amazon-eks-ami
amazon-eks-ami copied to clipboard
Adjusted install-worker to redirect GovCloud
Issue #, if available: 1536
Description of changes:
Currently, the S3 bucket for the kubelet binary in us-gov-west-1 (and us-gov-east-1) returns an 403 - Access Denied
HTTP Code when attempting to download it, when the binary_bucket_region
variable is set to us-gov-west-1
or us-gov-east-1
instead of the default us-west-2
.
I added a redirect from us-gov-west-1
and us-gov-east-1
to us-west-2
and us-east-2
repectively.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
Step 1 - Adjusted file as noted above and in the diff (line numbers included)
279 # Updating binary_bucket_region variable to redirect from us-gov-west-1 and us-gov-east-1 to us-west-2 and us-east-2 respectively, as the buckets in GovCloud regions is returning Access Denieds
280 # https://github.com/awslabs/amazon-eks-ami/issues/1536
281 elif [ "$BINARY_BUCKET_REGION" = "us-gov-west-1" ]; then
282 BINARY_BUCKET_REGION="us-west-2"
283 elif [ "$BINARY_BUCKET_REGION" = "us-gov-east-1" ]; then
284 BINARY_BUCKET_REGION="us-east-2"
Without Line Numbers:
# Updating binary_bucket_region variable to redirect from us-gov-west-1 and us-gov-east-1 to us-west-2 and us-east-2 respectively, as the buckets in GovCloud regions is returning Access Denieds
# https://github.com/awslabs/amazon-eks-ami/issues/1536
elif [ "$BINARY_BUCKET_REGION" = "us-gov-west-1" ]; then
BINARY_BUCKET_REGION="us-west-2"
elif [ "$BINARY_BUCKET_REGION" = "us-gov-east-1" ]; then
BINARY_BUCKET_REGION="us-east-2"
fi
Step 2 - Change the bucket_binary_region
variable in eks-worker-al2-variables.json
(example provided assuming that the amazon-eks-ami
the current working directory)
sed -i 's/\"binary_bucket_region\": \"us-west-2\"/\"binary_bucket_region\": \"us-gov-west-1\"/g' eks-worker-al2-variables.json
Step 3 - Built an AMI using packer as noted here: https://aws.amazon.com/blogs/containers/building-amazon-linux-2-cis-benchmark-amis-for-amazon-eks/ Example command:
make 1.27 aws_region=$AWS_REGION source_ami_id=$AMI_ID source_ami_owners=$AMI_OWNER_ACCOUNT_ID source_ami_filter_name="$AMI_NAME" subnet_id="$SUBNET_ID"
Note: In addition to the variables in the above, you also need to set the kubernetes_version
and kubernetes_build_date
as the hack/latest-binaries.sh
also throws an error in GovCloud. Here are the variables I used:
kubernetes_build_date=2023-11-14
kubernetes_version=1.27.7
See this guide for recommended testing for PRs. Some tests may not apply. Completing tests and providing additional validation steps are not required, but it is recommended and may reduce review time and time to merge.