Skip to content

Commit 8a2c5a8

Browse files
samadwarsamadwar
committed
Fixed cert permission issue and added IMDS token
1 parent 45f5b71 commit 8a2c5a8

File tree

3 files changed

+100
-92
lines changed

3 files changed

+100
-92
lines changed

‎example/sagemaker-studio-local-mode.ipynb

+1-1
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@
9595
"metadata": {},
9696
"outputs": [],
9797
"source": [
98-
"!cd data/train; wget https://raw.githubusercontent.com/aws-samples/amazon-sagemaker-local-mode/main/xgboost_script_mode_local_training_and_serving/data/train/abalone"
98+
"!mkdir -p data/train; cd data/train; wget https://raw.githubusercontent.com/aws-samples/amazon-sagemaker-local-mode/main/xgboost_script_mode_local_training_and_serving/data/train/abalone"
9999
]
100100
},
101101
{

‎src/sagemaker_studio_docker_cli/bootstrap.py

+9-3
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,12 @@ def generate_bootstrap_script(home, efs_ip_address, port, user_uid, gpu_option,
3838
{efs_ip_address}:/{user_uid} \
3939
/home/sagemaker-user
4040
41-
4241
{create_certs}
4342
44-
instance_type=$(curl http://169.254.169.254/latest/meta-data/instance-type)
45-
instance_id=$(curl http://169.254.169.254/latest/meta-data/instance-id)
43+
token = $(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 3600")
44+
45+
instance_type=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-type)
46+
instance_id=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id)
4647
4748
if ( ! [[ "{home}" == "/home/sagemaker-user" ]] || [[ "{home}" == "/root" ]] )
4849
then
@@ -57,6 +58,8 @@ def generate_bootstrap_script(home, efs_ip_address, port, user_uid, gpu_option,
5758
mkdir -p $CERTS
5859
5960
_tls_generate_certs "$CERTS"
61+
62+
chown -R {user_uid}:1001 $CERTS
6063
6164
sudo -u ec2-user docker run -d \
6265
-p {port}:2376 \
@@ -74,6 +77,9 @@ def generate_bootstrap_script(home, efs_ip_address, port, user_uid, gpu_option,
7477
mkdir -p $CERTS
7578
7679
_tls_generate_certs "$CERTS"
80+
81+
chown -R {user_uid}:1001 $CERTS
82+
7783
sudo -u ec2-user docker run -d \
7884
-p {port}:2376 \
7985
-p 8080:8080 {gpu_option} \

‎src/sagemaker_studio_docker_cli/create_certs.sh

+90-88
Original file line numberDiff line numberDiff line change
@@ -1,91 +1,93 @@
11
_tls_ensure_private() {
2-
local f="$1"; shift
3-
[ -s "$f" ] || openssl genrsa -out "$f" 4096
4-
}
5-
_tls_san() {
6-
IPADDR=$(curl http://169.254.169.254/latest/meta-data/local-ipv4)
7-
LOCALDNS=$(curl http://169.254.169.254/latest/meta-data/local-hostname)
8-
{
9-
ip -oneline address | awk '{ gsub(/\/.+$/, "", $4); print "IP:" $4 }'
10-
{
11-
cat /etc/hostname
12-
echo 'docker'
13-
echo 'localhost'
14-
echo $LOCALDNS
15-
hostname -f
16-
hostname -s
17-
echo $IPADDR
18-
} | sed 's/^/DNS:/'
19-
[ -z "${DOCKER_TLS_SAN:-}" ] || echo "$DOCKER_TLS_SAN"
20-
} | sort -u | xargs printf '%s,' | sed "s/,\$//"
21-
}
22-
23-
_tls_generate_certs() {
24-
local dir="$1"; shift
25-
26-
# if ca/key.pem || !ca/cert.pem, generate CA public if necessary
27-
# if ca/key.pem, generate server public
28-
# if ca/key.pem, generate client public
29-
# (regenerating public certs every startup to account for SAN/IP changes and/or expiration)
30-
31-
# https://github.com/FiloSottile/mkcert/issues/174
32-
local certValidDays='825'
2+
local f="$1"; shift
3+
[ -s "$f" ] || openssl genrsa -out "$f" 4096
4+
}
5+
_tls_san() {
6+
token = $(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 3600")
337

34-
if [ -s "$dir/ca/key.pem" ] || [ ! -s "$dir/ca/cert.pem" ]; then
35-
# if we either have a CA private key or do *not* have a CA public key, then we should create/manage the CA
36-
mkdir -p "$dir/ca"
37-
_tls_ensure_private "$dir/ca/key.pem"
38-
openssl req -new -key "$dir/ca/key.pem" \
39-
-out "$dir/ca/cert.pem" \
40-
-subj '/CN=$HOSTNAME CA' -x509 -days "$certValidDays"
41-
fi
42-
43-
if [ -s "$dir/ca/key.pem" ]; then
44-
# if we have a CA private key, we should create/manage a server key
45-
mkdir -p "$dir/server"
46-
_tls_ensure_private "$dir/server/key.pem"
47-
openssl req -new -key "$dir/server/key.pem" \
48-
-out "$dir/server/csr.pem" \
49-
-subj '/CN=docker:dind server'
50-
echo "[ x509_exts ]" >> $dir/server/openssl.cnf
51-
echo "subjectAltName = $(_tls_san)" >> $dir/server/openssl.cnf
8+
IPADDR=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/local-ipv4)
9+
LOCALDNS=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/local-hostname)
10+
{
11+
ip -oneline address | awk '{ gsub(/\/.+$/, "", $4); print "IP:" $4 }'
12+
{
13+
cat /etc/hostname
14+
echo 'docker'
15+
echo 'localhost'
16+
echo $LOCALDNS
17+
hostname -f
18+
hostname -s
19+
echo $IPADDR
20+
} | sed 's/^/DNS:/'
21+
[ -z "${DOCKER_TLS_SAN:-}" ] || echo "$DOCKER_TLS_SAN"
22+
} | sort -u | xargs printf '%s,' | sed "s/,\$//"
23+
}
5224

53-
openssl x509 -req \
54-
-in "$dir/server/csr.pem" \
55-
-CA "$dir/ca/cert.pem" \
56-
-CAkey "$dir/ca/key.pem" \
57-
-CAcreateserial \
58-
-out "$dir/server/cert.pem" \
59-
-days "$certValidDays" \
60-
-extfile "$dir/server/openssl.cnf" \
61-
-extensions x509_exts
62-
cp "$dir/ca/cert.pem" "$dir/server/ca.pem"
63-
openssl verify -CAfile "$dir/server/ca.pem" "$dir/server/cert.pem"
64-
fi
65-
66-
if [ -s "$dir/ca/key.pem" ]; then
67-
# if we have a CA private key, we should create/manage a client key
68-
mkdir -p "$dir/client"
69-
_tls_ensure_private "$dir/client/key.pem"
70-
chmod 0644 "$dir/client/key.pem" # openssl defaults to 0600 for the private key, but this one needs to be shared with arbitrary client contexts
71-
openssl req -new \
72-
-key "$dir/client/key.pem" \
73-
-out "$dir/client/csr.pem" \
74-
-subj '/CN=docker:dind client'
75-
76-
echo "[ x509_exts ]" >> $dir/client/openssl.cnf
77-
echo "extendedKeyUsage = clientAuth" >> $dir/client/openssl.cnf
78-
79-
openssl x509 -req \
80-
-in "$dir/client/csr.pem" \
81-
-CA "$dir/ca/cert.pem" \
82-
-CAkey "$dir/ca/key.pem" \
83-
-CAcreateserial \
84-
-out "$dir/client/cert.pem" \
85-
-days "$certValidDays" \
86-
-extfile "$dir/client/openssl.cnf" \
87-
-extensions x509_exts
88-
cp "$dir/ca/cert.pem" "$dir/client/ca.pem"
89-
openssl verify -CAfile "$dir/client/ca.pem" "$dir/client/cert.pem"
90-
fi
91-
}
25+
_tls_generate_certs() {
26+
local dir="$1"; shift
27+
28+
# if ca/key.pem || !ca/cert.pem, generate CA public if necessary
29+
# if ca/key.pem, generate server public
30+
# if ca/key.pem, generate client public
31+
# (regenerating public certs every startup to account for SAN/IP changes and/or expiration)
32+
33+
# https://github.com/FiloSottile/mkcert/issues/174
34+
local certValidDays='825'
35+
36+
if [ -s "$dir/ca/key.pem" ] || [ ! -s "$dir/ca/cert.pem" ]; then
37+
# if we either have a CA private key or do *not* have a CA public key, then we should create/manage the CA
38+
mkdir -p "$dir/ca"
39+
_tls_ensure_private "$dir/ca/key.pem"
40+
openssl req -new -key "$dir/ca/key.pem" \
41+
-out "$dir/ca/cert.pem" \
42+
-subj '/CN=$HOSTNAME CA' -x509 -days "$certValidDays"
43+
fi
44+
45+
if [ -s "$dir/ca/key.pem" ]; then
46+
# if we have a CA private key, we should create/manage a server key
47+
mkdir -p "$dir/server"
48+
_tls_ensure_private "$dir/server/key.pem"
49+
openssl req -new -key "$dir/server/key.pem" \
50+
-out "$dir/server/csr.pem" \
51+
-subj '/CN=docker:dind server'
52+
echo "[ x509_exts ]" >> $dir/server/openssl.cnf
53+
echo "subjectAltName = $(_tls_san)" >> $dir/server/openssl.cnf
54+
55+
openssl x509 -req \
56+
-in "$dir/server/csr.pem" \
57+
-CA "$dir/ca/cert.pem" \
58+
-CAkey "$dir/ca/key.pem" \
59+
-CAcreateserial \
60+
-out "$dir/server/cert.pem" \
61+
-days "$certValidDays" \
62+
-extfile "$dir/server/openssl.cnf" \
63+
-extensions x509_exts
64+
cp "$dir/ca/cert.pem" "$dir/server/ca.pem"
65+
openssl verify -CAfile "$dir/server/ca.pem" "$dir/server/cert.pem"
66+
fi
67+
68+
if [ -s "$dir/ca/key.pem" ]; then
69+
# if we have a CA private key, we should create/manage a client key
70+
mkdir -p "$dir/client"
71+
_tls_ensure_private "$dir/client/key.pem"
72+
chmod 0644 "$dir/client/key.pem" # openssl defaults to 0600 for the private key, but this one needs to be shared with arbitrary client contexts
73+
openssl req -new \
74+
-key "$dir/client/key.pem" \
75+
-out "$dir/client/csr.pem" \
76+
-subj '/CN=docker:dind client'
77+
78+
echo "[ x509_exts ]" >> $dir/client/openssl.cnf
79+
echo "extendedKeyUsage = clientAuth" >> $dir/client/openssl.cnf
80+
81+
openssl x509 -req \
82+
-in "$dir/client/csr.pem" \
83+
-CA "$dir/ca/cert.pem" \
84+
-CAkey "$dir/ca/key.pem" \
85+
-CAcreateserial \
86+
-out "$dir/client/cert.pem" \
87+
-days "$certValidDays" \
88+
-extfile "$dir/client/openssl.cnf" \
89+
-extensions x509_exts
90+
cp "$dir/ca/cert.pem" "$dir/client/ca.pem"
91+
openssl verify -CAfile "$dir/client/ca.pem" "$dir/client/cert.pem"
92+
fi
93+
}

0 commit comments

Comments
 (0)