AWS Air-gapped AMI

To create an Image using Konvoy Image Builder (KIB) for use in an air-gapped cluster, follow these instructions. AMI images contain configuration information and software to create a specific, pre-configured, operating environment. For example, you can create an AMI image of your current computer system settings and software. The AMI image can then be replicated and distributed, creating your computer system for other users. You can use overrides files to customize some of the components installed on your machine image. For example, you could tell KIB to install the FIPS versions of the Kubernetes components.

Prerequisites

Minimal IAM Permissions for KIB to create an Image for an AWS account using Konvoy Image Builder.

In previous DKP releases, AMI images provided by the upstream CAPA project would be used if you did not specify an AMI. However, the upstream images are not recommended for production and may not always be available. Therefore, DKP now requires you to specify an AMI when creating a cluster. To create an AMI, use Konvoy Image Builder.

Using KIB, you can build an AMI without requiring access to the internet by providing an additional --override flag.

Assuming you have downloaded dkp-air-gapped-bundle_v2.7.2_linux_amd64.tar.gz , extract the tarball to a local directory:
CODE
```
tar -xzvf dkp-air-gapped-bundle_v2.7.2_linux_amd64.tar.gz && cd dkp-v2.7.2/kib
```
Follow the instructions below to build an AMI.

Depending on which version of DKP you are running, steps and flags will be different. To deploy in a region where CAPI images are not provided, you need to use KIB to create your own image for the region. For a list of supported AWS regions, refer to the Published AMI information from AWS.

Execute the following to begin image creation:

Run the konvoy-image command to build and validate the image. Ensure you have named the correct AMI image YAML file for your OS in the konvoy-image build command.

CODE

konvoy-image build aws images/ami/centos-79.yaml --overrides overrides/offline.yaml

By default it builds in the us-west-2 region. To specify another region set the --region flag as shown in the example command below:

CODE

konvoy-image build aws --region us-east-1 images/ami/centos-79.yaml --overrides overrides/offline.yaml

Instructions for customizing an override file are found on this page: Image Overrides

After KIB provisions the image successfully, the ami id is printed and written to the packer.pkr.hcl (Packer config) file. This file has an amazon-ebs.kib_image field whose value provides the name of the AMI ID as shown in the example below. That is the ami you use in the dkp create cluster command:

CODE

...
    amazon-ebs.kib_image: Adding tag: "distribution_version": "8.6"
    amazon-ebs.kib_image: Adding tag: "gpu_nvidia_version": ""
    amazon-ebs.kib_image: Adding tag: "kubernetes_cni_version": ""
    amazon-ebs.kib_image: Adding tag: "build_timestamp": "20231023182049"
    amazon-ebs.kib_image: Adding tag: "gpu_types": ""
    amazon-ebs.kib_image: Adding tag: "kubernetes_version": "1.26.6"
==> amazon-ebs.kib_image: Creating snapshot tags
    amazon-ebs.kib_image: Adding tag: "ami_name": "konvoy-ami-rhel-8.6-1.26.6-20231023182049"
==> amazon-ebs.kib_image: Terminating the source AWS instance...
==> amazon-ebs.kib_image: Cleaning up any extra volumes...
==> amazon-ebs.kib_image: No volumes to clean up, skipping
==> amazon-ebs.kib_image: Deleting temporary security group...
==> amazon-ebs.kib_image: Deleting temporary keypair...
==> amazon-ebs.kib_image: Running post-processor:  (type manifest)
Build 'amazon-ebs.kib_image' finished after 26 minutes 52 seconds.

==> Wait completed after 26 minutes 52 seconds

==> Builds finished. The artifacts of successful builds are:
--> amazon-ebs.kib_image: AMIs were created:
us-west-2: ami-04b8dfef8bd33a016

--> amazon-ebs.kib_image: AMIs were created:
us-west-2: ami-04b8dfef8bd33a016

Explore the Customize your Image topic for more options.

After you complete these steps, you can Air-gapped Seed the Registry .

If using AWS ECR as your local private registry, more information can be found on the Registry Mirror Tools page.