AWS Bootstrap Cluster

To create a bootstrap cluster in a proxied environment use the flags for HTTP:

  --http-proxy <string> \
  --https-proxy <string> \
  --no-proxy <string>

You need to add the custom CAs into two places:

• The capa-controller-manager pod, because CAPA controllers interact with AWS API when creating and deleting infrastructure.

• The trusted root CAs in the AWS AMI used as Kubernetes nodes. The first step of the node bootstrap process is to fetch the sensitive information from the AWS Secrets Manager service, so the aws client on the instances needs to trust this custom CA. This process is unique to your environment but a general flow can be similar to what is documented in adding trusted root certificates to the server.

1. Place the AWS CA file as ca.pem in your working directory

2. Create a ConfigMap with the contents of the file:

   CODE

   kubectl create configmap -n capa-system aws-ca --from-file=ca.pem

3. Update the capa-controller-manager to set an environment variable AWS_CA_BUNDLE in capa-controller-manager:

   CODE

   kubectl patch deployment -n capa-system capa-controller-manager --patch '{"spec":{"template":{"spec":{"$setElementOrder/containers":[{"name":"manager"},{"name":"kube-rbac-proxy"}],"$setElementOrder/volumes":[{"name":"cert"},{"name":"credentials"},{"name":"aws-ca"}],"containers":[{"$setElementOrder/env":[{"name":"AWS_SHARED_CREDENTIALS_FILE"},{"name":"AWS_CA_BUNDLE"}],"$setElementOrder/volumeMounts":[{"mountPath":"/tmp/k8s-webhook-server/serving-certs"},{"mountPath":"/home/.aws"},{"mountPath":"/home/.konvoy/aws-ca.pem"}],"env":[{"name":"AWS_CA_BUNDLE","value":"/home/.konvoy/aws-ca.pem"}],"name":"manager","volumeMounts":[{"mountPath":"/home/.konvoy/aws-ca.pem","name":"aws-ca","subPath":"ca.pem"}]}],"volumes":[{"configMap":{"name":"aws-ca"},"name":"aws-ca"}]}}}}'