Extend packer configuration steps for FIPS builds
What does this MR do and why?
The process to build a FIPS image seems outdated. Trying the make command without installing the amazon packer plugin will return:
Error: Failed to initialize build "amazon-ebs"
So we need to install the plugin first. Then, attempting the make command, will start the build process, but eventually will fail with:
amazon-ebs: Loaded plugins: priorities, update-motd, versionlock
amazon-ebs: Adding versionlock on: 0:containerd-1.4.6-8.amzn2
amazon-ebs: versionlock added: 1
amazon-ebs: Loaded plugins: priorities, update-motd, versionlock
amazon-ebs: Resolving Dependencies
amazon-ebs: --> Running transaction check
amazon-ebs: ---> Package docker.x86_64 0:20.10.7-5.amzn2 will be installed
amazon-ebs: --> Processing Dependency: libcgroup >= 0.40.rc1-5.15 for package: docker-20.10.7-5.amzn2.x86_64
amazon-ebs: --> Processing Dependency: pigz for package: docker-20.10.7-5.amzn2.x86_64
amazon-ebs: --> Running transaction check
amazon-ebs: ---> Package libcgroup.x86_64 0:0.41-21.amzn2 will be installed
amazon-ebs: ---> Package pigz.x86_64 0:2.3.4-1.amzn2.0.1 will be installed
amazon-ebs: --> Processing Conflict: libseccomp-2.5.2-1.amzn2.0.1.x86_64 conflicts docker < 20.10.25
amazon-ebs: --> Finished Dependency Resolution
amazon-ebs: Error: libseccomp conflicts with docker-20.10.7-5.amzn2.x86_64
Although it appears that FIPS building was merged to the default branch as part of: https://github.com/awslabs/amazon-eks-ami/pull/1458
So now we don't need to checkout the working branch anymore, and the new process is to specify enable_fips=true to the make command. Additionally, the upstream docs recommend that we detect the latest binaries with the hack/latest-binaries.sh script, and use slightly different command arguments to build:
hack/latest-binaries.sh 1.30
kubernetes_version=1.30.8 kubernetes_build_date=2025-01-10
make k8s \
kubernetes_version=1.30.8 \
kubernetes_build_date=2025-01-10 \
arch=x86_64 \
enable_fips=true
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
How to set up and validate locally
Try to run the steps we have currently documented with a fresh packer installation without the plugin installed, to validate you see the errors described above.
Then go back to the master branch and attempt the new proposed commands.