AWS eks documentation change
Summary
Updated documentation with deprecation notice for AL2 AMIs, added prerequisites, quickstart guide, and examples for building custom AMIs including STIG-compliant configurations with FIPS and KMS
Security assessment
Added documentation for STIG-compliant AMI with FIPS (security standard) and KMS encryption, but no evidence of addressing a specific vulnerability
Diff
diff --git a/eks/latest/userguide/eks-ami-build-scripts.md b/eks/latest/userguide/eks-ami-build-scripts.md index 074651182..0eb835c7f 100644 --- a//eks/latest/userguide/eks-ami-build-scripts.md +++ b//eks/latest/userguide/eks-ami-build-scripts.md @@ -4,0 +5,2 @@ +PrerequisitesQuickstart + @@ -9 +11,59 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -# Build a custom Amazon Linux AMI with a script +# Build a custom Amazon Linux AMI + +###### Important + +Amazon EKS will no longer publish EKS-optimized Amazon Linux 2 (AL2) AMIs after November 26th, 2025. Additionally, Kubernetes version `1.32` is the last version for which Amazon EKS will release AL2 AMIs. From version `1.33` onwards, Amazon EKS will continue to release AL2023 and Bottlerocket based AMIs. + +The Amazon EKS optimized Amazon Linux (AL) AMIs are built on top of AL2 and AL2023, specifically for use as nodes in Amazon EKS clusters. Amazon EKS provides open-source build scripts in the [Amazon EKS AMI Build Specification](https://github.com/awslabs/amazon-eks-ami) repository that you can use in the following ways: * View the configurations for `kubelet`, the runtime, and the AWS IAM Authenticator for Kubernetes. * Build your own AL-based AMI from scratch. + +This repository contains the specialized [bootstrap script](https://github.com/awslabs/amazon-eks-ami/blob/main/templates/al2/runtime/bootstrap.sh) and [nodeadm script](https://awslabs.github.io/amazon-eks-ami/nodeadm/) that runs at boot time. These scripts configure your instance’s certificate data, control plane endpoint, cluster name, and more. The scripts are considered the source of truth for Amazon EKS optimized AMI builds, so you can follow the GitHub repository to monitor changes to our AMIs. + +## Prerequisites + + * [Install the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) + + * [Install HashiCorp Packer v1.9.4+](https://developer.hashicorp.com/packer/downloads) + + * [Install GNU Make](https://www.gnu.org/software/make/) + + + + +## Quickstart + +This section shows you the commands to create a custom AMI in your AWS account. To learn more about the configurations available to customize your AMI, see the template variables on the [Amazon Linux 2023](https://awslabs.github.io/amazon-eks-ami/usage/al2023/) page. + +### Step 1. Setup your environment + +Clone or fork the official Amazon EKS AMI repository. For example: + + + git clone https://github.com/awslabs/amazon-eks-ami.git + cd amazon-eks-ami + +Verify that Packer is installed: + + + packer --version + +### Step 2. Create a custom AMI + +The following are example commands for various custom AMIs. + +**Basic NVIDIA AL2 AMI:** + + + make k8s=1.31 os_distro=al2 \ + enable_accelerator=nvidia \ + nvidia_driver_major_version=560 \ + enable_efa=true + +**Basic NVIDIA AL2023 AMI:** + + + make k8s=1.31 os_distro=al2023 \ + enable_accelerator=nvidia \ + nvidia_driver_major_version=560 \ + enable_efa=true + +**STIG-Compliant Neuron AL2023 AMI:** @@ -11 +70,0 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -Amazon Elastic Kubernetes Service (Amazon EKS) has open-source scripts that are used to build the Amazon EKS optimized AMI. These build scripts are available [on GitHub](https://github.com/awslabs/amazon-eks-ami). @@ -13 +72,5 @@ Amazon Elastic Kubernetes Service (Amazon EKS) has open-source scripts that are -The Amazon EKS optimized Amazon Linux AMIs are built on top of Amazon Linux 2 (AL2) and Amazon Linux 2023 (AL2023), specifically for use as a node in Amazon EKS clusters. You can use this repository to view the specifics of how the Amazon EKS team configures `kubelet`, the runtime, the AWS IAM Authenticator for Kubernetes, and build your own Amazon Linux based AMI from scratch. + make k8s=1.31 os_distro=al2023 \ + enable_accelerator=neuron \ + enable_fips=true \ + source_ami_id=ami-0abcd1234efgh5678 \ + kms_key_id=alias/aws-stig @@ -15 +78 @@ The Amazon EKS optimized Amazon Linux AMIs are built on top of Amazon Linux 2 (A -The build scripts repository includes a [HashiCorp packer](https://www.packer.io/) template and build scripts to generate an AMI. These scripts are the source of truth for Amazon EKS optimized AMI builds, so you can follow the GitHub repository to monitor changes to our AMIs. For example, perhaps you want your own AMI to use the same version of Docker that the Amazon EKS team uses for the official AMI. +After you run these commands, Packer will do the following: * Launch a temporary Amazon EC2 instance. * Install Kubernetes components, drivers, and configurations. * Create the AMI in your AWS account. @@ -17 +80 @@ The build scripts repository includes a [HashiCorp packer](https://www.packer.io -The GitHub repository also contains the specialized [bootstrap script](https://github.com/awslabs/amazon-eks-ami/blob/main/templates/al2/runtime/bootstrap.sh) and [nodeadm script](https://awslabs.github.io/amazon-eks-ami/nodeadm/) that runs at boot time to configure your instance’s certificate data, control plane endpoint, cluster name, and more. +### Step 3. View default values @@ -19 +82 @@ The GitHub repository also contains the specialized [bootstrap script](https://g -Additionally, the GitHub repository contains our Amazon EKS node AWS CloudFormation templates. These templates make it easier to spin up an instance running an Amazon EKS optimized AMI and register it with a cluster. +To view default values and additional options, run the following command: @@ -21 +83,0 @@ Additionally, the GitHub repository contains our Amazon EKS node AWS CloudFormat -For more information, see the repositories on GitHub at [https://github.com/awslabs/amazon-eks-ami](https://github.com/awslabs/amazon-eks-ami). @@ -23 +85 @@ For more information, see the repositories on GitHub at [https://github.com/awsl -Amazon EKS optimized AL2 contains an optional bootstrap flag to enable the `containerd` runtime. + make help