Skip to main content
Skip table of contents

AWS FIPS: Create an Image

Learn how to build a custom AMI for use with DKP

This procedure describes how to use the Konvoy Image Builder (KIB) to create a Cluster API compliant Amazon Machine Image (AMI). KIB uses variable overrides to specify base image and container images to use in your new AMI.

In previous DKP releases, AMI images provided by the upstream CAPA project would be used if you did not specify an AMI. However, the upstream images are not recommended for production and may not always be available.   Therefore, DKP now requires you to specify an AMI when creating a cluster. To create an AMI, use Konvoy Image Builder.

Prerequisites

Before you begin, you must:

Extract KIB Bundle

Extract the bundle and cd into the extracted konvoy-image-bundle-$VERSION folder. The bundled version of konvoy-image contains an embedded docker image that contains all the requirements for building.

The konvoy-image binary and all supporting folders are also extracted. When run, konvoy-image bind mounts the current working directory (${PWD}) into the container to be used.

  • Set environment variables for AWS access. The following variables must be set using your credentials including required IAM:

    CODE
    export AWS_ACCESS_KEY_ID
    export AWS_SECRET_ACCESS_KEY
    export AWS_DEFAULT_REGION
  • If you have an override file to configure specific attributes of your AMI file, add it.

Non-air-gapped Environment Create FIPS-140 images

KIB can produce images containing FIPS-140 compliant binaries. Use the fips.yaml override file provided with the image bundles.

You can also find these override files in the Konvoy Image Builder repo.

  • A non-air-gapped example of override file use is the command below, which produces a FIPS-compliant image on RHEL 8.4 for AWS:
    Replace ami with your infrastructure provisioner

CODE
konvoy-image build --overrides overrides/fips.yaml images/ami/rhel-84.yaml

Next Step:

AWS FIPS: Create the Management Cluster

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.