From ddbd1e64a796f1909c01e580dec974bc222c2892 Mon Sep 17 00:00:00 2001 From: Hao Zhou Date: Wed, 9 Dec 2020 18:29:06 -0800 Subject: [PATCH] Update README for Per Pod Security Group --- README.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 18743105a5..7714006353 100644 --- a/README.md +++ b/README.md @@ -423,8 +423,13 @@ Type: Boolean as a String Default: `false` -To enable security groups for pods you need to have at least an EKS 1.17 eks.3 cluster. Setting `ENABLE_POD_ENI` to `true` -will add the `vpc.amazonaws.com/has-trunk-attached` label to the node if it is possible to attach an additional ENI. +To enable security groups for pods you need to have at least an EKS 1.17 eks.3 cluster. + +Setting `ENABLE_POD_ENI` to `true` will allow IPAMD to add the `vpc.amazonaws.com/has-trunk-attached` label to the node if the instance has capacity to attach an additional ENI. + +The label notifies vpc-resource-controller (https://github.com/aws/amazon-vpc-resource-controller-k8s) to attach a Trunk ENI to the instance. The label value is initially set to `false` and is marked to `true` by IPAMD when vpc-resource-controller attaches a Trunk ENI to the instance. However, there might be cases where the label value will remain `false` if the instance doesn't support ENI Trunking. + +**NOTE!** Toggling `ENABLE_POD_ENI` from `true` to `false` will not detach the Trunk ENI from instance. To delete/detach the Trunk ENI from instance, you need recycle the instance. ---