Building Golden AMIs with Packer and Terraform for EKS Node Groups

1packer {
2  required_plugins {
3    amazon = {
4      version = ">= 1.2.0"
5      source  = "github.com/hashicorp/amazon"
6    }
7  }
8}
9
10variable "eks_version" {
11  type = string
12  default = "1.29"
13}
14
15variable "aws_region" {
16  type = string
17  default = "ap-south-1"
18}
19
20# Fetch the latest EKS-optimized AMI as our base
21data "amazon-ami" "eks_base" {
22  filters = {
23    name                = "amazon-eks-node-${var.eks_version}-*"
24    virtualization-type = "hvm"
25    architecture        = "x86_64"
26  }
27  owners = ["602401143452"]  # AWS EKS AMI account
28  most_recent = true
29  region = var.aws_region
30}
31
32source "amazon-ebs" "eks_node" {
33  ami_name = "eks-golden-${var.eks_version}-{{timestamp}}"
34  instance_type = "t3.medium"
35  region = var.aws_region
36  source_ami = data.amazon-ami.eks_base.id
37  ssh_username = "ec2-user"
38  
39  ami_description = "Golden AMI for EKS ${var.eks_version} nodes"
40  
41  tags = {
42    Name        = "eks-golden-${var.eks_version}"
43    EKSVersion  = var.eks_version
44    BuildTime   = "{{timestamp}}"
45    ManagedBy   = "Packer"
46  }
47}
48
49build {
50  sources = ["source.amazon-ebs.eks_node"]
51
52  # Update system packages
53  provisioner "shell" {
54    inline = [
55      "sudo yum update -y",
56      "sudo yum install -y aws-cli jq wget"
57    ]
58  }
59
60  # Install monitoring agents
61  provisioner "shell" {
62    script = "scripts/install-cloudwatch-agent.sh"
63  }
64
65  # Install security tools
66  provisioner "shell" {
67    script = "scripts/install-security-agents.sh"
68  }
69
70  # Pre-cache common container images
71  provisioner "shell" {
72    script = "scripts/cache-container-images.sh"
73  }
74
75  # Apply CIS hardening
76  provisioner "shell" {
77    script = "scripts/cis-hardening.sh"
78  }
79
80  # Cleanup
81  provisioner "shell" {
82    inline = [
83      "sudo yum clean all",
84      "sudo rm -rf /var/cache/yum",
85      "sudo rm -rf /tmp/*"
86    ]
87  }
88}

1#!/bin/bash
2set -e
3
4# Install CloudWatch agent
5sudo yum install -y amazon-cloudwatch-agent
6
7# Add base configuration
8cat <<EOF | sudo tee /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json
9{
10  "logs": {
11    "logs_collected": {
12      "files": {
13        "collect_list": [
14          {
15            "file_path": "/var/log/messages",
16            "log_group_name": "/eks/nodes/system"
17          }
18        ]
19      }
20    }
21  }
22}
23EOF

1#!/bin/bash
2set -e
3
4# Pre-pull common images to speed up pod scheduling
5IMAGES=(
6  "602401143452.dkr.ecr.ap-south-1.amazonaws.com/amazon-k8s-cni:v1.15.1"
7  "602401143452.dkr.ecr.ap-south-1.amazonaws.com/eks/kube-proxy:v1.29.0"
8  "public.ecr.aws/eks/aws-load-balancer-controller:v2.7.0"
9)
10
11# Authenticate with ECR
12aws ecr get-login-password --region ap-south-1 | \
13  sudo docker login --username AWS --password-stdin 602401143452.dkr.ecr.ap-south-1.amazonaws.com
14
15for image in "${IMAGES[@]}"; do
16  echo "Pre-caching: $image"
17  sudo ctr --namespace k8s.io image pull "$image" || true
18done

1# Initialize Packer plugins
2packer init eks-node.pkr.hcl
3
4# Validate the template (catch errors early)
5packer validate eks-node.pkr.hcl
6
7# Build the AMI
8packer build -var="eks_version=1.29" eks-node.pkr.hcl

1# variables.tf
2variable "golden_ami_id" {
3  description = "Golden AMI ID built by Packer"
4  type = string
5}
6
7variable "cluster_name" {
8  type = string
9  default = "production-eks"
10}

1# eks.tf
2module "eks" {
3  source = "terraform-aws-modules/eks/aws"
4  version = "~> 20.0"
5
6  cluster_name = var.cluster_name
7  cluster_version = "1.29"
8
9  vpc_id = module.vpc.vpc_id
10  subnet_ids = module.vpc.private_subnets
11
12  eks_managed_node_groups = {
13    application = {
14      name           = "app-nodes"
15      instance_types = ["t3.large"]
16
17      min_size     = 2
18      max_size     = 10
19      desired_size = 3
20
21      # This is where we use our Golden AMI
22      ami_id                     = var.golden_ami_id
23      enable_bootstrap_user_data = true
24
25      # Additional bootstrap arguments
26      bootstrap_extra_args = "--kubelet-extra-args '--node-labels=workload=application'"
27
28      labels = {
29        Environment = "production"
30        ManagedBy   = "terraform"
31      }
32
33      tags = {
34        AMIType = "golden"
35      }
36    }
37  }
38}

1# data.tf
2data "aws_ami" "golden_eks" {
3  most_recent = true
4  owners = ["self"]
5
6  filter {
7    name = "name"
8    values = ["eks-golden-1.29-*"]
9  }
10
11  filter {
12    name = "tag:ManagedBy"
13    values = ["Packer"]
14  }
15}
16
17# Then reference: data.aws_ami.golden_eks.id

1# .github/workflows/golden-ami.yml
2name: Build Golden AMI
3
4on:
5  schedule:
6    - cron: '0 2 * * 0'  # Weekly builds every Sunday at 2 AM
7  workflow_dispatch:      # Manual trigger option
8
9jobs:
10  build:
11    runs-on: ubuntu-latest
12    steps:
13      - uses: actions/checkout@v4
14      
15      - name: Configure AWS credentials
16        uses: aws-actions/configure-aws-credentials@v4
17        with:
18          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
19          aws-region: ap-south-1
20
21      - name: Setup Packer
22        uses: hashicorp/setup-packer@main
23
24      - name: Build AMI
25        run: |
26 packer init eks-node.pkr.hcl
27 packer build -machine-readable eks-node.pkr.hcl | tee build.log
28 
29      - name: Extract AMI ID
30        run: |
31 AMI_ID=$(grep 'artifact,0,id' build.log | cut -d: -f2)
32 echo "New Golden AMI: $AMI_ID"