Skip to content

Commit bbc17f5

Browse files
aledbfaledbf
committed
Update AMI
1 parent 5137f11 commit bbc17f5

File tree

10 files changed

+108
-98
lines changed

10 files changed

+108
-98
lines changed

‎README.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ Please update the `ami` field in the [eks-cluster.yaml](eks-cluster.yaml) file w
2020

2121
| Region | AMI |
2222
| ------------ | --------------------- |
23-
| us-west-1 | ami-06c84b5625f8b9604 |
24-
| us-west-2 | ami-0a9aa973650d0c831 |
25-
| eu-west-1 | ami-0de99790cc9326e71 |
26-
| eu-west-2 | ami-0fea47c0b713f556a |
27-
| eu-central-1 | ami-037f1d445b7fce6d9 |
28-
| us-east-1 | ami-0cb54c9245b490884 |
29-
| us-east-2 | ami-0648e811b79d1c89a |
23+
| us-west-1 | ami-0f3e6671ef1ede777 |
24+
| us-west-2 | ami-04a6d2a3b0d131841 |
25+
| eu-west-1 | ami-0542a7d18c5df4e79 |
26+
| eu-west-2 | ami-060cb8be1976f9dd5 |
27+
| eu-central-1 | ami-0d58b84ef791d4348 |
28+
| us-east-1 | ami-0efd7bb7f07150aa3 |
29+
| us-east-2 | ami-08b5bc88b0131552f |
3030

3131

3232
**To start the installation, execute:**
@@ -41,12 +41,12 @@ The whole process takes around forty minutes. In the end, the following resource
4141

4242
- an EKS cluster running Kubernetes v1.21
4343
- Kubernetes nodes using a custom [AMI image](https://github.com/gitpod-io/amazon-eks-custom-amis/tree/gitpod):
44-
- Ubuntu 20.04
44+
- Ubuntu 21.10
4545
- Linux kernel v5.13
46-
- containerd v1.5.5
46+
- containerd v1.5.8
4747
- runc: v1.0.1
4848
- CNI plugins: v0.9.1
49-
- Stargz Snapshotter: v0.7.0
49+
- Stargz Snapshotter: v0.10.0
5050

5151
- ALB load balancer with TLS termination and re-encryption
5252
- RDS Mysql database

‎ami/Makefile

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
PACKER_VARIABLES := binary_bucket_name binary_bucket_region eks_version eks_build_date cni_plugin_version root_volume_size data_volume_size hardening_flag http_proxy https_proxy no_proxy
2+
PACKER_VARIABLES := binary_bucket_name binary_bucket_region eks_version eks_build_date root_volume_size data_volume_size hardening_flag http_proxy https_proxy no_proxy
33
VPC_ID := vpc-0e8cf1ce122b1b059
44
SUBNET_ID := subnet-0eddf1d7d0f9f9772
55
AWS_REGION := us-west-2
@@ -15,12 +15,12 @@ build:
1515
$(foreach packerVar,$(PACKER_VARIABLES), $(if $($(packerVar)),--var $(packerVar)='$($(packerVar))',)) \
1616
$(PACKER_FILE)
1717

18-
# Ubuntu 20.04
18+
# Ubuntu 21.10
1919
#-----------------------------------------------------
2020
# https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html
2121

22-
build-ubuntu2004-1.20:
23-
$(MAKE) build PACKER_FILE=amazon-eks-node-ubuntu2004.json eks_version=$(EKS_120_VERSION) eks_build_date=2021-04-12
22+
build-ubuntu2110-1.20:
23+
$(MAKE) build PACKER_FILE=amazon-eks-node-ubuntu2110.json eks_version=$(EKS_120_VERSION) eks_build_date=2021-04-12
2424

25-
build-ubuntu2004-1.21:
26-
$(MAKE) build PACKER_FILE=amazon-eks-node-ubuntu2004.json eks_version=$(EKS_121_VERSION) eks_build_date=2021-07-05
25+
build-ubuntu2110-1.21:
26+
$(MAKE) build PACKER_FILE=amazon-eks-node-ubuntu2110.json eks_version=$(EKS_121_VERSION) eks_build_date=2021-07-05

‎ami/amazon-eks-node-ubuntu2004.json renamed to ‎ami/amazon-eks-node-ubuntu2110.json

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
11
{
22
"variables":{
3-
"aws_region":"us-east-2",
4-
"ami_description":"EKS Kubernetes Worker AMI on Ubuntu 20.04 (k8s: {{user `eks_version`}})",
3+
"aws_region":"us-west-2",
4+
"ami_description":"EKS Kubernetes Worker AMI on Ubuntu 21.10 (k8s: {{user `eks_version`}})",
55
"eks_version":"",
66
"eks_build_date":"",
7-
"cni_plugin_version": "v0.9.1",
87
"binary_bucket_name": "amazon-eks",
98
"binary_bucket_region": "us-west-2",
109
"hardening_flag": "false",
@@ -20,8 +19,8 @@
2019
"source_ami_owner_govcloud": "513442679011",
2120
"source_ami_ssh_user": "ubuntu",
2221
"source_ami_arch":"x86_64",
23-
"source_ami_name":"ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*",
24-
"target_ami_name": "amazon-eks-node-{{user `eks_version`}}-ubuntu-20.04-{{ timestamp }}"
22+
"source_ami_name":"ubuntu/images/hvm-ssd/ubuntu-impish-21.10-amd64-server-*",
23+
"target_ami_name": "amazon-eks-node-{{user `eks_version`}}-ubuntu-21.10-{{ timestamp }}"
2524
},
2625
"builders":[
2726
{
@@ -41,7 +40,7 @@
4140
],
4241
"most_recent":true
4342
},
44-
"instance_type":"m5.xlarge",
43+
"instance_type":"m6i.xlarge",
4544
"ssh_username":"{{user `source_ami_ssh_user`}}",
4645
"ssh_pty":true,
4746
"subnet_id":"{{user `subnet_id`}}",
@@ -63,7 +62,7 @@
6362
{
6463
"device_name":"/dev/sdb",
6564
"volume_size":"{{user `data_volume_size`}}",
66-
"volume_type":"gp2",
65+
"volume_type":"gp3",
6766
"delete_on_termination":true
6867
}
6968
],
@@ -106,7 +105,6 @@
106105
"KUBERNETES_BUILD_DATE={{user `eks_build_date`}}",
107106
"BINARY_BUCKET_NAME={{user `binary_bucket_name`}}",
108107
"BINARY_BUCKET_REGION={{user `binary_bucket_region`}}",
109-
"CNI_PLUGIN_VERSION={{user `cni_plugin_version`}}",
110108
"HARDENING_FLAG={{user `hardening_flag`}}"
111109
],
112110
"execute_command":"echo 'packer' | {{.Vars}} sudo -S -E bash -eux '{{.Path}}'",
@@ -128,13 +126,21 @@
128126
"KUBERNETES_BUILD_DATE={{user `eks_build_date`}}",
129127
"BINARY_BUCKET_NAME={{user `binary_bucket_name`}}",
130128
"BINARY_BUCKET_REGION={{user `binary_bucket_region`}}",
131-
"CNI_PLUGIN_VERSION={{user `cni_plugin_version`}}",
132129
"HARDENING_FLAG={{user `hardening_flag`}}"
133130
],
134131
"execute_command":"echo 'packer' | {{.Vars}} sudo -S -E bash -eux '{{.Path}}'",
135132
"expect_disconnect":true,
136133
"pause_after":"30s"
137134
},
135+
{
136+
"type":"shell",
137+
"scripts":[
138+
"./scripts/ubuntu2004/shiftfs.sh"
139+
],
140+
"execute_command":"echo 'packer' | {{.Vars}} sudo -S -E bash -eux '{{.Path}}'",
141+
"expect_disconnect":true,
142+
"pause_after":"30s"
143+
},
138144
{
139145
"type":"shell",
140146
"scripts": [
@@ -149,7 +155,6 @@
149155
"KUBERNETES_BUILD_DATE={{user `eks_build_date`}}",
150156
"BINARY_BUCKET_NAME={{user `binary_bucket_name`}}",
151157
"BINARY_BUCKET_REGION={{user `binary_bucket_region`}}",
152-
"CNI_PLUGIN_VERSION={{user `cni_plugin_version`}}",
153158
"HARDENING_FLAG={{user `hardening_flag`}}"
154159
],
155160
"execute_command":"echo 'packer' | {{.Vars}} sudo -S -E bash -eux '{{.Path}}'"

‎ami/files/gitpod/containerd-stargz-grpc.toml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[cri_keychain]
2+
enable_keychain = true
3+
image_service_path = "/run/containerd/containerd.sock"

‎ami/files/gitpod/containerd.toml

Lines changed: 35 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,38 @@
1+
# explicitly use v2 config format
12
version = 2
23

3-
[plugins]
4-
[plugins."io.containerd.grpc.v1.cri"]
5-
max_concurrent_downloads = 20
6-
sandbox_image = "k8s.gcr.io/pause:3.5"
7-
8-
[plugins."io.containerd.grpc.v1.cri".containerd]
9-
default_runtime_name = "runc"
10-
#snapshotter = "overlayfs"
11-
12-
snapshotter = "stargz"
13-
disable_snapshot_annotations = false
14-
15-
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
16-
17-
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
18-
privileged_without_host_devices = false
19-
runtime_type = "io.containerd.runc.v2"
20-
21-
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
22-
SystemdCgroup = true
23-
24-
[plugins."io.containerd.grpc.v1.cri".registry]
25-
config_path = "/etc/containerd/certs.d"
26-
274
[proxy_plugins]
28-
[proxy_plugins.stargz]
29-
type = "snapshot"
30-
address = "/run/containerd-stargz-grpc/containerd-stargz-grpc.sock"
5+
# stargz is used for lazy pulling
6+
[proxy_plugins.stargz]
7+
type = "snapshot"
8+
address = "/run/containerd-stargz-grpc/containerd-stargz-grpc.sock"
9+
10+
[plugins."io.containerd.grpc.v1.cri".containerd]
11+
# save disk space when using a single snapshotter
12+
discard_unpacked_layers = true
13+
# enable stargz snapshotter
14+
snapshotter = "stargz"
15+
# pass additional snapshotter labels to remote snapshotter
16+
disable_snapshot_annotations = false
17+
# explicit default here, as we're configuring it below
18+
default_runtime_name = "runc"
19+
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
20+
# set default runtime handler to v2, which has a per-pod shim
21+
runtime_type = "io.containerd.runc.v2"
22+
23+
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
24+
SystemdCgroup = true
25+
26+
# allow pulling from registries using self-signed SSL certificates
27+
[plugins."io.containerd.grpc.v1.cri".registry]
28+
config_path = "/etc/containerd/certs.d"
29+
30+
[plugins."io.containerd.grpc.v1.cri"]
31+
max_concurrent_downloads = 20
32+
# use fixed sandbox image
33+
sandbox_image = "k8s.gcr.io/pause:3.6"
34+
# allow hugepages controller to be missing
35+
# see https://github.com/containerd/cri/pull/1501
36+
tolerate_missing_hugepages_controller = true
37+
# restrict_oom_score_adj needs to be true when running inside UserNS (rootless)
38+
restrict_oom_score_adj = false

‎ami/files/gitpod/kubelet.service

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ ExecStart=/usr/bin/kubelet --cloud-provider aws \
1212
--resolv-conf=/run/systemd/resolve/resolv.conf \
1313
--container-runtime remote \
1414
--container-runtime-endpoint unix:///run/containerd/containerd.sock \
15+
--image-service-endpoint=unix:///run/containerd-stargz-grpc/containerd-stargz-grpc.sock \
1516
$KUBELET_ARGS $KUBELET_EXTRA_ARGS
1617

1718
Restart=on-failure

‎ami/scripts/shared/docker.sh

Lines changed: 22 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4,24 +4,21 @@ set -o pipefail
44
set -o nounset
55
set -o errexit
66

7-
# shellcheck disable=SC1091
8-
source /etc/packer/files/functions.sh
9-
10-
apt-get install -y apt-transport-https ca-certificates curl gnupg-agent software-properties-common
11-
12-
add-apt-repository -y ppa:tuxinvader/lts-mainline
13-
apt-get update
14-
apt-get install -y linux-generic-5.13
7+
# Update OS
8+
apt update
159

1610
# Install required packages
17-
apt-get install -y \
11+
apt --no-install-recommends install -y \
12+
apt-transport-https ca-certificates curl gnupg2 software-properties-common \
1813
iptables libseccomp2 socat conntrack ipset \
1914
fuse3 \
2015
jq \
2116
iproute2 \
2217
auditd \
2318
ethtool \
24-
net-tools
19+
net-tools \
20+
linux-aws \
21+
dkms
2522

2623
mkdir -p /etc/modules-load.d/
2724

@@ -39,37 +36,37 @@ blacklist dccp
3936
blacklist sctp
4037
EOF
4138

42-
# Configure grub
43-
# echo "GRUB_GFXPAYLOAD_LINUX=keep" >> /etc/default/grub
4439
# Enable cgroups2
45-
# sed -i 's/GRUB_CMDLINE_LINUX="\(.*\)"/GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=1 cgroup_no_v1=all \1"/g' /etc/default/grub
46-
# update-grub2
40+
# sed -i 's/GRUB_CMDLINE_LINUX="\(.*\)"/GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=1 \1"/g' /etc/default/grub
4741

4842
# Install containerd
49-
curl -sSL https://github.com/containerd/nerdctl/releases/download/v0.11.1/nerdctl-full-0.11.1-linux-amd64.tar.gz -o - | tar -xz -C /usr/local
43+
curl -sSL https://github.com/containerd/nerdctl/releases/download/v0.14.0/nerdctl-full-0.14.0-linux-amd64.tar.gz -o - | tar -xz -C /usr/local
5044

51-
mkdir -p /etc/containerd /etc/containerd/certs.d
52-
53-
cp /etc/packer/files/gitpod/containerd.toml /etc/containerd/config.toml
45+
# copy the portmap plugin to support hostport
46+
mkdir -p /opt/cni/bin
47+
ln -s /usr/local/libexec/cni/portmap /opt/cni/bin
5448

5549
cp /usr/local/lib/systemd/system/* /lib/systemd/system/
56-
sed -i 's/--log-level=debug//g' /lib/systemd/system/stargz-snapshotter.service
5750

58-
cp /usr/local/lib/systemd/system/* /lib/systemd/system/
59-
# Disable software irqbalance service
60-
systemctl stop irqbalance.service
61-
systemctl disable irqbalance.service
51+
# Configure containerd
52+
mkdir -p /etc/containerd/
53+
cp /etc/packer/files/gitpod/containerd.toml /etc/containerd/config.toml
54+
# Enable stargz-snapshotter plugin
55+
mkdir -p /etc/containerd-stargz-grpc
56+
cp /etc/packer/files/gitpod/containerd-stargz-grpc.toml /etc/containerd-stargz-grpc/config.toml
57+
cp /etc/packer/files/gitpod/stargz-snapshotter.service /lib/systemd/system/stargz-snapshotter.service
6258

6359
# Reload systemd
6460
systemctl daemon-reload
6561

66-
mkdir -p /etc/containerd-stargz-grpc/
67-
6862
# Start containerd and stargz
6963
systemctl enable containerd
7064
systemctl enable stargz-snapshotter
7165

66+
echo "image-endpoint: unix:///run/containerd-stargz-grpc/containerd-stargz-grpc.sock" >> /etc/crictl.yaml
67+
7268
systemctl start containerd
69+
systemctl start stargz-snapshotter
7370

7471
# Prepare images airgap tgz
7572
chmod +x /etc/packer/files/gitpod/airgap.sh

‎ami/scripts/shared/eks.sh

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -71,20 +71,6 @@ for binary in ${BINARIES[*]} ; do
7171
mv $binary /usr/bin/
7272
done
7373

74-
# Since CNI 0.7.0, all releases are done in the plugins repo.
75-
CNI_PLUGIN_FILENAME="cni-plugins-linux-${ARCH}-${CNI_PLUGIN_VERSION}"
76-
77-
curl -sL -o "${CNI_PLUGIN_FILENAME}.tgz" "https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGIN_VERSION}/${CNI_PLUGIN_FILENAME}.tgz"
78-
curl -sL -o "${CNI_PLUGIN_FILENAME}.tgz.sha512" "https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGIN_VERSION}/${CNI_PLUGIN_FILENAME}.tgz.sha512"
79-
80-
sha512sum -c "${CNI_PLUGIN_FILENAME}.tgz.sha512"
81-
rm "${CNI_PLUGIN_FILENAME}.tgz.sha512"
82-
83-
tar -xvf "${CNI_PLUGIN_FILENAME}.tgz" -C /opt/cni/bin
84-
rm "${CNI_PLUGIN_FILENAME}.tgz"
85-
86-
rm ./*.sha256
87-
8874
mkdir -p /etc/kubernetes/kubelet
8975
mkdir -p /etc/systemd/system/kubelet.service.d
9076

@@ -98,16 +84,12 @@ configure_kubelet_environment
9884

9985
systemctl daemon-reload && systemctl disable kubelet
10086

101-
mkdir -p /var/lib/containerd/io.containerd.snapshotter.v1.stargz
102-
10387
################################################################################
10488
### EKS ########################################################################
10589
################################################################################
10690

10791
mkdir -p /etc/eks
108-
# Temporal https://github.com/awslabs/amazon-eks-ami/pull/735
109-
curl -sL -o /etc/eks/eni-max-pods.txt https://raw.githubusercontent.com/awslabs/amazon-eks-ami/e9b681acc4ea08d22a82eb4388734a225d153561/files/eni-max-pods.txt
110-
# https://raw.githubusercontent.com/awslabs/amazon-eks-ami/master/files/eni-max-pods.txt
92+
curl -sL -o /etc/eks/eni-max-pods.txt https://raw.githubusercontent.com/awslabs/amazon-eks-ami/master/files/eni-max-pods.txt
11193

11294
cp /etc/packer/files/gitpod/bootstrap.sh /etc/eks/bootstrap.sh
11395
chown root:root /etc/eks/bootstrap.sh

‎ami/scripts/ubuntu2004/boilerplate.sh

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,16 @@ set -o pipefail
44
set -o nounset
55
set -o errexit
66

7+
export DEBIAN_FRONTEND=noninteractive
8+
79
# shellcheck disable=SC1091
810
source /etc/packer/files/functions.sh
911

1012
# wait for cloud-init to finish
1113
wait_for_cloudinit
1214

1315
# upgrade the operating system
14-
apt-get update -y && apt-get upgrade -y
16+
apt update -y && apt dist-upgrade -y
1517

1618
# install dependencies
1719
apt-get install -y \

‎ami/scripts/ubuntu2004/shiftfs.sh

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env bash
2+
3+
set -o pipefail
4+
set -o nounset
5+
set -o errexit
6+
7+
git clone -b k5.13 https://github.com/toby63/shiftfs-dkms.git /tmp/shiftfs-k513
8+
cd /tmp/shiftfs-k513
9+
make -f Makefile.dkms
10+
modinfo shiftfs
11+
12+
reboot

0 commit comments

Comments
 (0)