Trying to use either sheltie or apiclient commands in user-data scripts

[harshabadakere]

Hi,

I am using the bottlerocket AMI in AWS(bottlerocket-aws-k8s-1.31-x86_64-v1.32.0-cacc4ce9) for EKS nodegroup. I have a requirement where in I need to attach a secondary network interface to the EKS nodes and configure IP routes to it through a user data script.

I am using a bootstrap container to run my userdata script. My script needs to use ip command to set the routes and interfaces. Currently I am having trouble using sheltie ip commands in my script. I am getting the below error:

Feb 13 21:47:23.160166 ip-10-168-5-88.ap-northeast-1.compute.internal bootstrap-containers@bootstrap[2700]: /.bottlerocket/rootfs/var/lib/initial/user-data.sh: line 20: sheltie: not found

Is sheltie supported for bootstrap containers? If not is there any other way to achieve what I need to do?

Regards,
Harsha

[cbgbt]

Hello,

sheltie itself is a script that is included with the admin container (source code.)

Bootstrap containers themselves do not have superuser access; however, they do have CAP_SYS_ADMIN. You can't use nsenter in the same way that sheltie does, but you can just execute ip route directly.

For example, the following bootstrap container script does the trick:

#!/usr/bin/env sh
set -euo pipefail -x

yum -y install iproute

ip route add 192.168.1.0/24 dev eth0

To configure this, I provided userdata like so:

[settings.bootstrap-containers.ip-example]
essential = true
mode = "always"
user-data =
"IyEvdXNyL2Jpbi9lbnYgc2gKCnNldCAtZXVvIHBpcGVmYWlsIC14Cgp5dW0gLXkgaW5zdGFsbCBpcHJvdXRlCgplY2hvICJleGVjdXRpbmcgaXAiCmlwIHJvdXRl
IGZsdXNoIGNhY2hlCmlwIHJvdXRlIGFkZCAxOTIuMTY4LjEuMC8yNCBkZXYgZXRoMAplY2hvICJkb25lIgoK"
source = "public.ecr.aws/bottlerocket/bottlerocket-bootstrap:v0.1.1"

To prove that this worked, I enabled the admin container, logged in, then did:

[ec2-user@admin]$ sudo sheltie ip route
...
192.168.1.0/24 dev eth0 scope link

Hope that helps! Let me know if you have any questions.

[harshabadakere]

Thanks. Yes that helped resolve my issue.