fix(aws/ami): QPE AMI 빌드 및 최초 부팅 경로 복구 - #145
Open
jk-kim0 wants to merge 11 commits into
Open
Conversation
The supported Amazon plugin needs an explicit Spot price to propagate the selected instance type, while Spot builds cannot request ENA attribute modification. Constraint: AMI builds must remain compatible with the Packer Amazon plugin version allowed by the template Rejected: Set instance_type alongside spot_instance_types | Packer forbids configuring both Confidence: high Scope-risk: narrow Directive: Preserve Spot Fleet input compatibility unless the minimum plugin version is raised and runtime-tested Tested: 11 Bats tests; Packer validation for x86_64 and arm64; bash -n; ShellCheck; git diff --check Not-tested: Live QPE AMI build and boot verification pending Co-Authored-By: Atlas <atlas@jk.agent>
EC2 Fleet did not associate a public address even in a default public subnet, leaving the external Packer SSH communicator without a route to the builder. Constraint: Packer provisions builders from outside the QPE VPC over temporary SSH access Rejected: Broaden the security group CIDR | CloudTrail showed the allowed source IP was already correct Confidence: high Scope-risk: narrow Directive: Keep explicit public address association unless provisioning moves to a private network path Tested: 12 Bats tests; Packer validation for x86_64 and arm64; bash -n; ShellCheck; git diff --check; CloudTrail RunInstances network response Not-tested: Live QPE AMI build and boot verification pending Co-Authored-By: Atlas <atlas@jk.agent>
Spot Fleet selected a private subnet without an Internet Gateway route, so builders remained unreachable even after receiving public addresses. Constraint: The QPE default VPC contains both public default subnets and private non-default subnets Rejected: Rely on public IP association alone | A public address does not provide reachability without an Internet Gateway route Confidence: high Scope-risk: narrow Directive: Keep remote Packer builders constrained to default public subnets unless SSH moves to a private path Tested: 13 Bats tests; Packer validation for x86_64 and arm64; bash -n; ShellCheck; git diff --check; QPE route-table inspection Not-tested: Live QPE AMI build and boot verification pending Co-Authored-By: Atlas <atlas@jk.agent>
The execution environment blocks direct outbound TCP/22, so public subnet routing and narrow security-group rules cannot make the Packer SSH communicator reachable. Constraint: AMI provisioning must work without opening inbound SSH from a changing external NAT Rejected: Broaden temporary SSH ingress | Direct outbound TCP/22 is blocked and broader ingress would not restore connectivity Confidence: high Scope-risk: moderate Directive: Keep Session Manager tooling and the ec2-session-manager profile available for AMI builds Tested: 14 Bats tests; Packer validation for x86_64 and arm64; session-manager-plugin 1.2.835.0; bash -n; ShellCheck; git diff --check Not-tested: Live QPE Session Manager canary and AMI boot verification pending Co-Authored-By: Atlas <atlas@jk.agent>
Runtime verification has the same blocked direct-SSH path as image builds, so it must use the authenticated SSM tunnel and public SSM egress as well. Constraint: Built AMIs require live boot verification from an environment without outbound TCP/22 Rejected: Leave verification on direct SSH | It would make successful image builds unverifiable in the current execution environment Confidence: high Scope-risk: moderate Directive: Keep build and verification communicator paths aligned Tested: 15 Bats tests; Packer validation for both build and verify templates on x86_64 and arm64; bash -n; ShellCheck; git diff --check Not-tested: Live QPE AMI boot verification pending Co-Authored-By: Atlas <atlas@jk.agent>
Session Manager keeps the SSH child root-owned, so an unprivileged killall cannot disconnect Packer after adding ec2-user to the docker group. Constraint: Packer must reconnect so the next provisioner sees the docker group membership Rejected: Kill every sshd process as root | That would also terminate the listener and broaden disruption Confidence: high Scope-risk: narrow Directive: Disconnect only SSH sessions belonging to the provisioning user Tested: 16 Bats tests; Packer validation for build and verify templates on x86_64 and arm64; bash -n; ShellCheck; git diff --check Not-tested: Live QPE build after targeted disconnect pending Co-Authored-By: Atlas <atlas@jk.agent>
The long-lived SSM SSH transport retains the pre-install supplementary groups, so the QueryPie installer must enter the docker group explicitly after Docker is installed. Constraint: The Packer Session Manager transport may preserve an SSH login across provisioners Rejected: Depend on reconnect side effects | The targeted disconnect did not refresh supplementary groups reliably Confidence: high Scope-risk: narrow Directive: Keep Docker-dependent provisioning explicit about its group context Tested: 17 Bats tests; Packer validation for build and verify templates on x86_64 and arm64; bash -n; ShellCheck; git diff --check Not-tested: Live QPE partial installation after group-context change pending Co-Authored-By: Atlas <atlas@jk.agent>
Constraint: Amazon Linux 2023 cloud-init rejects the documented --machine-id option. Rejected: Leaving the source machine ID intact | cloned instances must receive unique identities. Confidence: high Scope-risk: narrow Directive: Preserve cloud-init cleanup and systemd first-boot identity semantics together. Tested: 18 Bats tests, four Packer validations, bash -n, ShellCheck, git diff --check Not-tested: Live QPE image build will be rerun after this commit. Co-Authored-By: Atlas <atlas@jk.agent>
Constraint: QueryPie first boot runs as a systemd root service, outside the build user home. Rejected: Invoking the standalone docker-compose binary | the installer consistently uses the Docker CLI plugin interface. Confidence: high Scope-risk: narrow Directive: Keep Compose available both per-user during builds and system-wide after cloning. Tested: 19 Bats tests, four Packer validations, bash -n, ShellCheck, git diff --check Not-tested: Live QPE first-boot verification will be rerun after this commit. Co-Authored-By: Atlas <atlas@jk.agent>
Constraint: ap-northeast-2d temporarily had no t4g.xlarge Spot capacity while other compatible pools remained usable. Rejected: Pinning builds to one currently available AZ | that would move rather than remove the capacity dependency. Confidence: high Scope-risk: narrow Directive: Keep arm64 fallback types at 16 GiB memory and compatible with the source architecture. Tested: 20 Bats tests, four Packer validations, bash -n, ShellCheck, git diff --check Not-tested: Live QPE arm64 build will be rerun after this commit. Co-Authored-By: Atlas <atlas@jk.agent>
Constraint: QueryPie publishes 40000-40030 inside the Linux ephemeral range, allowing first-boot service collisions with existing outbound connections. Rejected: Retrying failed container startup | future customer boots would remain nondeterministic. Confidence: high Scope-risk: narrow Directive: Apply the reservation through sysctl.d before networking-intensive provisioning and first boot. Tested: 21 Bats tests, four Packer validations, bash -n, ShellCheck, git diff --check Not-tested: Final QPE images will be rebuilt and boot-verified after this commit. Co-Authored-By: Atlas <atlas@jk.agent>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 87399052a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| region = var.region | ||
| ssh_username = local.ssh_username | ||
| ssh_interface = "session_manager" |
There was a problem hiding this comment.
When a workstation or CI runner has Packer and the AWS CLI but not the separately installed session-manager-plugin, this new communicator mode cannot establish its SSH tunnel; however, both ami-build.sh::validate_environment and ami-verify.sh::validate_environment still accept that environment and the README lists only Packer and AWS as required commands. This causes builds and verification to fail only after Packer begins creating AWS resources, so the plugin should be documented and checked during preflight.
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
요약
검증
142605707876,ap-northeast-2에서 아래 AMI 실제 빌드 및 first-boot/readyz 검증 통과ami-081f63436086b6485ami-0aeb8c53df9653724ami-03671442cb05ebe09ami-046d152ad5a5b2969