat >mycsr.yaml <<EOF
61+
apiVersion: certificates.k8s.io/v1
62+
kind: CertificateSigningRequest
63+
metadata:
64+
name: myserver
65+
spec:
66+
request: $base_64
67+
signerName: beta.eks.amazonaws.com/app-serving
68+
usages:
69+
- digital signature
70+
- key encipherment
71+
- server auth
72+
EOF
73+
----
74+
. Submit the CSR.
75+
+
76+
[source,bash,subs="verbatim,attributes"]
77+
----
78+
kubectl apply -f mycsr.yaml
79+
----
80+
. Approve the serving certificate.
81+
+
82+
[source,bash,subs="verbatim,attributes"]
83+
----
84+
kubectl certificate approve myserver
85+
----
86+
. Verify that the certificate was issued.
87+
+
88+
[source,bash,subs="verbatim,attributes"]
89+
----
90+
kubectl get csr myserver
91+
----
92+
+
93+
An example output is as follows.
94+
+
95+
[source,bash,subs="verbatim,attributes"]
96+
----
97+
NAME AGE SIGNERNAME REQUESTOR CONDITION
98+
myserver 3m20s beta.eks.amazonaws.com/app-serving kubernetes-admin Approved,Issued
99+
----
100+
. Export the issued certificate.
101+
+
102+
[source,bash,subs="verbatim,attributes"]
103+
----
104+
kubectl get csr myserver -o jsonpath='{.status.certificate}'| base64 -d > myserver.crt
105+
----
106+
107+
108+
[[csr-considerations,csr-considerations.title]]
109+
== Certificate signing considerations before upgrading your cluster to [.noloc]`Kubernetes` 1.24
110+
111+
In [.noloc]`Kubernetes` `1.23` and earlier, `kubelet` serving certificates with unverifiable IP and DNS Subject Alternative Names (SANs) are automatically issued with unverifiable SANs. The SANs are omitted from the provisioned certificate. In `1.24` and later clusters, `kubelet` serving certificates aren't issued if a SAN can't be verified. This prevents the `kubectl exec` and `kubectl logs` commands from working.
112+
113+
Before upgrading your cluster to `1.24`, determine whether your cluster has certificate signing requests (CSR) that haven't been approved by completing the following steps:
114+
115+
. Run the following command.
116+
+
117+
[source,bash,subs="verbatim,attributes"]
118+
----
119+
kubectl get csr -A
120+
----
121+
+
122+
An example output is as follows.
123+
+
124+
[source,bash,subs="verbatim,attributes"]
125+
----
126+
NAME AGE SIGNERNAME REQUESTOR REQUESTEDDURATION CONDITION
127+
csr-7znmf 90m kubernetes.io/kubelet-serving system:node:ip-192-168-42-149.region.compute.internal <none> Approved
128+
csr-9xx5q 90m kubernetes.io/kubelet-serving system:node:ip-192-168-65-38.region.compute.internal <none> Approved, Issued
129+
----
130+
+
131+
If the returned output shows a CSR with a https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers[kubernetes.io/kubelet-serving] signer that's `Approved` but not `Issued` for a node, then you need to approve the request.
132+
. Manually approve the CSR. Replace `csr-[.replaceable]``7znmf``` with your own value.
133+
+
134+
[source,bash,subs="verbatim,attributes"]
135+
----
136+
kubectl certificate approve csr-7znmf
137+
----
138+
139+
To auto-approve CSRs in the future, we recommend that you write an approving controller that can automatically validate and approve CSRs that contain IP or DNS SANs that Amazon EKS can't verify.
140+

‎latest/ug/security/compliance.adoc‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,6 @@
55
:info_doctype: section
66
:info_title: Compliance validation for Amazon EKS clusters
77
:info_titleabbrev: Validate compliance
8-
:info_abstract: Discover compliance resources and services for Amazon Elastic Kubernetes Service \
9-
to help secure your {aws} workloads, meet regulatory requirements like HIPAA, and \
10-
validate adherence to security standards like NIST, PCI, and ISO using {aws} Config, \
11-
Security Hub, GuardDuty, and Audit Manager.
128

139
include::../attributes.txt[]
1410

‎latest/ug/security/configuration-vulnerability-analysis.adoc‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,7 @@
22
[.topic]
33
[[configuration-vulnerability-analysis,configuration-vulnerability-analysis.title]]
44
= Analyze vulnerabilities in Amazon EKS
5-
:info_doctype: section
6-
:info_title: Analyze vulnerabilities \
7-
in Amazon EKS
85
:info_titleabbrev: Analyze vulnerabilities
9-
:info_abstract: Learn how to analyze the security configuration and vulnerabilities of your Amazon EKS \
10-
clusters and resources using tools like the CIS EKS Benchmark, platform \
11-
versions, vulnerability lists, Amazon Inspector, and Amazon GuardDuty for \
12-
comprehensive threat detection and protection.
136

147
include::../attributes.txt[]
158

‎latest/ug/security/default-roles-users.adoc‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
//!!NODE_ROOT <section>
2+
[.topic]
3+
[[default-roles-users,default-roles-users.title]]
4+
= Understand Amazon EKS created RBAC roles and users
5+
:info_titleabbrev: Default roles and users
6+
7+
include::../attributes.txt[]
8+
9+
[abstract]
10+
--
11+
Learn about the Kubernetes roles and users that Amazon EKS creates for cluster components and add-ons. Amazon EKS uses these role-based authorization control (RBAC) identities to operate the cluster.
12+
--
13+
14+
When you create a [.noloc]`Kubernetes` cluster, several default [.noloc]`Kubernetes` identities are created on that cluster for the proper functioning of [.noloc]`Kubernetes`. Amazon EKS creates [.noloc]`Kubernetes` identities for each of its default components. The identities provide [.noloc]`Kubernetes` role-based authorization control (RBAC) for the cluster components. For more information, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/[Using RBAC Authorization] in the [.noloc]`Kubernetes` documentation.
15+
16+
When you install optional <<eks-add-ons,add-ons>> to your cluster, additional [.noloc]`Kubernetes` identities might be added to your cluster. For more information about identities not addressed by this topic, see the documentation for the add-on.
17+
18+
You can view the list of Amazon EKS created [.noloc]`Kubernetes` identities on your cluster using the {aws-management-console} or `kubectl` command line tool. All of the user identities appear in the `kube` audit logs available to you through Amazon CloudWatch.
19+
20+
21+
22+
*{aws-management-console}*::
23+
24+
.Prerequisite
25+
The link:IAM/latest/UserGuide/id_roles.html#iam-term-principal[IAM principal,type="documentation"] that you use must have the permissions described in <<view-kubernetes-resources-permissions,Required permissions>>.
26+
+
27+
.. Open the link:eks/home#/clusters[Amazon EKS console,type="console"].
28+
.. In the *Clusters* list, choose the cluster that contains the identities that you want to view.
29+
.. Choose the *Resources* tab.
30+
.. Under *Resource types*, choose *Authorization*.
31+
.. Choose, *ClusterRoles*, *ClusterRoleBindings*, *Roles*, or *RoleBindings*. All resources prefaced with *eks* are created by Amazon EKS. Additional Amazon EKS created identity resources are:
32+
+
33+
*** The *ClusterRole* and *ClusterRoleBinding* named *aws-node*. The *aws-node* resources support the <<managing-vpc-cni,Amazon VPC CNI plugin for Kubernetes>>, which Amazon EKS installs on all clusters.
34+
*** A *ClusterRole* named *vpc-resource-controller-role* and a *ClusterRoleBinding* named *vpc-resource-controller-rolebinding*. These resources support the https://github.com/aws/amazon-vpc-resource-controller-k8s[Amazon VPC resource controller], which Amazon EKS installs on all clusters.
35+
36+
+
37+
In addition to the resources that you see in the console, the following special user identities exist on your cluster, though they're not visible in the cluster's configuration:
38+
+
39+
*** *`eks:cluster-bootstrap`* – Used for `kubectl` operations during cluster bootstrap.
40+
*** *`eks:support-engineer`* – Used for cluster management operations.
41+
.. Choose a specific resource to view details about it. By default, you're shown information in *Structured view*. In the top-right corner of the details page you can choose *Raw view* to see all information for the resource.
42+
43+
44+
*Kubectl*::
45+
46+
.Prerequisite
47+
The entity that you use ({aws} Identity and Access Management (IAM) or [.noloc]`OpenID Connect` ([.noloc]`OIDC`)) to list the [.noloc]`Kubernetes` resources on the cluster must be authenticated by IAM or your [.noloc]`OIDC` identity provider. The entity must be granted permissions to use the [.noloc]`Kubernetes` `get` and `list` verbs for the `Role`, `ClusterRole`, `RoleBinding`, and `ClusterRoleBinding` resources on your cluster that you want the entity to work with. For more information about granting IAM entities access to your cluster, see <<grant-k8s-access>>. For more information about granting entities authenticated by your own [.noloc]`OIDC` provider access to your cluster, see <<authenticate-oidc-identity-provider>>.
48+
.To view Amazon EKS created identities using `kubectl`
49+
Run the command for the type of resource that you want to see. All returned resources that are prefaced with *eks* are created by Amazon EKS. In addition to the resources returned in the output from the commands, the following special user identities exist on your cluster, though they're not visible in the cluster's configuration:
50+
+
51+
** *`eks:cluster-bootstrap`* – Used for `kubectl` operations during cluster bootstrap.
52+
** *`eks:support-engineer`* – Used for cluster management operations.
53+
+
54+
*ClusterRoles* – `ClusterRoles` are scoped to your cluster, so any permission granted to a role applies to resources in any [.noloc]`Kubernetes` namespace on the cluster.
55+
+
56+
The following command returns all of the Amazon EKS created [.noloc]`Kubernetes` `ClusterRoles` on your cluster.
57+
+
58+
[source,bash,subs="verbatim,attributes"]
59+
----
60+
kubectl get clusterroles | grep eks
61+
----
62+
+
63+
In addition to the `ClusterRoles` returned in the output that are prefaced with, the following `ClusterRoles` exist.
64+
+
65+
** *`aws-node`* – This `ClusterRole` supports the <<managing-vpc-cni,Amazon VPC CNI plugin for Kubernetes>>, which Amazon EKS installs on all clusters.
66+
** *`vpc-resource-controller-role`* – This `ClusterRole` supports the https://github.com/aws/amazon-vpc-resource-controller-k8s[Amazon VPC resource controller], which Amazon EKS installs on all clusters.
67+
68+
+
69+
To see the specification for a `ClusterRole`, replace [.replaceable]`eks:k8s-metrics` in the following command with a `ClusterRole` returned in the output of the previous command. The following example returns the specification for the [.replaceable]`eks:k8s-metrics` `ClusterRole`.
70+
+
71+
[source,bash,subs="verbatim,attributes"]
72+
----
73+
kubectl describe clusterrole eks:k8s-metrics
74+
----
75+
+
76+
An example output is as follows.
77+
+
78+
[source,bash,subs="verbatim,attributes"]
79+
----
80+
Name: eks:k8s-metrics
81+
Labels: <none>
82+
Annotations: <none>
83+
PolicyRule:
84+
Resources Non-Resource URLs Resource Names Verbs
85+
--------- ----------------- -------------- -----
86+
[/metrics] [] [get]
87+
endpoints [] [] [list]
88+
nodes [] [] [list]
89+
pods [] [] [list]
90+
deployments.apps [] [] [list]
91+
----
92+
+
93+
*ClusterRoleBindings* – `ClusterRoleBindings` are scoped to your cluster.
94+
+
95+
The following command returns all of the Amazon EKS created [.noloc]`Kubernetes` `ClusterRoleBindings` on your cluster.
96+
+
97+
[source,bash,subs="verbatim,attributes"]
98+
----
99+
kubectl get clusterrolebindings | grep eks
100+
----
101+
+
102+
In addition to the `ClusterRoleBindings` returned in the output, the following `ClusterRoleBindings` exist.
103+
+
104+
** *`aws-node`* – This `ClusterRoleBinding` supports the <<managing-vpc-cni,Amazon VPC CNI plugin for Kubernetes>>, which Amazon EKS installs on all clusters.
105+
** *`vpc-resource-controller-rolebinding`* – This `ClusterRoleBinding` supports the https://github.com/aws/amazon-vpc-resource-controller-k8s[Amazon VPC resource controller], which Amazon EKS installs on all clusters.
106+
107+
+
108+
To see the specification for a `ClusterRoleBinding`, replace [.replaceable]`eks:k8s-metrics` in the following command with a `ClusterRoleBinding` returned in the output of the previous command. The following example returns the specification for the [.replaceable]`eks:k8s-metrics` `ClusterRoleBinding`.
109+
+
110+
[source,bash,subs="verbatim,attributes"]
111+
----
112+
kubectl describe clusterrolebinding eks:k8s-metrics
113+
----
114+
+
115+
An example output is as follows.
116+
+
117+
[source,bash,subs="verbatim,attributes"]
118+
----
119+
Name: eks:k8s-metrics
120+
Labels: <none>
121+
Annotations: <none>
122+
Role:
123+
Kind: ClusterRole
124+
Name: eks:k8s-metrics
125+
Subjects:
126+
Kind Name Namespace
127+
---- ---- ---------
128+
User eks:k8s-metrics
129+
----
130+
+
131+
*Roles* – `Roles` are scoped to a [.noloc]`Kubernetes` namespace. All Amazon EKS created `Roles` are scoped to the `kube-system` namespace.
132+
+
133+
The following command returns all of the Amazon EKS created [.noloc]`Kubernetes` `Roles` on your cluster.
134+
+
135+
[source,bash,subs="verbatim,attributes"]
136+
----
137+
kubectl get roles -n kube-system | grep eks
138+
----
139+
+
140+
To see the specification for a `Role`, replace [.replaceable]`eks:k8s-metrics` in the following command with the name of a `Role` returned in the output of the previous command. The following example returns the specification for the [.replaceable]`eks:k8s-metrics` `Role`.
141+
+
142+
[source,bash,subs="verbatim,attributes"]
143+
----
144+
kubectl describe role eks:k8s-metrics -n kube-system
145+
----
146+
+
147+
An example output is as follows.
148+
+
149+
[source,bash,subs="verbatim,attributes"]
150+
----
151+
Name: eks:k8s-metrics
152+
Labels: <none>
153+
Annotations: <none>
154+
PolicyRule:
155+
Resources Non-Resource URLs Resource Names Verbs
156+
--------- ----------------- -------------- -----
157+
daemonsets.apps [] [aws-node] [get]
158+
deployments.apps [] [vpc-resource-controller] [get]
159+
----
160+
+
161+
*RoleBindings* – `RoleBindings` are scoped to a [.noloc]`Kubernetes` namespace. All Amazon EKS created `RoleBindings` are scoped to the `kube-system` namespace.
162+
+
163+
The following command returns all of the Amazon EKS created [.noloc]`Kubernetes` `RoleBindings` on your cluster.
164+
+
165+
[source,bash,subs="verbatim,attributes"]
166+
----
167+
kubectl get rolebindings -n kube-system | grep eks
168+
----
169+
+
170+
To see the specification for a `RoleBinding`, replace [.replaceable]`eks:k8s-metrics` in the following command with a `RoleBinding` returned in the output of the previous command. The following example returns the specification for the [.replaceable]`eks:k8s-metrics` `RoleBinding`.
171+
+
172+
[source,bash,subs="verbatim,attributes"]
173+
----
174+
kubectl describe rolebinding eks:k8s-metrics -n kube-system
175+
----
176+
+
177+
An example output is as follows.
178+
+
179+
[source,bash,subs="verbatim,attributes"]
180+
----
181+
Name: eks:k8s-metrics
182+
Labels: <none>
183+
Annotations: <none>
184+
Role:
185+
Kind: Role
186+
Name: eks:k8s-metrics
187+
Subjects:
188+
Kind Name Namespace
189+
---- ---- ---------
190+
User eks:k8s-metrics
191+
----
192+
193+

0 commit comments

Comments
 (0)