IMAGE_NAME="eks-node" IMAGE_DESCRIPTION="Unified EKS K3s node VM — Alpine + K3s v1.32.5+k3s1 + eks-token-webhook + konnectivity-server v0.30.3; role (server|agent) chosen at first boot" DISTRO="alpine" ALPINE_VERSION="3.21.7" # 4G — server superset (K3s server binary + embedded-etcd datastore working set under # /var/lib/rancher/k3s on the root disk). Agents use the same image; the ~10MB # of unused server binary + webhook is dwarfed by the headroom for node images. IMAGE_SIZE="4G" # Server superset of both package sets (etcd-ctl is ~5MB, not worth branching). # K3s pulls cgroups + iptables; jq builds the bootstrap-message JSON envelopes; # etcd-client used by the snapshot script (server role only). The control plane # reaches the host via the AWS gateway (eks-gateway-publish), not a NATS CLI. APK_PACKAGES="ca-certificates curl jq iptables ip6tables conntrack-tools cgroup-tools etcd-ctl openrc" # eks-token-webhook binary always installed (agents never start it). # eks-gateway-publish relays the bootstrap envelopes + state reports to the AWS # gateway over SigV4 HTTPS (server role only). The k3s binary is downloaded + # SHA256-verified by setup.sh (network in chroot). # konnectivity-server is built from the upstream apiserver-network-proxy source # at a pinned tag (its GitHub releases ship only container images, and its go.mod # carries replace directives that block `go install pkg@version`). The agent half # is the matching proxy-agent container image, pinned in k3s.initd. BUILD_COMMANDS="CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -o bin/eks-token-webhook ./cmd/eks-token-webhook && CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -o bin/eks-gateway-publish ./cmd/eks-gateway-publish && CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -o bin/eks-gateway-fetch ./cmd/eks-gateway-fetch && CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -o bin/eks-webhook-cert ./cmd/eks-webhook-cert && CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -o bin/eks-konnectivity-cert ./cmd/eks-konnectivity-cert && CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -o bin/ecr-credential-provider ./cmd/ecr-credential-provider && rm -rf /tmp/anp-build && git clone --depth 1 --branch v0.30.3 https://github.com/kubernetes-sigs/apiserver-network-proxy /tmp/anp-build && ( cd /tmp/anp-build && CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -o /tmp/anp-build/konnectivity-server ./cmd/server ) && cp /tmp/anp-build/konnectivity-server bin/konnectivity-server && rm -rf /tmp/anp-build" INSTALL_BINARIES="bin/eks-token-webhook:/usr/local/bin/eks-token-webhook bin/eks-gateway-publish:/usr/local/bin/eks-gateway-publish bin/eks-gateway-fetch:/usr/local/bin/eks-gateway-fetch bin/eks-webhook-cert:/usr/local/bin/eks-webhook-cert bin/eks-konnectivity-cert:/usr/local/bin/eks-konnectivity-cert bin/konnectivity-server:/usr/local/bin/konnectivity-server bin/ecr-credential-provider:/usr/local/bin/ecr-credential-provider" # All role services ship; none but the selector are enabled at bake time. # eks-node-role picks server vs agent at first boot and enables the rest. INSTALL_FILES="\ scripts/images/eks-node/eks-node-role.initd:/etc/init.d/eks-node-role \ scripts/images/eks-node/eks-node-role.sh:/usr/local/sbin/eks-node-role \ scripts/images/eks-node/k3s.initd:/etc/init.d/k3s \ scripts/images/eks-node/k3s-prestart.sh:/usr/local/sbin/k3s-prestart \ scripts/images/eks-node/k3s-agent.initd:/etc/init.d/k3s-agent \ scripts/images/eks-node/k3s-agent-prestart.sh:/usr/local/sbin/k3s-agent-prestart \ scripts/images/eks-node/eks-token-webhook.initd:/etc/init.d/eks-token-webhook \ scripts/images/eks-node/k3s-first-boot.initd:/etc/init.d/k3s-first-boot \ scripts/images/eks-node/k3s-first-boot.sh:/usr/local/sbin/k3s-first-boot \ scripts/images/eks-node/mulga-eks-state-report.initd:/etc/init.d/mulga-eks-state-report \ scripts/images/eks-node/mulga-eks-state-report.sh:/usr/local/sbin/mulga-eks-state-report \ scripts/images/eks-node/mulga-eks-addon-sync.initd:/etc/init.d/mulga-eks-addon-sync \ scripts/images/eks-node/mulga-eks-addon-sync.sh:/usr/local/sbin/mulga-eks-addon-sync \ scripts/images/eks-node/konnectivity-server.initd:/etc/init.d/konnectivity-server \ scripts/images/eks-node/konnectivity-server-prestart.sh:/usr/local/sbin/konnectivity-server-prestart \ scripts/images/eks-node/konnectivity/konnectivity-agent.yaml:/usr/share/spinifex-eks/konnectivity/konnectivity-agent.yaml \ scripts/images/eks-node/mulga-ebs-byid.initd:/etc/init.d/mulga-ebs-byid \ scripts/images/eks-node/mulga-ebs-byid.sh:/usr/local/sbin/mulga-ebs-byid \ scripts/images/eks-node/mulga-eks-provider-id.initd:/etc/init.d/mulga-eks-provider-id \ scripts/images/eks-node/mulga-eks-provider-id.sh:/usr/local/sbin/mulga-eks-provider-id \ scripts/images/common/mulga-mgmt-net.initd:/etc/init.d/mulga-mgmt-net \ scripts/images/common/mulga-mgmt-net.sh:/usr/local/sbin/mulga-mgmt-net \ scripts/images/eks-node/mulga-vpc-mtu.initd:/etc/init.d/mulga-vpc-mtu \ scripts/images/eks-node/mulga-vpc-mtu.sh:/usr/local/sbin/mulga-vpc-mtu \ scripts/images/eks-node/mulga-eks-k3s-recovery.initd:/etc/init.d/mulga-eks-k3s-recovery \ scripts/images/eks-node/mulga-eks-k3s-recovery.sh:/usr/local/sbin/mulga-eks-k3s-recovery \ scripts/images/eks-node/addons/spinifex-noop/0.1.0/noop.yaml:/usr/share/spinifex-eks/addons/spinifex-noop/0.1.0/noop.yaml \ scripts/images/eks-node/addons/argocd/3.0.23/argocd.yaml:/usr/share/spinifex-eks/addons/argocd/3.0.23/argocd.yaml \ scripts/images/eks-node/addons/aws-load-balancer-controller/2.11.0/00-crds.yaml:/usr/share/spinifex-eks/addons/aws-load-balancer-controller/2.11.0/00-crds.yaml \ scripts/images/eks-node/addons/aws-load-balancer-controller/2.11.0/10-aws-load-balancer-controller.yaml:/usr/share/spinifex-eks/addons/aws-load-balancer-controller/2.11.0/10-aws-load-balancer-controller.yaml \ scripts/images/eks-node/addons/aws-load-balancer-controller/2.11.0/webhook.conf:/usr/share/spinifex-eks/addons/aws-load-balancer-controller/2.11.0/webhook.conf \ scripts/images/eks-node/addons/aws-ebs-csi-driver/1.40.1/00-rbac.yaml:/usr/share/spinifex-eks/addons/aws-ebs-csi-driver/1.40.1/00-rbac.yaml \ scripts/images/eks-node/addons/aws-ebs-csi-driver/1.40.1/10-controller.yaml:/usr/share/spinifex-eks/addons/aws-ebs-csi-driver/1.40.1/10-controller.yaml \ scripts/images/eks-node/addons/aws-ebs-csi-driver/1.40.1/20-node.yaml:/usr/share/spinifex-eks/addons/aws-ebs-csi-driver/1.40.1/20-node.yaml \ scripts/images/eks-node/addons/aws-ebs-csi-driver/1.40.1/30-storageclass.yaml:/usr/share/spinifex-eks/addons/aws-ebs-csi-driver/1.40.1/30-storageclass.yaml \ scripts/images/eks-node/addons/nvidia-device-plugin/0.17.4/10-daemonset.yaml:/usr/share/spinifex-eks/addons/nvidia-device-plugin/0.17.4/10-daemonset.yaml \ scripts/images/eks-node/coredns/coredns-mulga.yaml:/usr/share/spinifex-eks/coredns/coredns-mulga.yaml \ scripts/images/eks-node/rbac/eks-access-policy-bindings.yaml:/usr/share/spinifex-eks/rbac/eks-access-policy-bindings.yaml \ scripts/images/eks-node/cloud-init-ec2.cfg:/etc/cloud/cloud.cfg.d/90-spinifex-ec2-imds.cfg \ scripts/images/eks-node/mulga-eks-etcd-snapshot.sh:/etc/periodic/daily/mulga-eks-etcd-snapshot \ scripts/images/eks-node/mulga-eks-etcd-snapshot.sh:/etc/periodic/15min/mulga-eks-etcd-snapshot" # crond (etcd snapshot), the role selector, and the role-agnostic node services # (EBS by-id, provider-id) into the default runlevel at bake. mulga-mgmt-net is # NOT here: setup.sh adds it to the boot runlevel before cloud-init-local, since # it must DHCP the data NIC so the init-local Ec2 crawl reaches IMDS; a default # runlevel entry always runs after cloud-init-local (boot) and is too late. # cloud-init-ec2.cfg keeps a generous Ec2 max_wait as a safety net for host # br-imds datapath lag. The selector adds the role-specific services # (k3s/eks-token-webhook/k3s-first-boot/state-report or k3s-agent) to the # default runlevel on first boot. ENABLE_SERVICES="crond eks-node-role mulga-ebs-byid mulga-eks-provider-id mulga-vpc-mtu" SETUP_SCRIPT="scripts/images/eks-node/setup.sh" AMI_NAME="spinifex-eks-node" SYSTEM_TAG="spinifex:managed-by=eks"