AWS Air-gapped FIPS: Create an Image

Create an Image using Konvoy Image Builder (KIB) for use in an air-gapped cluster

Prerequisites

• Before you begin, you must:

  • Check the DKP Supported Kubernetes Versions.

  • Check the Supported Infrastructure Operating Systems

  • Download the KIB bundle for your version of DKP prefixed with konvoy-image-bundle for your OS.

  • Create a working Docker or other registry setup.

  • Ensure you have met the minimal set of permissions from the AWS Image Builder Book.

  • A Minimal IAM Permissions for KIB to create an Image for an AWS account using Konvoy Image Builder.

The default AWS image is not recommended for use in production. We suggest using Konvoy Image Builder to create an AWS Air-gapped AMI to take advantage of enhanced cluster operations. Explore the KIB with AWS topics for more options.

Using KIB, you can build an AMI without requiring access to the internet by providing an additional --override flag.

1. Assuming you have downloaded dkp-air-gapped-bundle_v2.5.2_linux_amd64.tar.gz , extract the tarball to a local directory:

   CODE

   tar -xzvf dkp-air-gapped-bundle_v2.5.2_linux_amd64.tar.gz && cd dkp-v2.5.2/kib

2. Follow the instructions below to build an AMI.

Create FIPS 140 Images: Air-gapped Environment

KIB can produce images containing FIPS-140 compliant binaries. Use the fips.yaml override file provided with the image bundles.

You can also find these override files in the Konvoy Image Builder repo.

• An air-gapped example of override file use is the command below which produces an AWS FIPS-compliant image on RHEL 8.4:

konvoy-image build --overrides overrides/offline-fips.yaml images/ami/rhel-84.yaml

Next Step:

AWS Air-gapped FIPS: Load the Registry