Amazon EKS Hybrid Nodes を Amazon EC2 で簡単に試してみよう

$ ssh [email protected]
...
ubuntu@ip-10-116-0-10:~$ 

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "eks:DescribeCluster"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ssm:DescribeInstanceInformation",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ssm:DeregisterManagedInstance",
            "Resource": "arn:aws:ssm:AWS_REGION:AWS_ACCOUNT_ID:managed-instance/*",
            "Condition": {
                "StringEquals": {
                    "ssm:resourceTag/TAG_KEY": "TAG_VALUE"
                }
            }
        }
    ]
}

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"",
         "Effect":"Allow",
         "Principal":{
            "Service":"ssm.amazonaws.com"
         },
         "Action":"sts:AssumeRole",
         "Condition":{
            "StringEquals":{
               "aws:SourceAccount":"AWS_ACCOUNT_ID"
            },
            "ArnEquals":{
               "aws:SourceArn":"arn:aws:ssm:AWS_REGION:AWS_ACCOUNT_ID:*"
            }
         }
      }
   ]
}

$ ssh [email protected]

ubuntu@ip-10-116-0-10:~$ curl -OL 'https://hybrid-assets.eks.amazonaws.com/releases/latest/bin/linux/amd64/nodeadm'
ubuntu@ip-10-116-0-10:~$ chmod +x nodeadm

ubuntu@ip-10-116-0-10:~$ sudo ./nodeadm install 1.31 --credential-provider ssm
{"level":"info","ts":1738219344.2963061,"caller":"install/install.go:95","msg":"Creating package manager..."}
{"level":"info","ts":1738219344.2963915,"caller":"install/install.go:104","msg":"Validating Kubernetes version","kubernetes version":"1.31"}
{"level":"info","ts":1738219344.366482,"caller":"install/install.go:110","msg":"Using Kubernetes version","kubernetes version":"1.31.4"}
{"level":"info","ts":1738219344.3665466,"caller":"flows/install.go:42","msg":"Configuring package manager. This might take a while..."}
{"level":"info","ts":1738219344.3665597,"caller":"flows/install.go:64","msg":"Installing containerd..."}
{"level":"info","ts":1738219349.5372758,"caller":"flows/install.go:69","msg":"Installing iptables..."}
{"level":"info","ts":1738219349.5373924,"caller":"flows/install.go:83","msg":"Installing SSM agent installer..."}
{"level":"info","ts":1738219352.9538224,"caller":"flows/install.go:94","msg":"Installing kubelet..."}
{"level":"info","ts":1738219353.7074184,"caller":"flows/install.go:99","msg":"Installing kubectl..."}
{"level":"info","ts":1738219354.4058442,"caller":"flows/install.go:104","msg":"Installing cni-plugins..."}
{"level":"info","ts":1738219355.5251875,"caller":"flows/install.go:109","msg":"Installing image credential provider..."}
{"level":"info","ts":1738219355.5736701,"caller":"flows/install.go:114","msg":"Installing IAM authenticator..."}
{"level":"info","ts":1738219356.2909362,"caller":"flows/install.go:59","msg":"Finishing up install..."}    

apiVersion: node.eks.aws/v1alpha1
kind: NodeConfig
spec:
  cluster:
    name: sandbox-hybrid-eks
    region: ap-northeast-1
  hybrid:
    ssm:
      activationCode: ACTIVATION_CODE
      activationId: ACTIVATION_ID

ubuntu@ip-10-116-0-10:~$ sudo ./nodeadm init -c file://nodeConfig.yaml

❯ kubectl get nodes
NAME                   STATUS     ROLES    AGE     VERSION
i-03e64e460d7b1e59e    Ready      <none>   3h21m   v1.31.3-eks-7636447
i-079e38f6f3d535092    Ready      <none>   3h21m   v1.31.3-eks-7636447
mi-021e8e7ae37d70b95   NotReady   <none>   14s     v1.31.4-eks-aeac579

affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
        - key: eks.amazonaws.com/compute-type
          operator: In
          values:
          - hybrid # オンプレミスのノードのみで実行する
envoy:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: eks.amazonaws.com/compute-type
            operator: In
            values:
            - hybrid # オンプレミスのノードのみで実行する
ipam:
  mode: cluster-pool
  operator:
    clusterPoolIPv4MaskSize: 28
    clusterPoolIPv4PodCIDRList:
    - 10.116.128.0/17 # 前の手順で設定した Pod CIDR
operator:
  replicas: 1
  unmanagedPodWatcher:
    restart: false

$ helm repo add cilium https://helm.cilium.io/
$ helm install cilium cilium/cilium \
    --version 1.16.6 \
    --namespace kube-system \
    --values cilium-values.yaml
NAME: cilium
LAST DEPLOYED: Thu Jan 30 16:36:22 2025
NAMESPACE: kube-system
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
You have successfully installed Cilium with Hubble.

Your release version is 1.16.6.

❯ kubectl get nodes
NAME                   STATUS   ROLES    AGE     VERSION
i-03e64e460d7b1e59e    Ready    <none>   4h17m   v1.31.3-eks-7636447
i-079e38f6f3d535092    Ready    <none>   4h17m   v1.31.3-eks-7636447
mi-021e8e7ae37d70b95   Ready    <none>   56m     v1.31.4-eks-aeac579

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-ex
spec:
  selector:
    matchLabels:
      app: web-ex
  replicas: 2
  template:
    metadata:
      labels:
        app: web-ex
    spec:
      containers:
      - name: nginx
        image: public.ecr.aws/nginx/nginx:1.27-alpine
        ports:
        - containerPort: 80
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: eks.amazonaws.com/compute-type
                operator: In
                values:
                - hybrid
---
apiVersion: v1
kind: Service
metadata:
  name: web-ex
spec:
  selector:
    app: web-ex
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80

$ kubectl apply -f workload.yaml
$ kubectl get pods
NAME                      READY   STATUS    RESTARTS   AGE
web-ex-55f796f547-wwzj2   1/1     Running   0          15s
web-ex-55f796f547-xdhsc   1/1     Running   0          10s

$ kubectl port-forward service/web-ex 8080:80