├── CODE_OF_CONDUCT.md ├── CONTRIBUTING.md ├── Dockerfile ├── LICENSE ├── README.md ├── configmap.yaml ├── daemonset.yaml ├── install.sh ├── runonce.sh ├── runonhost.sh ├── setup.yaml └── wait.sh /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | ## Code of Conduct 2 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 3 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 4 | opensource-codeofconduct@amazon.com with any additional questions or comments. 5 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing Guidelines 2 | 3 | Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional 4 | documentation, we greatly value feedback and contributions from our community. 5 | 6 | Please read through this document before submitting any issues or pull requests to ensure we have all the necessary 7 | information to effectively respond to your bug report or contribution. 8 | 9 | 10 | ## Reporting Bugs/Feature Requests 11 | 12 | We welcome you to use the GitHub issue tracker to report bugs or suggest features. 13 | 14 | When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already 15 | reported the issue. Please try to include as much information as you can. Details like these are incredibly useful: 16 | 17 | * A reproducible test case or series of steps 18 | * The version of our code being used 19 | * Any modifications you've made relevant to the bug 20 | * Anything unusual about your environment or deployment 21 | 22 | 23 | ## Contributing via Pull Requests 24 | Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that: 25 | 26 | 1. You are working against the latest source on the *main* branch. 27 | 2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already. 28 | 3. You open an issue to discuss any significant work - we would hate for your time to be wasted. 29 | 30 | To send us a pull request, please: 31 | 32 | 1. Fork the repository. 33 | 2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change. 34 | 3. Ensure local tests pass. 35 | 4. Commit to your fork using clear commit messages. 36 | 5. Send us a pull request, answering any default questions in the pull request interface. 37 | 6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation. 38 | 39 | GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and 40 | [creating a pull request](https://help.github.com/articles/creating-a-pull-request/). 41 | 42 | 43 | ## Finding contributions to work on 44 | Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start. 45 | 46 | 47 | ## Code of Conduct 48 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 49 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 50 | opensource-codeofconduct@amazon.com with any additional questions or comments. 51 | 52 | 53 | ## Security issue notifications 54 | If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue. 55 | 56 | 57 | ## Licensing 58 | 59 | See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution. 60 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM debian 2 | COPY runonhost.sh / 3 | COPY wait.sh / 4 | RUN chmod u+x runonhost.sh 5 | CMD ["./runonhost.sh"] -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | 3 | Permission is hereby granted, free of charge, to any person obtaining a copy of 4 | this software and associated documentation files (the "Software"), to deal in 5 | the Software without restriction, including without limitation the rights to 6 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 7 | the Software, and to permit persons to whom the Software is furnished to do so. 8 | 9 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 10 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 11 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 12 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 13 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 14 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 15 | 16 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # node-configuration-daemonset 2 | 3 | This project shows how you can install the SSM agent onto EKS worker nodes using a Kubernetes DaemonSet. This method for configuring the nodes can be used to customize workers in an EKS Managed Node Group (MNG) after they've been deployed, at least until launch templates are supported. This project was heavily inspired by Shekhar Patnaik's [AKS Node Installer Project](https://github.com/patnaikshekhar/AKSNodeInstaller). 4 | 5 | ## Installation instructions 6 | 1. Add the `AmazonSSMManagedInstanceCore` policy the the EC2 Instance Profile of the Managed Worker Nodes. 7 | 2. Apply the manifest: 8 | ``` 9 | kubectl apply -f setup.yaml 10 | ``` 11 | 12 | ## Updates 13 | - 11/5/2020 The daemonset has been updated. Instead of running indefinitely, the container that runs the scripts to install the SSM agent runs as an init container. Upon exiting a `pause` container runs. This has a considerably smaller attack surface than the init container. 14 | - 3/15/2020 Created `setup.yaml` to install the DaemonSet. The manifest adds a PSP, RBAC Role, and ServiceAccount for the init container. 15 | 16 | ## Verify installation 17 | You can verify that the installation was successful by looking at the logs of a DaemonSet pod. If the installation was successfull, the last line in the log file will read `Success` otherwise it will read `Fail`. The nodes will also appears as managed instances in the SSM console if the installation was successful. 18 | -------------------------------------------------------------------------------- /configmap.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ConfigMap 3 | metadata: 4 | name: ssm-installer-script 5 | data: 6 | install.sh: | 7 | #!/bin/bash 8 | # Update and install packages 9 | sudo yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm 10 | STATUS=$(sudo systemctl status amazon-ssm-agent) 11 | if echo $STATUS | grep -q "running"; then 12 | echo "Success" 13 | else 14 | echo "Fail" >&2 15 | fi -------------------------------------------------------------------------------- /daemonset.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: DaemonSet 3 | metadata: 4 | name: ssm-agent-installer 5 | spec: 6 | selector: 7 | matchLabels: 8 | job: ssm-agent-installer 9 | template: 10 | metadata: 11 | labels: 12 | job: ssm-agent-installer 13 | spec: 14 | hostPID: true 15 | restartPolicy: Always 16 | initContainers: 17 | - image: public.ecr.aws/q2t9z9u5/ssm-agent-installer:1.2 18 | name: ssm-agent-installer 19 | securityContext: 20 | privileged: true 21 | volumeMounts: 22 | - name: install-script 23 | mountPath: /tmp 24 | - name: host-mount 25 | mountPath: /host 26 | volumes: 27 | - name: install-script 28 | configMap: 29 | name: ssm-installer-script 30 | - name: host-mount 31 | hostPath: 32 | path: /tmp/install 33 | containers: 34 | - image: "gcr.io/google-containers/pause:2.0" 35 | name: pause 36 | securityContext: 37 | allowPrivilegeEscalation: false 38 | runAsUser: 1000 39 | readOnlyRootFilesystem: true 40 | -------------------------------------------------------------------------------- /install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | sudo yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm 4 | STATUS=$(sudo systemctl status amazon-ssm-agent) 5 | 6 | if echo $STATUS | grep -q "running"; then 7 | echo "Install succeeded" 8 | else 9 | echo "Install failed" >&2 10 | fi -------------------------------------------------------------------------------- /runonce.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # this has yet to be tested 4 | 5 | set -euo pipefail 6 | 7 | function main() { 8 | kubectl apply -f configmap.yaml 9 | kubectl apply -f daemonset.yaml 10 | 11 | local -r DAEMONSET_NAME="ssm-agent-installer" 12 | local -r PODS="$(kubectl get pods | grep -i "${DAEMONSET_NAME}" | awk '{print $1}')" 13 | 14 | wait_for_pods 15 | wait_for_success 16 | 17 | kubectl delete -f daemonset.yaml 18 | } 19 | 20 | function wait_for_pods() { 21 | echo -n "waiting for ${DAEMONSET_NAME} pods to run" 22 | 23 | for POD in ${PODS}; do 24 | while [[ "$(kubectl get pod "${POD}" -o go-template --template "{{.status.phase}}")" != "Running" ]]; do 25 | sleep 1 26 | echo -n "." 27 | done 28 | done 29 | 30 | echo 31 | } 32 | 33 | function wait_for_success() { 34 | echo -n "waiting for ${DAEMONSET_NAME} daemonset to complete" 35 | 36 | for POD in ${PODS}; do 37 | while [[ $(kubectl logs "${POD}" --tail 1) != "Success" ]]; do 38 | sleep 1 39 | echo -n "." 40 | done 41 | 42 | # at this point you could take the output of kubectl logs and do something with it 43 | done 44 | 45 | echo 46 | } 47 | 48 | main -------------------------------------------------------------------------------- /runonhost.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Inspired by https://medium.com/@patnaikshekhar/initialize-your-aks-nodes-with-daemonsets-679fa81fd20e 3 | 4 | # Copy installation script to host 5 | cp /tmp/install.sh /host 6 | 7 | # Copy wait script to the host 8 | cp /wait.sh /host 9 | 10 | # Wait for updates to complete 11 | /usr/bin/nsenter -m/proc/1/ns/mnt -- chmod u+x /tmp/install/wait.sh 12 | 13 | # Give execute priv to script 14 | /usr/bin/nsenter -m/proc/1/ns/mnt -- chmod u+x /tmp/install/install.sh 15 | 16 | # Wait for Node updates to complete 17 | /usr/bin/nsenter -m/proc/1/ns/mnt /tmp/install/wait.sh 18 | 19 | # If the /tmp folder is mounted on the host then it can run the script 20 | /usr/bin/nsenter -m/proc/1/ns/mnt /tmp/install/install.sh 21 | 22 | # Sleep 30 seconds, then exit 23 | echo "Waiting for 30 seconds..." 24 | sleep 30 25 | echo "Task Completed" -------------------------------------------------------------------------------- /setup.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: node-configuration-daemonset 5 | --- 6 | apiVersion: rbac.authorization.k8s.io/v1 7 | kind: ClusterRole 8 | metadata: 9 | name: ssm-agent-installer 10 | rules: 11 | - apiGroups: ['policy'] 12 | resources: ['podsecuritypolicies'] 13 | verbs: ['use'] 14 | resourceNames: 15 | - ssm-agent-installer 16 | --- 17 | apiVersion: v1 18 | kind: ServiceAccount 19 | metadata: 20 | name: ssm-agent-installer 21 | namespace: node-configuration-daemonset 22 | --- 23 | apiVersion: rbac.authorization.k8s.io/v1 24 | kind: RoleBinding 25 | metadata: 26 | name: ssm-agent-installer 27 | namespace: node-configuration-daemonset 28 | roleRef: 29 | kind: ClusterRole 30 | name: ssm-agent-installer 31 | apiGroup: rbac.authorization.k8s.io 32 | subjects: 33 | - kind: ServiceAccount 34 | name: ssm-agent-installer 35 | namespace: node-configuration-daemonset 36 | --- 37 | apiVersion: policy/v1beta1 38 | kind: PodSecurityPolicy 39 | metadata: 40 | name: ssm-agent-installer 41 | spec: 42 | privileged: true 43 | hostPID: true 44 | seLinux: 45 | rule: RunAsAny 46 | supplementalGroups: 47 | rule: RunAsAny 48 | runAsUser: 49 | rule: RunAsAny 50 | fsGroup: 51 | rule: RunAsAny 52 | --- 53 | apiVersion: v1 54 | kind: ConfigMap 55 | metadata: 56 | name: ssm-installer-script 57 | namespace: node-configuration-daemonset 58 | data: 59 | install.sh: | 60 | #!/bin/bash 61 | # Update and install packages 62 | sudo yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm 63 | STATUS=$(sudo systemctl status amazon-ssm-agent) 64 | if echo $STATUS | grep -q "running"; then 65 | echo "Success" 66 | else 67 | echo "Fail" >&2 68 | fi 69 | --- 70 | apiVersion: apps/v1 71 | kind: DaemonSet 72 | metadata: 73 | name: ssm-agent-installer 74 | namespace: node-configuration-daemonset 75 | spec: 76 | selector: 77 | matchLabels: 78 | job: ssm-agent-installer 79 | template: 80 | metadata: 81 | labels: 82 | job: ssm-agent-installer 83 | spec: 84 | hostPID: true 85 | restartPolicy: Always 86 | initContainers: 87 | - image: public.ecr.aws/q2t9z9u5/ssm-agent-installer:1.2 88 | name: ssm-agent-installer 89 | securityContext: 90 | privileged: true 91 | volumeMounts: 92 | - name: install-script 93 | mountPath: /tmp 94 | - name: host-mount 95 | mountPath: /host 96 | volumes: 97 | - name: install-script 98 | configMap: 99 | name: ssm-installer-script 100 | - name: host-mount 101 | hostPath: 102 | path: /tmp/install 103 | serviceAccount: ssm-agent-installer 104 | tolerations: 105 | - operator: Exists 106 | containers: 107 | - image: "gcr.io/google-containers/pause:2.0" 108 | name: pause 109 | securityContext: 110 | allowPrivilegeEscalation: false 111 | runAsUser: 1000 112 | readOnlyRootFilesystem: true 113 | -------------------------------------------------------------------------------- /wait.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | while sudo fuser /var/{lib/{dpkg,apt/lists},cache/apt/archives}/lock >/dev/null 2>&1; do sleep 1; done --------------------------------------------------------------------------------