aws-iam-authenticator for baremetal variant

[StefanTheWiz]

Hi!

I'm trying to use AWS EKS as the control plane with bottlerocket baremetal nodes.
I was wondering if there was a particular reason why aws-iam-authenticator is not included in baremetal variant?

Based on the README, I was kinda expecting that it would be included (for instance for using IAM Roles Anywhere).

To start, we're focusing on the use of Bottlerocket as a host OS in AWS EKS Kubernetes clusters and Amazon ECS clusters.

As an experiment, I've built a version of baremetal that has the aws-iam-authenticator (diff here).
However, the update process might remove the authenticator, which might mean maintaining our own TUF repo and that would be a tough sell.

[rpkelly]

Hi Stefan!

I believe we chose not to include aws-iam-authenticator on the baremetal variants for two main reasons. 1) We didn't want to assume that they would be used with EKS, and 2) since we weren't assuming EKS, we decided to save some space on the image size.

It is possible to use EKS without aws-iam-authenticator via the get-token api

[StefanTheWiz]

I believe we chose not to include aws-iam-authenticator on the baremetal variants for two main reasons. 1) We didn't want to assume that they would be used with EKS

Yes, not everyone might use BR with EKS. However, I couldn't find anything in the repo stating that bare metal doesn't support authentication-mode: "aws"?
If the intention is that the AWS authentication mode is supported across all variants, then the aws-iam-authenticator package should be included.

This is because the kubernetes package has this kubelet-kubeconfig for bootstrap, which doesn't safeguard from the aws-iam-authenticator being used on non-AWS variants (where the executable is missing).

So one option could be to class this as a bug, with the resolution of either:

• checking that variant == "aws" in the kubeconfig template; or
• including the aws-iam-authenticator package (I'm clearly favouring this option 😇)

---

2 ) since we weren't assuming EKS, we decided to save some space on the image size.

Looking at the aws-iam-authenticator releases page, the binaries are around 50MB in size, which seems pretty small given the whole OS takes about 5GB.

Furthermore, bare metal storage is generally cheap. For instance, Hetzner charges between €0.012-0.019 / GB / month. A 32GB SD card for Raspberry Pi is just £6, which works out at about €0.21/GB.

I can't speak for other BR users but, personally, I'm not very concerned about saving 50 MB storage.

---

It is possible to use EKS without aws-iam-authenticator via the get-token api

As far as I can tell, none of the variants come with AWS CLI installed? 🤔
I might be able to use a bootstrap container to get the EKS token and inject it in /etc/kubernetes/kubelet/kubeconfig but I'll wait, pending on the comments from (1) above.

[rpkelly]

I've created issue #2823 regarding the aws-iam-authenticator as well as opened an issue here regarding documentation.

I think I understand your use case better now. Adding the package may still require some more discussion though, and seems like a great topic for an upcoming community meeting.

It would also be great to get feedback from anyone else looking to use aws-iam-authenticator this way. Please add any comments to help understand the need better.

[StefanTheWiz]

Thanks @rpkelly. I'll join the community meeting tomorrow.