mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-19 19:01:42 +00:00
Josh Siviour
24bd50a53c
Adds the spinifex-ecs-node AMI variant: alpine 3.21.7 + containerd + runc + cni-plugins + ca-certificates with the ecs-agent binary baked to /usr/local/bin and three OpenRC services wired in dependency order (ecs-ca-install -> containerd -> ecs-agent). - manifest.conf drives build-system-image.sh (no host mounts). - ecs-ca-install.initd: first-boot oneshot installing the cloud-init delivered gateway CA into the system trust; no-op when absent. - ecs-agent.initd: sources /etc/spinifex-ecs/agent.env, backgrounds the agent after net + containerd. - 10-bridge.conflist: CNI bridge for task networking (Sprint 4d). - setup.sh: exec bits, /opt/cni/bin symlink, content-store dirs, ttyS0 console reorder + fast boot menu. - Makefile: build-ecs-node-image / import-ecs-node-image targets.
34 lines
1.1 KiB
Plaintext
34 lines
1.1 KiB
Plaintext
#!/sbin/openrc-run
|
|
# ecs-ca-install — first-boot oneshot that installs the cloud-init-delivered
|
|
# gateway CA into the system trust store, so containerd trusts the internal ECR
|
|
# registry's TLS when pulling task images. Ordered before containerd + ecs-agent.
|
|
#
|
|
# The CA is delivered per-instance (not baked) at /etc/spinifex-ecs/gateway-ca.pem
|
|
# by cloud-init user-data, mirroring how EKS delivers EKS_GATEWAY_CA. No-op when
|
|
# the file is absent — containerd then relies on the stock system trust.
|
|
|
|
description="Install Spinifex gateway CA into the system trust (first boot)"
|
|
|
|
GATEWAY_CA="/etc/spinifex-ecs/gateway-ca.pem"
|
|
TRUST_DST="/usr/local/share/ca-certificates/spinifex-gateway.crt"
|
|
|
|
depend() {
|
|
before containerd ecs-agent
|
|
after localmount
|
|
}
|
|
|
|
start() {
|
|
if [ ! -f "${GATEWAY_CA}" ]; then
|
|
einfo "no gateway CA at ${GATEWAY_CA}; using stock system trust"
|
|
return 0
|
|
fi
|
|
ebegin "Installing gateway CA into system trust"
|
|
install -D -m 0644 "${GATEWAY_CA}" "${TRUST_DST}"
|
|
update-ca-certificates >/dev/null 2>&1
|
|
eend $?
|
|
}
|
|
|
|
stop() {
|
|
return 0
|
|
}
|