mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-19 19:01:42 +00:00
Julian Sommer
42 lines
2.0 KiB
Plaintext
42 lines
2.0 KiB
Plaintext
IMAGE_NAME="ecs-agent"
|
|
IMAGE_DESCRIPTION="Spinifex ECS container instance — Alpine + containerd + runc + cni-plugins + ecs-agent"
|
|
DISTRO="alpine"
|
|
ALPINE_VERSION="3.21.7"
|
|
|
|
# 4G root: containerd content store (pulled task images) lives under
|
|
# /var/lib/containerd on the root disk. Instances can attach a larger root EBS at
|
|
# RunInstances; this is the baked floor.
|
|
IMAGE_SIZE="4G"
|
|
|
|
# containerd-openrc ships the OpenRC service for containerd (the containerd apk
|
|
# itself has no init script). cni-plugins + the baked bridge conflist ready the
|
|
# image for task networking. curl is used by the first-boot CA hook and
|
|
# IMDS probes. iproute2 supplies the full `ip` (busybox lacks `ip netns`) the
|
|
# agent uses to build awsvpc task netns; udhcpc is busybox built-in. iptables is
|
|
# the credential endpoint's DNAT rule (cmd/ecs-agent/credendpoint.go) fronting
|
|
# task-role credentials at 169.254.170.2:80 — Alpine splits iptables/ip6tables
|
|
# into separate apks (unlike Ubuntu's combined package) and only iptables is
|
|
# needed, since the endpoint is IPv4-only.
|
|
APK_PACKAGES="containerd containerd-openrc runc cni-plugins ca-certificates curl openrc iproute2 iptables"
|
|
|
|
# ecs-agent is the only built binary (static, FIPS boot like the host build).
|
|
BUILD_COMMANDS="CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -ldflags \"-s -w\" -o bin/ecs-agent ./cmd/ecs-agent"
|
|
|
|
INSTALL_BINARIES="bin/ecs-agent:/usr/local/bin/ecs-agent"
|
|
|
|
INSTALL_FILES="\
|
|
scripts/images/ecs-agent/ecs-agent.initd:/etc/init.d/ecs-agent \
|
|
scripts/images/ecs-agent/ecs-ca-install.initd:/etc/init.d/ecs-ca-install \
|
|
scripts/images/ecs-agent/10-bridge.conflist:/etc/cni/net.d/10-bridge.conflist"
|
|
|
|
# ecs-ca-install (first boot) installs the cloud-init gateway CA into the system
|
|
# trust before containerd starts; containerd then trusts the ECR registry TLS.
|
|
# ecs-agent registers + heartbeats + polls the AWS gateway (TLS+SigV4, no NATS)
|
|
# once net + containerd are up.
|
|
ENABLE_SERVICES="containerd ecs-ca-install ecs-agent"
|
|
|
|
SETUP_SCRIPT="scripts/images/ecs-agent/setup.sh"
|
|
|
|
AMI_NAME="spinifex-ecs-node"
|
|
SYSTEM_TAG="spinifex:managed-by=ecs"
|