eks-anywhere icon indicating copy to clipboard operation
eks-anywhere copied to clipboard

Updating procedure to improve image-builder user mangement

Open jaradtke-aws opened this issue 1 year ago • 2 comments

Issue #, if available: The procedure for managing the image-builder user in the Operating Systems Management | Artifacts page contained unnecessary steps that modified the underlying OS. The goal is to add a user (image-builder) and configure the system to allow that user to run the image-builder process. That requires that the user can access /dev/kvm (which has permissions: crw-rw---- root:kvm) indicating that the user needs to either be the root user, or belong to the kvm group. This PR was created for Issue #7846 https://github.com/aws/eks-anywhere/issues/7846

Description of changes: Update the user management procedure to be OS-specific. Added additional configuraiton to add the image-builder user to the appropriate groups at creation time (sudo/wheel,kvm). replaced "/home/$USER" with "${HOME}" throughout entire document. removed suggestions to modify OS file permissions to /dev/kvm.

NOTE: there are essentially 2 procedure for creating an image (requires KVM: Bare Metal/Cloud Stack - the other methods do not)

Removed any steps demonstrating how to modify the OS

-   sudo usermod -a -G kvm $USER
-   sudo chmod 666 /dev/kvm
-   sudo chown root:kvm /dev/kvm

Updated the step to create a user to have that step include the kvm and "admin" group at that time (several examples provided here)

-   sudo adduser image-builder
+   sudo useradd -G kvm,sudo image-builder
+   sudo useradd -G kvm,wheel image-builder
+   sudo useradd -G sudo image-builder
+   sudo useradd -G wheel image-builder

If the user was created using the updated useradd command, then the usermod step is unnecessary. Therefore removed that step

-   sudo usermod -aG sudo image-builder

Testing (if applicable): The following was run on an Ubuntu 22.04

# sudo useradd -G kvm,sudo testuser
$ groups testuser
testuser : testuser kvm
$ grep '^NAME|^VERSION' /etc/*release*
/etc/os-release:NAME="Ubuntu"
/etc/os-release:VERSION_ID="22.04"
/etc/os-release:VERSION="22.04.4 LTS (Jammy Jellyfish)"
/etc/os-release:VERSION_CODENAME=jammy

The following was run on Red Hat Enterprise Linux 8

$ sudo useradd -G kvm,wheel testuser
$ groups testuser
testuser : testuser wheel kvm
$ egrep '^NAME|^VERSION' /etc/*release*
/etc/os-release:NAME="Red Hat Enterprise Linux"
/etc/os-release:VERSION="8.9 (Ootpa)"
/etc/os-release:VERSION_ID="8.9"

Documentation added/planned (if applicable):

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

jaradtke-aws avatar Mar 15 '24 15:03 jaradtke-aws

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please assign csplinter for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

eks-distro-bot avatar Mar 15 '24 15:03 eks-distro-bot

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 73.39%. Comparing base (0e02f8e) to head (00cd95b).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #7852   +/-   ##
=======================================
  Coverage   73.39%   73.39%           
=======================================
  Files         576      576           
  Lines       35622    35622           
=======================================
  Hits        26144    26144           
  Misses       7826     7826           
  Partials     1652     1652           

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

codecov[bot] avatar Mar 15 '24 16:03 codecov[bot]