Add eksctl and aws-iam-authenticator to the runner image #6

Merged

geusebio merged 1 commit from claude/aws-cli-tools-40ddcb into main 2026-08-05 10:40:41 +00:00

Conversation 0 Commits 1 Files changed 1 +39

geusebio commented 2026-08-05 10:34:52 +00:00

Owner

Copy link

What

Adds the EKS-facing AWS toolchain to the runner image:

• eksctl v0.229.0
• aws-iam-authenticator v0.7.18

Both are installed from their upstream release archives following the existing OpenTofu pattern: pinned versions, verified against each project's published SHA256 checksums file, so every PHP variant and both arches (amd64 + arm64) get the same build. Both are static Go binaries and run on musl.

Why not the AWS CLI itself?

aws is already present — it ships via apk (AWS_PACKAGES), which gives aws-cli v2 on Alpine 3.19+ (php8.2–8.5) and v1 on the older php7.4/8.1 "life-support" bases. Verified working in the built image (aws-cli/2.27.25 on php8.4).

Why no session-manager-plugin?

Deliberately omitted. AWS distributes it only as a glibc-linked binary (needs libresolv.so.2 etc.), so it will not run on Alpine's musl without bundling a full glibc — the same incompatibility that keeps the official AWS CLI v2 installer off Alpine. gcompat doesn't cover it. Not worth the fragility for a runner image.

Verification

Built end-to-end via docker buildx bake and smoke-tested the binaries in the resulting image:

• php7.4 (Alpine 3.15, amd64 under emulation) — builds green, checksums OK
• php8.4 (arm64) — builds green; aws, eksctl, aws-iam-authenticator, tofu all run:

aws: aws-cli/2.27.25 Python/3.12.13 Linux/... aarch64.alpine.3
eksctl: 0.229.0
aws-iam-authenticator: {"Version":"0.7.18",...}
tofu: OpenTofu v1.12.5

🤖 Generated with Claude Code

## What Adds the EKS-facing AWS toolchain to the runner image: - **eksctl** `v0.229.0` - **aws-iam-authenticator** `v0.7.18` Both are installed from their upstream release archives following the existing OpenTofu pattern: pinned versions, verified against each project's published SHA256 checksums file, so every PHP variant and both arches (amd64 + arm64) get the same build. Both are static Go binaries and run on musl. ## Why not the AWS CLI itself? `aws` is already present — it ships via apk (`AWS_PACKAGES`), which gives aws-cli **v2** on Alpine 3.19+ (php8.2–8.5) and **v1** on the older php7.4/8.1 "life-support" bases. Verified working in the built image (`aws-cli/2.27.25` on php8.4). ## Why no session-manager-plugin? Deliberately omitted. AWS distributes it only as a **glibc-linked** binary (needs `libresolv.so.2` etc.), so it will not run on Alpine's musl without bundling a full glibc — the same incompatibility that keeps the official AWS CLI v2 installer off Alpine. `gcompat` doesn't cover it. Not worth the fragility for a runner image. ## Verification Built end-to-end via `docker buildx bake` and smoke-tested the binaries in the resulting image: - `php7.4` (Alpine 3.15, amd64 under emulation) — builds green, checksums OK - `php8.4` (arm64) — builds green; `aws`, `eksctl`, `aws-iam-authenticator`, `tofu` all run: ``` aws: aws-cli/2.27.25 Python/3.12.13 Linux/... aarch64.alpine.3 eksctl: 0.229.0 aws-iam-authenticator: {"Version":"0.7.18",...} tofu: OpenTofu v1.12.5 ``` 🤖 Generated with [Claude Code](https://claude.com/claude-code)

geusebio added 1 commit 2026-08-05 10:34:52 +00:00

Add eksctl and aws-iam-authenticator to the runner image ... 8a9de4205f

The base `aws` CLI already ships via apk (v2 on Alpine 3.19+, v1 on the
older php7.4/8.1 bases), but the surrounding EKS toolchain is not packaged
for Alpine. Install eksctl and aws-iam-authenticator from their upstream
releases the same way as OpenTofu: pinned versions, SHA256-verified against
each project's published checksums file, so every PHP variant and both
arches get the same build. Both are static Go binaries and run on musl.

session-manager-plugin is deliberately left out: AWS distributes it only as
a glibc-linked binary (needs libresolv.so.2), which will not run on musl
without bundling a full glibc — the same incompatibility that keeps the AWS
CLI v2 installer off Alpine.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

geusebio merged commit 04971a8ad8 into main 2026-08-05 10:40:41 +00:00

geusebio referenced this pull request from a commit 2026-08-05 10:40:41 +00:00

Merge pull request 'Add eksctl and aws-iam-authenticator to the runner image' (#6) from claude/aws-cli-tools-40ddcb into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

actions/Github-Actions-Runner!6

No description provided.