Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove sudo from bootstrap commands #1773

Merged
merged 3 commits into from
May 31, 2024
Merged

Conversation

zhuoweilee
Copy link
Contributor

Issue #, if available:

Description of changes:

sudo commands are removed from the bootstrap script.

This helps to resolve the issue outlined in this article which describes a permission issue with sudo commands in cloud_init scripts that results in a timeout when SELinux is enabled. This leads to extended bootstrap times (+25 sec per sudo). Before this pull request, customers that enable SELinux would have to either add an SELinux policy module or remove sudo commands from the bootstrap script to prevent timeout.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@cartermckinnon
Copy link
Member

cartermckinnon commented Apr 26, 2024

I think we should add an assertion to the start of the script that it's being run as `root, something like:

if [ "${EUID}" -ne 0 ]; then
  log "ERROR: must be run as root"
  exit 1
fi

@cartermckinnon
Copy link
Member

/ci
+workflow:os_distros al2

Copy link
Contributor

@cartermckinnon roger that! I've dispatched a workflow. 👍

Copy link
Contributor

@cartermckinnon the workflow that you requested has completed. 🎉

AMI variantBuildTest
1.21 / al2success ✅success ✅
1.22 / al2success ✅success ✅
1.23 / al2success ✅success ✅
1.24 / al2success ✅success ✅
1.25 / al2success ✅success ✅
1.26 / al2success ✅success ✅
1.27 / al2success ✅success ✅
1.28 / al2success ✅success ✅
1.29 / al2success ✅success ✅
1.30 / al2failure ❌skipped ⏭️

@cartermckinnon
Copy link
Member

cartermckinnon commented Apr 30, 2024

This LGTM, I'm getting another set of eyes on it.

EC2 docs also suggest not using sudo in userdata:

Scripts entered as user data are run as the root user, so do not use the sudo command in the script.

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html

@cartermckinnon cartermckinnon merged commit 75747c2 into awslabs:main May 31, 2024
10 checks passed
atmosx pushed a commit to gathertown/amazon-eks-ami that referenced this pull request Jun 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants