feat: Upgrade EKS to 1.27

.github/workflows/module-test.yaml

@@ -28,7 +28,7 @@ jobs:
         tar zxf awsweeper_0.12.0_linux_amd64.tar.gz
         mv awsweeper_0.12.0_linux_amd64/awsweeper ${HOME}/.local/bin
 
-        wget -q https://github.com/eksctl-io/eksctl/releases/download/v0.150.0/eksctl_Linux_amd64.tar.gz
+        wget -q https://github.com/eksctl-io/eksctl/releases/download/v0.160.0/eksctl_Linux_amd64.tar.gz
         tar zxf eksctl_Linux_amd64.tar.gz
         mv eksctl ${HOME}/.local/bin
 

.github/workflows/test-cleanup.yaml

@@ -30,7 +30,7 @@ jobs:
         tar zxf awsweeper_0.12.0_linux_amd64.tar.gz
         mv awsweeper_0.12.0_linux_amd64/awsweeper ${HOME}/.local/bin
 
-        wget https://github.com/eksctl-io/eksctl/releases/download/v0.150.0/eksctl_Linux_amd64.tar.gz
+        wget https://github.com/eksctl-io/eksctl/releases/download/v0.160.0/eksctl_Linux_amd64.tar.gz
         tar zxf eksctl_Linux_amd64.tar.gz
         mv eksctl ${HOME}/.local/bin
 

.github/workflows/website-build.yaml

@@ -15,7 +15,7 @@ jobs:
         node-version: 16
     - uses: azure/setup-kubectl@v3
       with:
-        version: 'v1.23.9'
+        version: 'v1.27.7'
       id: install
     - name: Run website build
       working-directory: website

cluster/eksctl/cluster.yaml

@@ -9,7 +9,7 @@ availabilityZones:
 metadata:
   name: ${EKS_CLUSTER_NAME}
   region: ${AWS_REGION}
-  version: '1.25'
+  version: '1.27'
   tags:
     karpenter.sh/discovery: ${EKS_CLUSTER_NAME}
     created-by: eks-workshop-v2
@@ -26,7 +26,7 @@ vpc:
 
 addons:
 - name: vpc-cni
-  version: v1.12.5-eksbuild.2
+  version: '1.14.1'
   configurationValues: "{\"env\":{\"ENABLE_PREFIX_DELEGATION\":\"true\", \"ENABLE_POD_ENI\":\"true\", \"POD_SECURITY_GROUP_ENFORCING_MODE\":\"standard\"}}"
   resolveConflicts: overwrite
 
@@ -37,6 +37,6 @@ managedNodeGroups:
   maxSize: 6
   instanceType: m5.large
   privateNetworking: true
-  releaseVersion: 1.25.6-20230304
+  releaseVersion: 1.27.3-20230816
   labels:
     workshop-default: 'yes'

lab/bin/reset-environment

@@ -55,16 +55,16 @@ kubectl delete pod load-generator --ignore-not-found > /dev/null
 kubectl delete namespace other --ignore-not-found > /dev/null
 
 kubectl apply -k $base_path --prune --all \
-  --prune-whitelist=autoscaling/v1/HorizontalPodAutoscaler \
-  --prune-whitelist=core/v1/Service \
-  --prune-whitelist=core/v1/ConfigMap \
-  --prune-whitelist=apps/v1/Deployment \
-  --prune-whitelist=apps/v1/StatefulSet \
-  --prune-whitelist=core/v1/ServiceAccount \
-  --prune-whitelist=core/v1/Secret \
-  --prune-whitelist=core/v1/PersistentVolumeClaim \
-  --prune-whitelist=scheduling.k8s.io/v1/PriorityClass \
-  --prune-whitelist=networking.k8s.io/v1/Ingress > /dev/null
+  --prune-allowlist=autoscaling/v1/HorizontalPodAutoscaler \
+  --prune-allowlist=core/v1/Service \
+  --prune-allowlist=core/v1/ConfigMap \
+  --prune-allowlist=apps/v1/Deployment \
+  --prune-allowlist=apps/v1/StatefulSet \
+  --prune-allowlist=core/v1/ServiceAccount \
+  --prune-allowlist=core/v1/Secret \
+  --prune-allowlist=core/v1/PersistentVolumeClaim \
+  --prune-allowlist=scheduling.k8s.io/v1/PriorityClass \
+  --prune-allowlist=networking.k8s.io/v1/Ingress > /dev/null
 
 crossplane_crd=$(kubectl get crds | grep relationaldatabases.awsblueprints.io || [[ $? == 1 ]])
 

lab/scripts/installer.sh

@@ -2,17 +2,14 @@
 
 set -e
 
-kubectl_version='1.23.9'
-kubectl_checksum='053561f7c68c5a037a69c52234e3cf1f91798854527692acd67091d594b616ce'
+kubectl_version='1.27.7'
+kubectl_checksum='e5fe510ba6f421958358d3d43b3f0b04c2957d4bc3bb24cf541719af61a06d79'
 
 helm_version='3.10.1'
 helm_checksum='c12d2cd638f2d066fec123d0bd7f010f32c643afdf288d39a4610b1f9cb32af3'
 
-eksctl_version='0.144.0'
-eksctl_checksum='f91a12e7f72bce41a2529053d3a22351ba1fd9bb3517f9d1d1ee74dda1e43afc'
-
-kustomize_version='4.5.7'
-kustomize_checksum='701e3c4bfa14e4c520d481fdf7131f902531bfc002cb5062dcf31263a09c70c9'
+eksctl_version='0.160.0'
+eksctl_checksum='24fc2ea2295f1a0687271ecd6f9b66e6e674560617cced8f19ef5bbe92a1e4a2'
 
 kubeseal_version='0.18.4'
 kubeseal_checksum='2e765b87889bfcf06a6249cde8e28507e3b7be29851e4fac651853f7638f12f3'
@@ -62,13 +59,6 @@ chmod +x eksctl
 mv ./eksctl /usr/local/bin
 rm -rf eksctl_Linux_amd64.tar.gz
 
-# kustomize
-download_and_verify "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${kustomize_version}/kustomize_v${kustomize_version}_linux_amd64.tar.gz" "$kustomize_checksum" "kustomize.tar.gz"
-tar zxf kustomize.tar.gz
-chmod +x kustomize
-mv ./kustomize /usr/local/bin
-rm -rf kustomize.tar.gz
-
 # aws cli v2
 curl --location --show-error --silent "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
 unzip -o -q awscliv2.zip -d /tmp

manifests/.workshop/terraform/base.tf

@@ -77,19 +77,21 @@ locals {
     env        = var.eks_cluster_id
   }
 
-  eks_oidc_issuer_url  = replace(data.aws_eks_cluster.eks_cluster.identity[0].oidc[0].issuer, "https://", "")
-  eks_cluster_endpoint = data.aws_eks_cluster.eks_cluster.endpoint
-  eks_cluster_version  = data.aws_eks_cluster.eks_cluster.version
+  eks_cluster_id        = data.aws_eks_cluster.eks_cluster.id
+  eks_oidc_issuer_url   = replace(data.aws_eks_cluster.eks_cluster.identity[0].oidc[0].issuer, "https://", "")
+  eks_cluster_endpoint  = data.aws_eks_cluster.eks_cluster.endpoint
+  eks_cluster_version   = data.aws_eks_cluster.eks_cluster.version
+  eks_oidc_provider_arn = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${local.eks_oidc_issuer_url}"
 
   addon_context = {
     aws_caller_identity_account_id = data.aws_caller_identity.current.account_id
     aws_caller_identity_arn        = data.aws_caller_identity.current.arn
     aws_eks_cluster_endpoint       = local.eks_cluster_endpoint
     aws_partition_id               = data.aws_partition.current.partition
     aws_region_name                = data.aws_region.current.name
-    eks_cluster_id                 = data.aws_eks_cluster.eks_cluster.id
+    eks_cluster_id                 = local.eks_cluster_id
     eks_oidc_issuer_url            = local.eks_oidc_issuer_url
-    eks_oidc_provider_arn          = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${local.eks_oidc_issuer_url}"
+    eks_oidc_provider_arn          = local.eks_oidc_provider_arn
     tags                           = {}
     irsa_iam_role_path             = "/"
     irsa_iam_permissions_boundary  = ""

manifests/modules/aiml/inferentia/base/kustomization.yaml

@@ -1,25 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-configMapGenerator:
-- name: base-vars
-  namespace: aiml
-  env: config.properties
-  options:
-    disableNameSuffixHash: true
-replacements:
-- source:
-    kind: ConfigMap
-    name: base-vars
-    version: v1
-    namespace: aiml
-    fieldPath: data.AIML_NEURON_ROLE_ARN
-  targets:
-    - select:
-        kind: ServiceAccount
-        name: inference
-        namespace: aiml
-      fieldPaths:
-        - metadata.annotations.[eks.amazonaws.com/role-arn]
 resources:
 - serviceaccount.yaml
 - namespace.yaml

manifests/modules/aiml/inferentia/compiler/kustomization.yaml

@@ -1,26 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-bases:
-  - ../base
-configMapGenerator:
-- name: compiler-vars
-  namespace: aiml
-  env: config.properties
-  options:
-    disableNameSuffixHash: true
-replacements:
-- source:
-    kind: ConfigMap
-    name: compiler-vars
-    version: v1
-    namespace: aiml
-    fieldPath: data.AIML_DL_IMAGE
-  targets:
-    - select:
-        kind: Pod
-        name: compiler
-        namespace: aiml
-      fieldPaths:
-        - spec.containers.0.image
 resources:
+- ../base
 - compiler.yaml

manifests/modules/aiml/inferentia/inference/kustomization.yaml

@@ -1,26 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-bases:
-- ../base
-configMapGenerator:
-- name: inference-vars
-  namespace: aiml
-  env: config.properties
-  options:
-    disableNameSuffixHash: true
-replacements:
-- source:
-    kind: ConfigMap
-    name: inference-vars
-    version: v1
-    namespace: aiml
-    fieldPath: data.AIML_DL_IMAGE
-  targets:
-    - select:
-        kind: Pod
-        name: inference
-        namespace: aiml
-      fieldPaths:
-        - spec.containers.0.image
 resources:
+- ../base
 - inference.yaml

manifests/modules/aiml/inferentia/provisioner/kustomization.yaml

@@ -1,37 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-bases:
-- ../base
-configMapGenerator:
-- name: inference-vars
-  namespace: aiml
-  env: config.properties
-  options:
-    disableNameSuffixHash: true
-replacements:
-- source:
-    kind: ConfigMap
-    name: inference-vars
-    version: v1
-    namespace: aiml
-    fieldPath: data.EKS_CLUSTER_NAME
-  targets:
-  - select:
-      kind: AWSNodeTemplate
-      name: aiml
-    fieldPaths:
-    - spec.securityGroupSelector.[karpenter.sh/discovery]
-- source:
-    kind: ConfigMap
-    name: inference-vars
-    version: v1
-    namespace: aiml
-    fieldPath: data.AIML_SUBNETS
-  targets:
-  - select:
-      kind: AWSNodeTemplate
-      name: aiml
-    fieldPaths:
-    - spec.subnetSelector.aws-ids
 resources:
+- ../base
 - provisioner.yaml

manifests/modules/automation/controlplanes/ack/.workshop/terraform/addon.tf

@@ -57,7 +57,7 @@ EOF
 
 module "eks_blueprints_addons" {
   source = "aws-ia/eks-blueprints-addons/aws"
-  version = "~> 1.0"
+  version = "1.9.2"
 
   enable_aws_load_balancer_controller = true
   aws_load_balancer_controller = {