Skip to content

Install AWS CLI v2 in rust-ci instead of Ubuntu's v1 #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
senamakel merged 1 commit into from
Oct 22, 2026
Merged

Install AWS CLI v2 in rust-ci instead of Ubuntu's v1 #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion images/rust-ci/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,23 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf \
libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev \
xvfb xauth at-spi2-core dbus-x11 webkit2gtk-driver \
libcap2 awscli openssh-client uidmap slirp4netns iptables iproute2 \
libcap2 openssh-client uidmap slirp4netns iptables iproute2 \
&& rm -rf /var/lib/apt/lists/*

# AWS CLI v2 for deploy jobs. Ubuntu's `awscli` package is v1 (1.22 on
# jammy), whose `aws eks update-kubeconfig` writes the
# `client.authentication.k8s.io/v1alpha1` exec API that kubectl 1.24 and
# later refuse. The digest is of AWS's signed release zip (signature checked
# against the AWS CLI team's key, FB5DB77FD5C118B80511ADA8A6310ACC4672475C).
ARG AWSCLI_VERSION=2.37.10
ARG AWSCLI_SHA256=1aaed142cb63294e41ef70431fe9c602dbb869f8a21b6b8fc9d5ffd53b5c9235
RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${AWSCLI_VERSION}.zip" -o /tmp/awscli.zip \
&& echo "${AWSCLI_SHA256} /tmp/awscli.zip" | sha256sum -c --quiet - \
&& unzip -q /tmp/awscli.zip -d /tmp/awscli \
&& /tmp/awscli/aws/install \
&& rm -rf /tmp/awscli /tmp/awscli.zip \
&& aws --version | grep -q "^aws-cli/${AWSCLI_VERSION} "

# MongoDB and mongosh, for tests that need a real server
# (`mongod --fork`, replica sets with `rs.initiate`): the runner's service
# containers and `docker run` are not available inside a container job.
Expand Down
3 changes: 2 additions & 1 deletion images/rust-ci/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,8 @@ and D-Bus. This verifies the image dependencies, not the full OpenHuman suite.

Deploy jobs can start Docker in rootless mode using `docker/setup-docker-action`.
The image includes `uidmap`, `slirp4netns`, `iptables`, `iproute2`, OpenSSH and
AWS CLI. A VM runner must supply user namespaces and at least 65,536 subordinate
AWS CLI v2 (`AWSCLI_VERSION`; v1's `aws eks update-kubeconfig` writes an exec
API current kubectl refuses). A VM runner must supply user namespaces and at least 65,536 subordinate
UIDs/GIDs for its job user. No root daemon or privileged Docker socket is baked
into this image. Verify a rootless build in the target VM before enabling deploys;
image build smoke tests cannot prove the host kernel supports user namespaces.
Expand Down
2 changes: 2 additions & 0 deletions images/rust-ci/smoke.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,8 @@ node --version
pnpm --version
python3 -c 'import tomli'
aws --version
# v1 writes a kubeconfig current kubectl refuses (exec API v1alpha1).
aws --version | grep -q '^aws-cli/2\.'
ssh -V
slirp4netns --version
iptables --version
Expand Down
Loading