aws / aws/eks-anywhere

EKS-A bare metal: Enable Bottlerocket-OS Serial console support for debugging failures such as sshd and kubelet

Open
#5,389 2 comments 0 reactions 0 assignees View on GitHub
area/os/bottlerocket external
Dominant language
Go
Stars
2.1k
Forks
328
Avg merge
1d 4h
Merged PRs (30d)
9

Description

**What would you like to be added**: Support for enabling serial console access for Bottlerocket-OS in EKS-A bare metal nodes as described at https://github.com/bottlerocket-os/bottlerocket-admin-container/pull/59

**Why is this needed**: Sometimes ssh in Bottlerocket-OS admin container fails to start along with other components such as Kubelet. When this happens, It is impossible to log in to Bottlerocket node and debug the issue.

Rather than injecting just the ssh authorized keys, if a user and password-hash is also injected in [settings.host-containers.admin], then as per https://github.com/bottlerocket-os/bottlerocket-admin-container/pull/59, serial console access will be enabled for admin container.

For instance :
{
"user": "bottlerocket",
"password-hash": "$y$j9T$j8llSdt8G1NdKghiJ6bHH.$jJKF5di/C59vqebsA.y35DHyXpLetY.jFnPQ.YBFvUA",
"ssh": {
"authorized-keys": ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCr/bRBFgLj5l7JiX/0H0uqLUa50x14iWXGKxrqjzPy5UYP9mIqLS4udxf5uvTpB5QsWp9Xn0r3gch0es8QVSG8g0aEHjRhxMD3sW/KhpU4fvCMXLa/ccVQA7OvvYmaoc4aKQXk/kksNQE68+UaVd/gClMq4TMlDH0KlJUADZ3+ZduBKTjKYcme24QD7wHEMipFLuA+NZ0DeMgBlU9zqVI5RX9PW+jheKzII+LZywDlSocNIxoWvgTUJAil1GUlqzWngLZiMBd1xfuJ9BahwlridMOtpbGnamHbZbfE7KKY+eiazfpTERO/T9SYJE/c2U468mO1eggRQjdw0GfcxMgy1ppcL0R80qkxtWxkFaWWxLx1Rh0BO1f+VuRuJiTdOdymmttCqBnCGmsSjIf8zmDr+r1Xmgs3W1KevIyCgezCLhdGPXFkXRAD2VDW1Qo26BDqmhv39M2CPXXil0ifMsdd0T4nIiguaAF4vzYPmmcajCyWNLqaZv4TqBFSwKN6+YE="]
}
}

Contributor guide

Open the contributing guide

Research direction

No repository files or tests are named. Start by tracing how bare-metal Bottlerocket settings.host-containers.admin is configured, then read the linked Bottlerocket admin-container change. Done means the requested user and password-hash configuration enables serial-console access for debugging when SSH or kubelet fails, with repository tests covering the resulting configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
infrastructure, operating-systems
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.