eks autoscaler and harbor registry with self signed certificate

Question

We have our eks kubernetes cluster and a ec2 instance with harbor registry. This registry has a self signed certificate, which needs to be in the worker nodes to be able to pull/push to this docker registry. The problem is that i have to autoscale my eks nodes depending on the load, but new scaled nodes must have the signed certificate to be able to contact the registry. Any ideas? Is it possible to make AMI image or are there other ways?

Answer 1

The above queries could be resolved in multiple ways. I will share the 2 of them here -

IF you are using EKS managed Nodegroup or custom nodegroup.

If you are using AWS Managed nodegroup.

a) On this case, please create an ami image of the node that has the registry script running, please ensure you have it running at bootup before you create the ami image.

b) Once you are done with the point in (a), please provision the AWS managed nodegroup to use the ami image that you created. If you are using terraform or any other infra provision tool, you can make the changes.

Custom Nodegroup - If you are using custom nodegroup

a) Create an ami image of that node.

# aws --profile $PROFILE --region $REGION ec2 create-image --instance-id ${INSTANCE_ID} --name ${INSTANCE_NAME}-image-at-${BUILD_TIMESTAMP} --description 'Snapshot of ${INSTANCE_NAME} taken at ${BUILD_TIMESTAMP}' --no-reboot --output text"

b) Create a new Launch configuration by running the following command:

# aws autoscaling create-launch-configuration --launch-configuration-name <${LAUNCH_TEMPLATE_NAME}> --image-id <${image-id}> --instance-id <${instance-id}>

c) Update the autoscaling group

# aws --profile <$PROFILE> --region <$REGION> autoscaling update-auto-scaling-group --auto-scaling-group-name <$ASG_NAME> --launch-configuration-name <LAUNCH_TEMPLATE_NAME>"

Incase of custom managed nodegroup, you can also set bootstrap parameters. unlike AWS Managed nodegroup. as I write today, till date, there is no way to bootstrap argument to the managed nondegroup. it may come on the later phase but we dont have that options as of now in the time of this writing.