Managing the package controller

Installing the package controller

Important

The package controller installation creates a package bundle controller resource for each cluster, thus allowing each to activate a different package bundle version. Ideally, you should never delete this resource because it would mean losing that information and upon re-installing, the latest bundle would be selected. However, you can always go back to the previous bundle version. For more information, see Managing package bundles.

The package controller is typically installed during cluster creation, but may be disabled intentionally in your cluster.yaml by setting spec.packages.disable to true.

If you created a cluster without the package controller or if the package controller was not properly configured, you may need to manually install it.

Enable the package controller in your cluster.yaml, if it was previously disabled:

apiVersion: anywhere.eks.amazonaws.com/v1alpha1
kind: Cluster
metadata:
  name: mgmt
spec:
  packages:
    disable: false

Make sure you are authenticated with the AWS CLI. Use the credentials you set up for packages. These credentials should have limited capabilities :

export AWS_ACCESS_KEY_ID="your*access*id"
export AWS_SECRET_ACCESS_KEY="your*secret*key"
export EKSA_AWS_ACCESS_KEY_ID="your*access*id"
export EKSA_AWS_SECRET_ACCESS_KEY="your*secret*key"

Verify your credentials are working:
```
aws sts get-caller-identity
```
Authenticate docker to the private AWS ECR registry with your AWS credentials. Reference prerequisites to identity the AWS account that houses the EKS Anywhere packages artifacts. Authentication is required to pull images from it.
```
aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_PACKAGES_ACCOUNT.dkr.ecr.$EKSA_AWS_REGION.amazonaws.com
```

Verify you can pull an image from the packages registry:

docker pull $ECR_PACKAGES_ACCOUNT.dkr.ecr.$EKSA_AWS_REGION.amazonaws.com/emissary-ingress/emissary:v3.9.1-828e7d186ded23e54f6bd95a5ce1319150f7e325

If the image downloads successfully, it worked!

Now, install the package controller using the EKS Anywhere Packages CLI:
```
eksctl anywhere install packagecontroller -f cluster.yaml
```
The package controller should now be installed!

Use kubectl to check the eks-anywhere-packages pod is running in your management cluster:

kubectl get pods -n eksa-packages 
NAME                                     READY   STATUS    RESTARTS   AGE
eks-anywhere-packages-55bc54467c-jfhgp   1/1     Running   0          21s

Updating the package credentials

You may need to create or update your credentials which you can do with a command like this. Set the environment variables to the proper values before running the command.

kubectl delete secret -n eksa-packages aws-secret
kubectl create secret -n eksa-packages generic aws-secret \
  --from-literal=AWS_ACCESS_KEY_ID=${EKSA_AWS_ACCESS_KEY_ID} \
  --from-literal=AWS_SECRET_ACCESS_KEY=${EKSA_AWS_SECRET_ACCESS_KEY}  \
  --from-literal=REGION=${EKSA_AWS_REGION}

Upgrade the packages controller

EKS Anywhere v0.15.0 (packages controller v0.3.9+) and onwards includes support for the eks-anywhere-packages controller as a self-managed package feature. The package controller now upgrades automatically according to the version specified within the management cluster’s selected package bundle.

For any version prior to v0.3.X, manual steps must be executed to upgrade.

Important

This operation may change your cluster’s selected package bundle to the latest version. However, you can always go back to the previous bundle version. For more information, see Managing package bundles.

To manually upgrade the package controller, do the following:

Ensure the namespace will be kept

kubectl annotate namespaces eksa-packages helm.sh/resource-policy=keep

Uninstall the eks-anywhere-packages helm release

helm uninstall -n eksa-packages eks-anywhere-packages

Remove the secret called aws-secret (we will need credentials when installing the new version)

kubectl delete secret -n eksa-packages aws-secret

Install the new version using the latest eksctl-anywhere binary on your management cluster

eksctl anywhere install packagecontroller -f eksa-mgmt-cluster.yaml