generated from kubernetes/kubernetes-template-project
-
Notifications
You must be signed in to change notification settings - Fork 408
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1570 from giantswarm/ecr_cred_provider
Add optional support for including ecr-credential-provider
- Loading branch information
Showing
11 changed files
with
148 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| # Including ECR Credential Provider | ||
|
|
||
| Starting with Kuberentes v1.27 the cloud credential providers are no longer included in-tree and need to be included as external binaries and referenced by the Kubelet. | ||
|
|
||
| To do this with image-builder you enable the use of [ecr-credential-provider](https://github.com/kubernetes/cloud-provider-aws/#aws-credential-provider) by setting the `ecr_credential_provider` packer variable to `true`. | ||
|
|
||
| Once enabled, the `ecr-credential-provider` binary will be downloaded, a `CredentialProviderConfig` config will be created, and the kubelet flags will be updated to reference both of these. | ||
|
|
||
| In most setups, this should be all that is needed but the following vars can be set to override various properties: | ||
|
|
||
| | variable | default | description | | ||
| | --- | --- | --- | | ||
| | ecr_credential_provider_version | "v1.31.0" | The release version of [cloud-provider-aws](https://github.com/kubernetes/cloud-provider-aws/) to use | | ||
| | ecr_credential_provider_os | "linux" | The operating system | | ||
| | ecr_credential_provider_arch | "amd64" | The architecture | | ||
| | ecr_credential_provider_base_url | "https://storage.googleapis.com/k8s-artifacts-prod/binaries/cloud-provider-aws" | The base URL of where to get the binary from | | ||
| | ecr_credential_provider_install_dir | "/opt/bin" | The location to install the binary into | | ||
| | ecr_credential_provider_binary_filename | "ecr-credential-provider" | The filename to use for the downloaded binary | | ||
| | ecr_credential_provider_match_images | ["*.dkr.ecr.*.amazonaws.com", "*.dkr.ecr.*.amazonaws.com.cn"] | An array of globs to use for matching images that should use the credential provider. (If using gov-cloud you may need to change this) | | ||
| | ecr_credential_provider_aws_profile | "default" | The AWS profile to use with the credential provider | | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
25 changes: 25 additions & 0 deletions
25
images/capi/ansible/roles/ecr_credential_provider/defaults/main.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| # Copyright 2024 The Kubernetes Authors. | ||
|
|
||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
|
|
||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
| --- | ||
|
|
||
| ecr_credential_provider_version: v1.31.0 | ||
| ecr_credential_provider_os: linux | ||
| ecr_credential_provider_arch: amd64 | ||
| ecr_credential_provider_base_url: https://storage.googleapis.com/k8s-artifacts-prod/binaries/cloud-provider-aws | ||
| ecr_credential_provider_install_dir: /opt/bin | ||
| ecr_credential_provider_binary_filename: ecr-credential-provider | ||
| ecr_credential_provider_match_images: | ||
| - "*.dkr.ecr.*.amazonaws.com" | ||
| - "*.dkr.ecr.*.amazonaws.com.cn" | ||
| ecr_credential_provider_aws_profile: default |
48 changes: 48 additions & 0 deletions
48
images/capi/ansible/roles/ecr_credential_provider/tasks/main.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| --- | ||
| - name: Ensure ecr_credential_provider is not already installed | ||
| ansible.builtin.stat: | ||
| path: "{{ ecr_credential_provider_install_dir }}/{{ ecr_credential_provider_binary_filename }}" | ||
| register: ecr_credential_provider_binary | ||
|
|
||
| - name: Install ECR Credential Provider binary | ||
| when: not ecr_credential_provider_binary.stat.exists | ||
| block: | ||
| - name: Ensure bin directory exists | ||
| ansible.builtin.file: | ||
| path: "{{ ecr_credential_provider_install_dir }}" | ||
| state: directory | ||
| mode: "0755" | ||
|
|
||
| - name: Download ecr_credential_provider binary | ||
| ansible.builtin.get_url: | ||
| url: "{{ ecr_credential_provider_base_url }}/{{ ecr_credential_provider_version }}/{{ ecr_credential_provider_os }}/{{ ecr_credential_provider_arch }}/ecr-credential-provider-{{ ecr_credential_provider_os }}-{{ ecr_credential_provider_arch }}" | ||
| dest: "{{ ecr_credential_provider_install_dir }}/{{ ecr_credential_provider_binary_filename }}" | ||
| mode: "0755" | ||
|
|
||
| - name: Create the CredentialProviderConfig for the ECR Credential Provider | ||
| block: | ||
| - name: Ensure config directory exists | ||
| ansible.builtin.file: | ||
| path: /var/usr/ecr-credential-provider | ||
| state: directory | ||
| mode: "0755" | ||
|
|
||
| - name: Create CredentialProviderConfig | ||
| ansible.builtin.template: | ||
| src: var/usr/ecr-credential-provider/ecr-credential-provider-config | ||
| dest: /var/usr/ecr-credential-provider/ecr-credential-provider-config | ||
| mode: "0644" | ||
|
|
||
| - name: Update kubelet args to include credential provider flags | ||
| block: | ||
| - name: Ensure kubelet config exists | ||
| ansible.builtin.stat: | ||
| path: "{{ '/etc/default/kubelet' if ansible_os_family == 'Debian' else '/etc/sysconfig/kubelet' }}" | ||
| register: kubelet_config | ||
| failed_when: not kubelet_config.stat.exists | ||
|
|
||
| - name: Add credential provider flags | ||
| when: kubelet_config.stat.exists | ||
| ansible.builtin.shell: | | ||
| set -e -o pipefail | ||
| sed -Ei 's|^(KUBELET_EXTRA_ARGS.*)|\1 --image-credential-provider-config=/var/usr/ecr-credential-provider/ecr-credential-provider-config --image-credential-provider-bin-dir={{ ecr_credential_provider_install_dir }}|' {{ '/etc/default/kubelet' if ansible_os_family == 'Debian' else '/etc/sysconfig/kubelet' }} |
10 changes: 10 additions & 0 deletions
10
...dential_provider/templates/var/usr/ecr-credential-provider/ecr-credential-provider-config
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| apiVersion: kubelet.config.k8s.io/v1 | ||
| kind: CredentialProviderConfig | ||
| providers: | ||
| - name: ecr-credential-provider | ||
| matchImages: {{ ecr_credential_provider_match_images }} | ||
| defaultCacheDuration: "12h" | ||
| apiVersion: credentialprovider.kubelet.k8s.io/v1 | ||
| env: | ||
| - name: AWS_PROFILE | ||
| value: "{{ ecr_credential_provider_aws_profile }}" |
Oops, something went wrong.