From 9da27d230dd80c38f5c59a008a14bcd02960dfe9 Mon Sep 17 00:00:00 2001
From: Steven Enamakel <enamakel@tinyhumans.ai>
Date: Thu, 22 Oct 2026 14:29:39 +0530
Subject: [PATCH] Install AWS CLI v2 in rust-ci instead of Ubuntu's v1

Co-authored-by: Medulla <medulla@tinyhumans.ai>
---
 images/rust-ci/Dockerfile | 16 +++++++++++++++-
 images/rust-ci/README.md  |  3 ++-
 images/rust-ci/smoke.sh   |  2 ++
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/images/rust-ci/Dockerfile b/images/rust-ci/Dockerfile
index efbcc16..05ffb64 100644
--- a/images/rust-ci/Dockerfile
+++ b/images/rust-ci/Dockerfile
@@ -38,9 +38,23 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf \
         libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev \
         xvfb xauth at-spi2-core dbus-x11 webkit2gtk-driver \
-        libcap2 awscli openssh-client uidmap slirp4netns iptables iproute2 \
+        libcap2 openssh-client uidmap slirp4netns iptables iproute2 \
     && rm -rf /var/lib/apt/lists/*
 
+# AWS CLI v2 for deploy jobs. Ubuntu's `awscli` package is v1 (1.22 on
+# jammy), whose `aws eks update-kubeconfig` writes the
+# `client.authentication.k8s.io/v1alpha1` exec API that kubectl 1.24 and
+# later refuse. The digest is of AWS's signed release zip (signature checked
+# against the AWS CLI team's key, FB5DB77FD5C118B80511ADA8A6310ACC4672475C).
+ARG AWSCLI_VERSION=2.37.10
+ARG AWSCLI_SHA256=1aaed142cb63294e41ef70431fe9c602dbb869f8a21b6b8fc9d5ffd53b5c9235
+RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${AWSCLI_VERSION}.zip" -o /tmp/awscli.zip \
+    && echo "${AWSCLI_SHA256}  /tmp/awscli.zip" | sha256sum -c --quiet - \
+    && unzip -q /tmp/awscli.zip -d /tmp/awscli \
+    && /tmp/awscli/aws/install \
+    && rm -rf /tmp/awscli /tmp/awscli.zip \
+    && aws --version | grep -q "^aws-cli/${AWSCLI_VERSION} "
+
 # MongoDB and mongosh, for tests that need a real server
 # (`mongod --fork`, replica sets with `rs.initiate`): the runner's service
 # containers and `docker run` are not available inside a container job.
diff --git a/images/rust-ci/README.md b/images/rust-ci/README.md
index 93a5b2b..e311420 100644
--- a/images/rust-ci/README.md
+++ b/images/rust-ci/README.md
@@ -91,7 +91,8 @@ and D-Bus. This verifies the image dependencies, not the full OpenHuman suite.
 
 Deploy jobs can start Docker in rootless mode using `docker/setup-docker-action`.
 The image includes `uidmap`, `slirp4netns`, `iptables`, `iproute2`, OpenSSH and
-AWS CLI. A VM runner must supply user namespaces and at least 65,536 subordinate
+AWS CLI v2 (`AWSCLI_VERSION`; v1's `aws eks update-kubeconfig` writes an exec
+API current kubectl refuses). A VM runner must supply user namespaces and at least 65,536 subordinate
 UIDs/GIDs for its job user. No root daemon or privileged Docker socket is baked
 into this image. Verify a rootless build in the target VM before enabling deploys;
 image build smoke tests cannot prove the host kernel supports user namespaces.
diff --git a/images/rust-ci/smoke.sh b/images/rust-ci/smoke.sh
index 81f90ee..80b384f 100644
--- a/images/rust-ci/smoke.sh
+++ b/images/rust-ci/smoke.sh
@@ -40,6 +40,8 @@ node --version
 pnpm --version
 python3 -c 'import tomli'
 aws --version
+# v1 writes a kubeconfig current kubectl refuses (exec API v1alpha1).
+aws --version | grep -q '^aws-cli/2\.'
 ssh -V
 slirp4netns --version
 iptables --version