aws: launch and customize a new instance with remote Ignition file from a S3 bucket

[HuijingHei]

Xerf to coreos/fedora-coreos-tracker#1769

[travier]

Let's add here the command to do that as well

[HuijingHei]

Add an URL here about how to create an IAM profile, WDYT?

[deby1122]

t

[HuijingHei]

@travier @prestist could you help to review again as I made some changes, thanks!

[c4rt0]

@HuijingHei I tried multiple times to go through this without success.
I am able to create roles & profiles I am just constantly getting stuck at Job ignition-fetch.service/start "running" forever.

I noticed that creating an ignition with --pretty results with:

Ignition has failed. Please ensure your config is valid.

the ignition file I used for this:

{"ignition":{"config":{"replace":{"source":"arn:aws:s3:::apiaseck-inf/bootstrap.ign"}},"version":"3.4.0"}}

I also tried:

{"ignition":{"config":{"replace":{"source":"s3://apiaseck-inf/bootstrap.ign"}},"version":"3.4.0"}}

The above was correct as per created bucket through commands provided.

adamsky@fedorapc Work/aws » NAME='apiaseck-inf'                                                                                                                                                                                           
adamsky@fedorapc Work/aws » aws s3 mb s3://$NAME --region us-east-2 

At this stage I can only present the last result of my failed attempt:

[   26.335382] NetworkManager[758]: <info>  [1729886778.9297] manager: NetworkManager state is now CONNECTED_GLOBAL
[   26.392925] NetworkManager[758]: <info>  [1729886778.9304] manager: startup complete
[   26.427019] systemd[1]: Starting ignition-fetch.service - Ignition (fetch)...
[   26.461496] systemd[1]: Starting nm-wait-online-initrd.service...
[   26.489977] (ignition)[773]: ignition-fetch.service: Referenced but unset environment variable evaluates to an empty string: IGNITION_ARGS
[   26.550563] systemd[1]: Finished nm-wait-online-initrd.service.
[   26.578781] systemd[1]: Starting dracut-initqueue.service - dracut initqueue hook...
[   26.616773] systemd[1]: Finished dracut-initqueue.service - dracut initqueue hook.
[   26.652396] systemd[1]: Reached target remote-fs-pre.target - Preparation for Remote File Systems.
[   26.701118] systemd[1]: Reached target remote-cryptsetup.target - Remote Encrypted Volumes.
[   26.737374] systemd[1]: Reached target remote-fs.target - Remote File Systems.
[   26.770933] systemd[1]: coreos-livepxe-rootfs.service - Acquire Live PXE rootfs Image was skipped because of an unmet condition check (ConditionPathExists=/run/ostree-live).
[   26.845810] systemd[1]: coreos-livepxe-persist-osmet.service - Persist Osmet Files (PXE) was skipped because of an unmet condition check (ConditionPathExists=/run/ostree-live).
[   26.922726] systemd[1]: Starting dracut-pre-mount.service - dracut pre-mount hook...
[   26.957961] systemd[1]: Finished dracut-pre-mount.service - dracut pre-mount hook.
[***   ] Job ignition-fetch.service/start running (6min 42s / no limit)

I will come back to this next week (I might need a reminder ;) )

[HuijingHei]

Thanks @c4rt0 for the testing. Let me clarify the two configs:

• The uploaded file bootstrap.ign is the real configuration and provisions the system based on that configuration, for example:

{"ignition":{"version":"3.4.0"},"passwd":{"users":[{"name":"core","sshAuthorizedKeys":["ssh-rsa xxx "]}]}}

• And --user-data config will retrieve the remote Ignition file from a s3 bucket, like what you used above:

{"ignition":{"config":{"replace":{"source":"s3://apiaseck-inf/bootstrap.ign"}},"version":"3.4.0"}}

It might be failed if using the wrong configurations.

[c4rt0]

I can confirm that I successfully created the aws instance, and after following the steps in this updated tutorial I was able to access it!

Log:

[  OK  ] Started [email protected] - Serial Getty on ttyS0.
[  OK  ] Reached target getty.target - Login Prompts.
[  OK  ] Reached target multi-user.target - Multi-User System.
         Starting systemd-update-utmp-runle…- Record Runlevel Change in UTMP...
         Starting zincati.service - Zincati Update Agent...
[  OK  ] Finished systemd-update-utmp-runle…e - Record Runlevel Change in UTMP.
         Starting polkit.service - Authorization Manager...
[  OK  ] Started polkit.service - Authorization Manager.
[  OK  ] Started zincati.service - Zincati Update Agent.

Fedora CoreOS 41.20241109.1.0
Kernel 6.11.6-300.fc41.x86_64 on an x86_64 (ttyS0)

SSH host key: SHA256:ZQFFYYHoK4oHAEDyPyDMZ0w7w6J7hnl/r50J03xMveI (ECDSA)
SSH host key: SHA256:VAwns02+Uc9cZrK/ofp4Gl7yzSwkALlo25tw+l0qd1c (ED25519)
SSH host key: SHA256:8MXRyrlRKmaYww+gzq7Anga7emIternDucBWDoJLGZM (RSA)
ens5: 10.0.13.169 fe80::79c8:6a4a:f0c:c11c
Ignition: ran on 2024/11/14 16:31:08 UTC (at least 2 boots ago)
Ignition: user-provided config was applied
Afterburn: wrote ssh authorized keys file for user: core
ip-10-0-13-169 login: core (automatic login)

Last login: Thu Nov 14 16:31:49 on ttyS0
Fedora CoreOS 41.20241109.1.0
[core@ip-10-0-13-169 ~]$

Thanks @HuijingHei !

/lgtm

[HuijingHei]

Awesome! Thanks @c4rt0 very much for the testing!