Flux bootstrap for AWS CodeCommit

To install Flux on an EKS cluster using a CodeCommit repository as the source of truth, you can use the flux bootstrap git command.

Bootstrap over SSH

Create a new CodeCommit repository and generate a SSH private key with a passphrase.

Upload the SSH public key using the AWS CLI:

aws iam upload-ssh-public-key --user-name codecommit-user --ssh-public-key-body file://flux.pub

The output will contain a field called SSHPublicKeyID:

{
    "SSHPublicKey": {
        "SSHPublicKeyId": "<SSH-Key-ID>",
        "Fingerprint": "<fingerprint>",
        "SSHPublicKeyBody": "<public-key>",
        "Status": "Active",
        "UploadDate": "<timestamp>"
    }
}

Run bootstrap using the SSHPublicKeyId as the SSH username:

flux bootstrap git \
  --url=ssh://<SSHPublicKeyId>@git-codecommit.<region>.amazonaws.com/v1/repos/<repository> \
  --branch=<my-branch> \
  --private-key-file=<path/to/ssh/private.key> \
  --password=<key-passphrase> \
  --path=clusters/my-cluster

You can also pipe the passphrase e.g. echo key-passphrase | flux bootstrap git.

The SSH private key and the known hosts keys are stored in the cluster as a Kubernetes secret named flux-system inside the flux-system namespace.