Amazon EKS cluster endpoint access control

To modify your cluster API server endpoint access using the Amazon Web Services Management Console

1. Open the Amazon EKS console at https://console.amazonaws.cn/eks/home#/clusters.

2. Choose the name of the cluster to display your cluster information.

3. Choose the Networking tab and choose Update.

4. For Private access, choose whether to enable or disable private access for your cluster's Kubernetes API server endpoint. If you enable private access, Kubernetes API requests that originate from within your cluster's VPC use the private VPC endpoint. You must enable private access to disable public access.

5. For Public access, choose whether to enable or disable public access for your cluster's Kubernetes API server endpoint. If you disable public access, your cluster's Kubernetes API server can only receive requests from within the cluster VPC.

6. (Optional) If you've enabled Public access, you can specify which addresses from the internet can communicate to the public endpoint. Select Advanced Settings. Enter a CIDR block, such as 203.0.113.5/32. The block cannot include reserved addresses. You can enter additional blocks by selecting Add Source. There is a maximum number of CIDR blocks that you can specify. For more information, see Amazon EKS service quotas. If you specify no blocks, then the public API server endpoint receives requests from all (0.0.0.0/0) IP addresses. If you restrict access to your public endpoint using CIDR blocks, it is recommended that you also enable private endpoint access so that nodes and Fargate Pods (if you use them) can communicate with the cluster. Without the private endpoint enabled, your public access endpoint CIDR sources must include the egress sources from your VPC. For example, if you have a node in a private subnet that communicates to the internet through a NAT Gateway, you will need to add the outbound IP address of the NAT gateway as part of an allowed CIDR block on your public endpoint.

7. Choose Update to finish.

To modify your cluster API server endpoint access using the Amazon CLI

Complete the following steps using the Amazon CLI version 1.27.160 or later. You can check your current version with aws --version. To install or upgrade the Amazon CLI, see Installing the Amazon CLI.

1. Update your cluster API server endpoint access with the following Amazon CLI command. Substitute your cluster name and desired endpoint access values. If you set endpointPublicAccess=true, then you can (optionally) enter single CIDR block, or a comma-separated list of CIDR blocks for publicAccessCidrs. The blocks cannot include reserved addresses. If you specify CIDR blocks, then the public API server endpoint will only receive requests from the listed blocks. There is a maximum number of CIDR blocks that you can specify. For more information, see Amazon EKS service quotas. If you restrict access to your public endpoint using CIDR blocks, it is recommended that you also enable private endpoint access so that nodes and Fargate Pods (if you use them) can communicate with the cluster. Without the private endpoint enabled, your public access endpoint CIDR sources must include the egress sources from your VPC. For example, if you have a node in a private subnet that communicates to the internet through a NAT Gateway, you will need to add the outbound IP address of the NAT gateway as part of an allowed CIDR block on your public endpoint. If you specify no CIDR blocks, then the public API server endpoint receives requests from all (0.0.0.0/0) IP addresses.

   Note

   The following command enables private access and public access from a single IP address for the API server endpoint. Replace 203.0.113.5/32 with a single CIDR block, or a comma-separated list of CIDR blocks that you want to restrict network access to.

   aws eks update-cluster-config \
       --region region-code \
       --name my-cluster \
       --resources-vpc-config endpointPublicAccess=true,publicAccessCidrs="203.0.113.5/32",endpointPrivateAccess=true
   

   An example output is as follows.

   {
       "update": {
           "id": "e6f0905f-a5d4-4a2a-8c49-EXAMPLE00000",
           "status": "InProgress",
           "type": "EndpointAccessUpdate",
           "params": [
               {
                   "type": "EndpointPublicAccess",
                   "value": "true"
               },
               {
                   "type": "EndpointPrivateAccess",
                   "value": "true"
               },
               {
                   "type": "publicAccessCidrs",
                   "value": "[\203.0.113.5/32\"]"
               }
           ],
           "createdAt": 1576874258.137,
           "errors": []
       }
   }

2. Monitor the status of your endpoint access update with the following command, using the cluster name and update ID that was returned by the previous command. Your update is complete when the status is shown as Successful.

   aws eks describe-update \
       --region region-code \
       --name my-cluster \
       --update-id e6f0905f-a5d4-4a2a-8c49-EXAMPLE00000
   

   An example output is as follows.

   {
       "update": {
           "id": "e6f0905f-a5d4-4a2a-8c49-EXAMPLE00000",
           "status": "Successful",
           "type": "EndpointAccessUpdate",
           "params": [
               {
                   "type": "EndpointPublicAccess",
                   "value": "true"
               },
               {
                   "type": "EndpointPrivateAccess",
                   "value": "true"
               },
               {
                   "type": "publicAccessCidrs",
                   "value": "[\203.0.113.5/32\"]"
               }
           ],
           "createdAt": 1576874258.137,
           "errors": []
       }
   }