-
Notifications
You must be signed in to change notification settings - Fork 4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(eks): bundle kubectl, helm and awscli instead of SAR app
Bundle the AWS Lambda layer zip bundle as part of the EKS module and upload as an asset to the destination account in order to remove the dependency on the [aws-lambda-layer-kubectl](https://github.com/aws-samples/aws-lambda-layer-kubectl) SAR app. The dependency on the SAR app introduces an operational and maintenance risk, and increases deploy time due to an additional nested stack introduced by SAR. This also ensures that the EKS module can be deployed to any environment, regardless of whether the SAR app is avaialble in that location. This change increases the module size by ~40MiB. Fixes #11874
- Loading branch information
Elad Ben-Israel
committed
Dec 17, 2020
1 parent
d10ea63
commit 5a7bfbd
Showing
14 changed files
with
203 additions
and
217 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -17,4 +17,5 @@ nyc.config.js | |
| .nycrc | ||
| !.eslintrc.js | ||
|
|
||
| junit.xml | ||
| junit.xml | ||
| lib/kubectl-layer.zip | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| build.sh | ||
| layer.zip |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| layer.zip |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| # base lambda image | ||
| FROM public.ecr.aws/lambda/provided:latest | ||
|
|
||
| # versions | ||
| ARG KUBECTL_VERSION=1.20.0 | ||
| ARG HELM_VERSION=3.4.2 | ||
| ARG AWSCLI_VERSION=1.18.198 | ||
|
|
||
| USER root | ||
| RUN mkdir -p /opt | ||
| WORKDIR /tmp | ||
|
|
||
| # install some tools | ||
| RUN yum update -y \ | ||
| && yum install -y zip unzip make wget tar gzip | ||
|
|
||
| # kubectl | ||
| RUN mkdir -p /opt/kubectl | ||
| RUN cd /opt/kubectl && curl -LO "https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl" | ||
| RUN chmod +x /opt/kubectl/kubectl | ||
|
|
||
| # helm | ||
| RUN mkdir -p /tmp/helm && wget -qO- https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz | tar -xvz -C /tmp/helm | ||
| RUN mkdir -p /opt/helm && cp /tmp/helm/linux-amd64/helm /opt/helm/helm | ||
|
|
||
| # aws cli (latest) | ||
| RUN curl https://s3.amazonaws.com/aws-cli/awscli-bundle-${AWSCLI_VERSION}.zip -o awscli-bundle.zip | ||
| RUN unzip awscli-bundle.zip | ||
| RUN ./awscli-bundle/install -i /tmp/awscli -b /tmp/awscli/aws | ||
| RUN cp -r /tmp/awscli/lib/python2.7/site-packages/ /opt/awscli/ | ||
| RUN cp -r /tmp/awscli/bin/ /opt/awscli/bin/ | ||
| RUN cp -r /tmp/awscli/bin/aws /opt/awscli/aws | ||
| RUN cp -r /usr/bin/make /opt/awscli/make | ||
| RUN rm -rf \ | ||
| /opt/awscli/pip* \ | ||
| /opt/awscli/setuptools* \ | ||
| /opt/awscli/awscli/examples | ||
|
|
||
| # jq | ||
| RUN wget https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 \ | ||
| && mv jq-linux64 /opt/awscli/jq \ | ||
| && chmod +x /opt/awscli/jq | ||
|
|
||
| # create the bundle | ||
| RUN cd /opt \ | ||
| && zip -r ../layer.zip * \ | ||
| && echo "/layer.zip is ready" \ | ||
| && ls -alh /layer.zip; | ||
|
|
||
| WORKDIR / |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| # kubectl-layer | ||
|
|
||
| Adopted from [aws-samples/aws-lambda-layer-kubectl](https://github.com/aws-samples/aws-lambda-layer-kubectl) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| #!/bin/bash | ||
| set -euo pipefail | ||
|
|
||
| cd $(dirname $0) | ||
|
|
||
| echo ">> Building kubectl AWS Lambda layer (inside a docker image)..." | ||
|
|
||
| TAG='aws-lambda-layer-kubectl' | ||
|
|
||
| docker build -t ${TAG} . | ||
|
|
||
| echo ">> Extrating layer.zip from the build container..." | ||
| CONTAINER=$(docker run -d ${TAG} false) | ||
| docker cp ${CONTAINER}:/layer.zip ../lib/kubectl-layer.zip | ||
|
|
||
| echo ">> Stopping container..." | ||
| docker rm -f ${CONTAINER} | ||
| echo ">> lib/kubectl-layer.zip is ready" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,90 +1,15 @@ | ||
| import * as crypto from 'crypto'; | ||
| import * as path from 'path'; | ||
| import * as lambda from '@aws-cdk/aws-lambda'; | ||
| import { CfnResource, Token, Stack, ResourceEnvironment } from '@aws-cdk/core'; | ||
| import { Construct } from 'constructs'; | ||
|
|
||
| const KUBECTL_APP_ARN = 'arn:aws:serverlessrepo:us-east-1:903779448426:applications/lambda-layer-kubectl'; | ||
| const KUBECTL_APP_CN_ARN = 'arn:aws-cn:serverlessrepo:cn-north-1:487369736442:applications/lambda-layer-kubectl'; | ||
| const KUBECTL_APP_VERSION = '2.0.0'; | ||
|
|
||
| // v2 - keep this import as a separate section to reduce merge conflict when forward merging with the v2 branch. | ||
| // eslint-disable-next-line | ||
| import { Construct as CoreConstruct } from '@aws-cdk/core'; | ||
|
|
||
| /** | ||
| * Properties for KubectlLayer. | ||
| */ | ||
| export interface KubectlLayerProps { | ||
| /** | ||
| * The semantic version of the kubectl AWS Lambda Layer SAR app to use. | ||
| * | ||
| * @default '2.0.0' | ||
| */ | ||
| readonly version?: string; | ||
|
|
||
| /** | ||
| * The Serverless Application Repository application ID which contains the kubectl layer. | ||
| * @default - The ARN for the `lambda-layer-kubectl` SAR app. | ||
| * @see https://github.com/aws-samples/aws-lambda-layer-kubectl | ||
| */ | ||
| readonly applicationId?: string; | ||
| } | ||
|
|
||
| /** | ||
| * An AWS Lambda layer that includes kubectl and the AWS CLI. | ||
| * | ||
| * @see https://github.com/aws-samples/aws-lambda-layer-kubectl | ||
| */ | ||
| export class KubectlLayer extends CoreConstruct implements lambda.ILayerVersion { | ||
| /** | ||
| * The ARN of the AWS Lambda layer version. | ||
| */ | ||
| public readonly layerVersionArn: string; | ||
|
|
||
| public readonly stack: Stack; | ||
| public readonly env: ResourceEnvironment; | ||
|
|
||
| /** | ||
| * All runtimes are compatible. | ||
| */ | ||
| public readonly compatibleRuntimes?: lambda.Runtime[] = undefined; | ||
|
|
||
| constructor(scope: Construct, id: string, props: KubectlLayerProps = {}) { | ||
| super(scope, id); | ||
|
|
||
| this.stack = Stack.of(this); | ||
| this.env = { | ||
| account: this.stack.account, | ||
| region: this.stack.region, | ||
| }; | ||
|
|
||
| const uniqueId = crypto.createHash('md5').update(this.node.path).digest('hex'); | ||
| const version = props.version ?? KUBECTL_APP_VERSION; | ||
| const applictionId = props.applicationId ?? (this.isChina() ? KUBECTL_APP_CN_ARN : KUBECTL_APP_ARN); | ||
|
|
||
| this.stack.templateOptions.transforms = ['AWS::Serverless-2016-10-31']; // required for AWS::Serverless | ||
| const resource = new CfnResource(this, 'Resource', { | ||
| type: 'AWS::Serverless::Application', | ||
| properties: { | ||
| Location: { | ||
| ApplicationId: applictionId, | ||
| SemanticVersion: version, | ||
| }, | ||
| Parameters: { | ||
| LayerName: `kubectl-${uniqueId}`, | ||
| }, | ||
| }, | ||
| export class KubectlLayer extends lambda.LayerVersion { | ||
| constructor(scope: Construct, id: string) { | ||
| super(scope, id, { | ||
| code: lambda.Code.fromAsset(path.join(__dirname, 'kubectl-layer.zip')), | ||
| description: 'Tools required for interacting with the EKS cluster (kubectl, helm and the AWS CLI)', | ||
| }); | ||
|
|
||
| this.layerVersionArn = Token.asString(resource.getAtt('Outputs.LayerVersionArn')); | ||
| } | ||
|
|
||
| public addPermission(_id: string, _permission: lambda.LayerVersionPermission): void { | ||
| return; | ||
| } | ||
|
|
||
| private isChina(): boolean { | ||
| const region = this.stack.region; | ||
| return !Token.isUnresolved(region) && region.startsWith('cn-'); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
5a7bfbdThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
awesome!