amazon-eks-ami
amazon-eks-ami copied to clipboard
Add PRIVATE_BIN_REPO support for pulling binaries
As a EKS ami builder, I want to be able to pull binaries from my own repo of cached artifacts so that I can ensure availability, reproducibility, and security.
In my particular case, the binaries are not currently available in s3://amazon-eks.s3.us-gov-west-1.amazonaws.com and egress rules are tightly controlled.
How to use:
-
User caches/stages the binaries in their own artifact repo. At present, these are:
- kubelet
- aws-iam-authenticator
- cni-plugins-linux
-
User adds the PRIVATE_BIN_REPO variable to their custom eks-worker config
Given that this is an edge uncommon use case, the PRIVATE_BIN_REPO user variable has not been added to the eks-worker config. Users will continue to use the existing behavior by default.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
You can already configured a private S3 bucket. Is there a reason that's insufficient for your use case?
I'm trying to add additional flexibility. I'm in a tightly controlled environment where all external artifacts must enter through a series of artifact repositories and promotion pipelines. I've added this change to pull from the repository rather than me needing to have extra process/automation to manage redundant artifacts in a s3 bucket.
must enter through a series of artifact repositories
IIUC, PRIVATE_BIN_REPO
/"artifact repositories" are just file servers?
the binaries are not currently available in s3://amazon-eks.s3.us-gov-west-1.amazonaws.com
This is something we're planning to address! Because the aws-us-gov
regions aren't airgapped, we haven't replicated binaries into that partition in the past; but we've heard from several customers that can't do cross-partition access for policy reasons. If the binaries were available in s3://amazon-eks
in this partition, would that solve your problem?
We still intend to replicate these binaries into the aws-us-gov
partition; but I don't think this PR makes sense in its current form.