Configuring and running Amazon EKS Anywhere on Snowball Edge devices

Perform initial setup

1. Download and install the Snowball Edge client. For more information, see Downloading and installing the Snowball Edge Client.

2. Connect the device to your local network. For more information, see Connecting a Snowball Edge to your local network.

3. Get credentials to unlock your device. For more information, see Getting credentials to access a Snowball Edge.

4. Unlock the device. For more information, see Unlocking the Snowball Edge. You can also use a script tool instead of unlocking devices manually. See Unlock devices.

To create a policy document and attach it to the Amazon EKS Anywhere local user

1. Create a policy document and save it to your computer. Copy the policy below to the document.

   
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "snowballdevice:DescribeDevice",
           "snowballdevice:CreateDirectNetworkInterface",
           "snowballdevice:DeleteDirectNetworkInterface",
           "snowballdevice:DescribeDirectNetworkInterfaces",
           "snowballdevice:DescribeDeviceSoftware"
         ],
         "Resource": ["*"]
       },
       {
         "Effect": "Allow",
         "Action": [
           "ec2:RunInstances",
           "ec2:DescribeInstances",
           "ec2:TerminateInstances",
           "ec2:ImportKeyPair",
           "ec2:DescribeKeyPairs",
           "ec2:DescribeInstanceTypes",
           "ec2:DescribeImages",
           "ec2:DeleteTags"
         ],
         "Resource": ["*"]
       }
     ]
   }
       

2. Use the create-policy command to create an IAM policy based on the policy document. The value of the --policy-document parameter should use the absolute path to the policy file. For example, file:///home/user/policy-name.json

   
   aws iam create-policy --policy-name policy-name --policy-document file:///home/user/policy-name.json --endpoint http://snowball-ip:6078 --profile profile-name
   {
       "Policy": {
           "PolicyName": "policy-name",
           "PolicyId": "ANPACEMGEZDGNBVGY3TQOJQGEZAAAABP76TE5MKAAAABCCOTR2IJ43NBTJRZBU",
           "Arn": "arn:aws:iam::123456789012:policy/policy-name",
           "Path": "/",
           "DefaultVersionId": "v1",
           "AttachmentCount": 0,
           "IsAttachable": true,
           "CreateDate": "2022-04-06T04:46:56.907000+00:00",
           "UpdateDate": "2022-04-06T04:46:56.907000+00:00"
       }
   }     
       

3. Use the attach-user-policy command to attach the IAM policy to the Amazon EKS Anywhere local user.

   
   aws iam attach-user-policy --policy-arn policy-arn --user-name user-name --endpoint http://snowball-ip:6078 --profile profile-name     
       

1. Use the create-access-key command to create an access key for the Amazon EKS Anywhere local user.

   
   aws iam create-access-key --user-name user-name --endpoint http://snowball-ip:6078 --profile profile-name
       {
           "AccessKey": {
               "UserName": "eks-a-user",
               "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
               "Status": "Active",
               "SecretAccessKey": "RTT/wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
               "CreateDate": "2022-04-06T04:23:46.139000+00:00"
           }
       }
     

2. Create a credential file. In it, save the AccessKeyId and SecretAccessKey values in the following format.

   
   [snowball-ip] 
   aws_access_key_id = ABCDEFGHIJKLMNOPQR2T
   aws_secret_access_key = AfSD7sYz/TBZtzkReBl6PuuISzJ2WtNkeePw+nNzJ
   region = snow            
             

   Note

   If you're working with multiple Snowball Edge devices, the order of the credentials in the file doesn’t matter, but the credentials for all devices do need to be in one file.

To create a certificates file

1. Use the list-certificates command to get certificates for each Snowball Edge device that you plan to use.

   
   PATH_TO_Snowball_Edge_CLIENT/bin/snowballEdge list-certificates --endpoint https://snowball-ip --manifest-file path-to-manifest-file --unlock-code unlock-code
   {
     "Certificates" : [ {
       "CertificateArn" : "arn:aws:snowball-device:::certificate/xxx",
       "SubjectAlternativeNames" : [ "ID:JID-xxx" ]
     } ]
   }
               

2. Use the value of CertificateArn as the value for the --certificate-arn parameter of the get-certificate command.

   
   PATH_TO_Snowball_Edge_CLIENT/bin/snowballEdge get-certificate --certificate-arn ARN --endpoint https://snowball-ip --manifest-file path-to-manifest-file --unlock-code unlock-code            
             

3. Create a device certificate file. Put the output of get-certificate into the certificate file. Following is an example of how to save the output.

   Note

   If you're working with multiple Snowball Edge devices, the order of the credentials in the file doesn’t matter, but the credentials for all devices do need to be in one file.

   
   -----BEGIN CERTIFICATE-----
   ZWtzYSBzbm93IHRlc3QgY2VydGlmaWNhdGUgZWtzYSBzbm93IHRlc3QgY2VydGlm  
   aWNhdGVla3NhIHNub3cgdGVzdCBjZXJ0aWZpY2F0ZWVrc2Egc25vdyB0ZXN0IGNl  
   cnRpZmljYXRlZWtzYSBzbm93IHRlc3QgY2VydGlmaWNhdGVla3NhIHNub3cgdGVz  
   dCBjZXJ0aWZpY2F0ZQMIIDXDCCAkSgAwIBAgIJAISM0nTVmbj+MA0GCSqGSIb3DQ  
   ...                                                               
   -----END CERTIFICATE----- 
               

4. Repeat Create an Amazon EKS Anywhere IAM local user to create an IAM local user for Amazon EKS Anywhere on all Snowball Edge devices.

Create an SSH key and import it to the Amazon EKS Anywhere instance

1. Use the ssh-keygen command to generate a SSH key.

   
   ssh-keygen -t rsa -C "key-name" -f path-to-key-file
        

2. Use the import-key-pair command to import the key from your computer to the Snowball Edge device.

   Note

   The value of the key-name parameter must be the same when you import the key to all devices.

   
   aws ec2 import-key-pair --key-name key-name --public-key-material fileb:///path/to/key-file --endpoint http://snowball-ip:8008 --profile profile-name 
   {
       "KeyFingerprint": "5b:0c:fd:e1:a0:69:05:4c:aa:43:f3:3b:3e:04:7f:51",
       "KeyName": "default",
       "KeyPairId": "s.key-85edb5d820c92a6f8"
   }
        

To run an Amazon EKS Anywhere admin instance

1. Use the create-key-pair command to create a SSH key for the Amazon EKS Anywhere admin instance. The command saves the key to $PWD/key-file-name.

   
   aws ec2 create-key-pair --key-name key-name --query 'KeyMaterial' --output text --endpoint http://snowball ip:8008 --profile profile-name > key-file-name

2. Use the describe-images command to find the image name that begins with eks-anywhere-admin from the output.

   
   aws ec2 describe-images --endpoint http://snowball-ip:8008 --profile profile-name
         

3. Use the run-instance command to start an eks-a admin instance with the Amazon EKS Anywhere admin image.

   
   aws ec2 run-instances --image-id eks-a-admin-image-id --key-name key-name --instance-type sbe-c.xlarge --endpoint http://snowball-ip:8008 --profile profile-name
         

4. Use the describe-instances command to check the status of the Amazon EKS Anywhere instance. Wait until the command indicates the instances state is running before continuing.

   
   aws ec2 describe-instances --instance-id instance-id --endpoint http://snowball-ip:8008 --profile profile-name
   

5. From the output of the describe-device command, note the value of PhysicalNetworkInterfaceId for the physical network interface that is connected to your network. You will use this to create a VNI.

    
   PATH_TO_Snowball_Edge_CLIENT/bin/snowballEdge describe-device --endpoint https://snowball-ip --manifest-file path-to-manifest-file --unlock-code unlock-code
   

6. Create a VNI for the Amazon EKS Anywhere admin instance. Use the value of PhysicalNetworkInterfaceId as the value of the physical-network-interface-id parameter.

   
   PATH_TO_Snowball_Edge_CLIENT/bin/snowballEdge create-virtual-network-interface --ip-address-assignment dhcp --physical-network-interface-id PNI --endpoint https://snowball-ip --manifest-file path-to-manifest-file --unlock-code unlock-code
   

7. Use the value of IpAddress as the value of the public-ip parameter of the associate-address command to associate the public address to the Amazon EKS Anywhere admin instance.

   
   aws ec2 associate-address --instance-id instance-id --public-ip VNI-IP --endpoint http://snowball-ip:8008 --profile profile-name 
   

8. Connect to the Amazon EKS Anywhere admin instance by SSH.

   
   ssh -i path-to-key ec2-user@VNI-IP