AWS Air-gapped FIPS: Create an Image

To create an Image using Konvoy Image Builder (KIB) for use in an air-gapped cluster, follow these instructions. AMI images contain configuration information and software to create a specific, pre-configured, operating environment. For example, you can create an AMI image of your current computer system settings and software. The AMI image can then be replicated and distributed, creating your computer system for other users. You can use overrides files to customize some of the components installed on your machine image. For example, you could tell KIB to install the FIPS versions of the Kubernetes components.

Prerequisites

Minimal IAM Permissions for KIB to create an Image for an AWS account using Konvoy Image Builder.

In previous DKP releases, AMI images provided by the upstream CAPA project would be used if you did not specify an AMI. However, the upstream images are not recommended for production and may not always be available. Therefore, DKP now requires you to specify an AMI when creating a cluster. To create an AMI, use Konvoy Image Builder.

Using KIB, you can build an AMI without requiring access to the internet by providing an additional --override flag.

Assuming you have downloaded dkp-air-gapped-bundle_v2.7.2_linux_amd64.tar.gz , extract the tarball to a local directory:
CODE
```
tar -xzvf dkp-air-gapped-bundle_v2.7.2_linux_amd64.tar.gz && cd dkp-v2.7.2/kib
```
Follow the instructions below to build an AMI.

Offline FIPS Override File (Air-gapped)

Add the following FIPS offline override file to your environment:

--overrides overrides/offline-fips.yaml

CODE

# fips os-packages
os_packages_local_bundle_file: "{{ playbook_dir }}/../artifacts/{{ kubernetes_version }}_{{ ansible_distribution|lower }}_{{ ansible_distribution_major_version }}_x86_64_fips.tar.gz"
containerd_local_bundle_file: "{{ playbook_dir }}/../artifacts/{{ containerd_tar_file }}"
pip_packages_local_bundle_file: "{{ playbook_dir }}/../artifacts/pip-packages.tar.gz"
images_local_bundle_dir: "{{ playbook_dir}}/../artifacts/images"

You can find all available Overrides files in the Konvoy Image Builder repo.

An air-gapped example of override file use is the command below which produces an AWS FIPS-compliant image on RHEL 8.4:

CODE

konvoy-image build --overrides overrides/offline-fips.yaml images/ami/rhel-84.yaml

Next Step:

AWS Air-gapped FIPS: Load the Registry