parallelcluster.yaml

name: PCluster
description: Bake PCluster AMI
schemaVersion: 1.0

constants:
  - ChefVersion:
      type: string
      value: 18.8.54
  - FailExitCode:
      type: string
      value: 1

phases:
  - name: build
    steps:
      # Get operating system name for variable chaining
      - name: OperatingSystemName
        action: ExecuteBash
        inputs:
          commands:
            - |
              set -x
              . /etc/os-release
              RELEASE="${!ID}${!VERSION_ID:+.${!VERSION_ID}}"
              case "$RELEASE" in
                amzn.2023) echo 'alinux2023' ;;
                ubuntu.22*) echo 'ubuntu2204' ;;
                ubuntu.24*) echo 'ubuntu2404' ;;
                rhel.8*) echo 'rhel8' ;;
                rocky.8*) echo 'rocky8' ;;
                rhel.9*) echo 'rhel9' ;;
                rocky.9*) echo 'rocky9' ;;
                almalinux.8*) echo 'almalinux8' ;;
                *) echo "Unsupported OS: $RELEASE" && exit {{ FailExitCode }} ;;
              esac

      # Disable snap refresh to prevent background updates during build (Ubuntu only)
      - name: DisableSnapRefresh
        action: ExecuteBash
        inputs:
          commands:
            - |
              set -x
              OS="{{ build.OperatingSystemName.outputs.stdout }}"
              if [[ $OS =~ ^ubuntu ]] && command -v snap &>/dev/null; then
                snap watch --last=auto-refresh 2>/dev/null || true
                snap refresh --hold && mkdir -p /opt/parallelcluster && touch /opt/parallelcluster/pcluster_build_image_snap_hold
              fi

      # Initialize system information and URLs
      - name: SystemInfo
        action: ExecuteBash
        inputs:
          commands:
            - |
              set -x
              # Get OS info
              . /etc/os-release
              # Check input base AMI OS and get OS information, the output should be like amzn.2023 | ubuntu.22.04 | rhel.8.10 | rocky.8.10 | almalinux.8.10
              RELEASE="${!ID}${!VERSION_ID:+.${!VERSION_ID}}"
              
              # Use OS name from previous step
              OS="{{ build.OperatingSystemName.outputs.stdout }}"
              
              # Set platform
              [[ $OS =~ ^(alinux|almalinux|rhel|rocky) ]] && PLATFORM='RHEL' || PLATFORM='DEBIAN'
              
              # Set URLs
              COOKBOOK_NAME="aws-parallelcluster-cookbook-${CfnParamCookbookVersion}"
              COOKBOOK_URL="https://${AWS::Region}-aws-parallelcluster.s3.${AWS::Region}.${AWS::URLSuffix}/parallelcluster/${CfnParamCookbookVersion}/cookbooks/${!COOKBOOK_NAME}.tgz"
              [ -n "${CfnParamChefCookbook}" ] && COOKBOOK_URL="${CfnParamChefCookbook}"
              
              CINC_URL="https://${AWS::Region}-aws-parallelcluster.s3.${AWS::Region}.${AWS::URLSuffix}/archives/cinc/cinc-install-1.4.0.sh"
              [ -n "${CfnParamCincInstaller}" ] && CINC_URL="${CfnParamCincInstaller}"
              
              if [[ $OS == alinux2023 && $(uname -r) == 6.12.* ]]; then
                KERNEL_PACKAGES_PREFIX="kernel6.12"
              else
                KERNEL_PACKAGES_PREFIX="kernel"
              fi
              
              # Output all variables to persistent location
              mkdir -p /opt/parallelcluster
              echo "OS='$OS'" > /opt/parallelcluster/system_info
              echo "PLATFORM='$PLATFORM'" >> /opt/parallelcluster/system_info
              echo "RELEASE='$RELEASE'" >> /opt/parallelcluster/system_info
              echo "VERSION_ID='$VERSION_ID'" >> /opt/parallelcluster/system_info
              echo "COOKBOOK_URL='$COOKBOOK_URL'" >> /opt/parallelcluster/system_info
              echo "CINC_URL='$CINC_URL'" >> /opt/parallelcluster/system_info
              echo "COOKBOOK_NAME='$COOKBOOK_NAME'" >> /opt/parallelcluster/system_info
              echo "KERNEL_PACKAGES_PREFIX='$KERNEL_PACKAGES_PREFIX'" >> /opt/parallelcluster/system_info

      - name: PinVersion
        action: ExecuteBash
        inputs:
          commands:
            - |
              set -x
              . /opt/parallelcluster/system_info

              # Pin kernel versions and install packages
              if [[ $PLATFORM == RHEL ]]; then
                [[ $OS =~ (rhel9|rocky9) && ! -f /etc/yum/vars/releasever ]] && {
                  echo "yes" > /opt/parallelcluster/pin_releasesever
                  echo $VERSION_ID > /etc/yum/vars/releasever
                  yum clean all
                }
                
                PACKAGE_LIST="${!KERNEL_PACKAGES_PREFIX}-headers-$(uname -r) ${!KERNEL_PACKAGES_PREFIX}-devel-$(uname -r) ${!KERNEL_PACKAGES_PREFIX}-modules-extra-$(uname -r)"
                Repository="BaseOS"
                [[ $OS =~ (rocky9|rhel9) ]] && PACKAGE_LIST+=" ${!KERNEL_PACKAGES_PREFIX}-devel-matched-$(uname -r)" && Repository="AppStream"
                
                if [[ $OS =~ rocky ]]; then
                  for PACKAGE in ${!PACKAGE_LIST}
                  do
                    yum -y install ${!PACKAGE} || {
                      # Enable vault repository
                      sed -i 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=http://dl.rockylinux.org/vault/rocky|g' /etc/yum.repos.d/*.repo
                      sed -i 's|^#baseurl=https://dl.rockylinux.org/$contentdir|baseurl=https://dl.rockylinux.org/vault/rocky|g' /etc/yum.repos.d/*.repo
                      yum install -y ${!PACKAGE}
                    } || {
                      # Download package from vault. Sometimes simply enabling vault is not enough if repodata index is not in vault
                      # Using the hard-coded links to download rpm is the last safety net.
                      # Although the following code only deal with individual packages, and doesn't have the global impact of enabling vault.
                      # We will figure out a global safety net when needed (build failure happens again)
                      yum install -y wget
                      wget https://dl.rockylinux.org/vault/rocky/${!VERSION_ID}/${!Repository}/$(uname -m)/os/Packages/k/${!PACKAGE}.rpm
                      yum install -y ./${!PACKAGE}.rpm
                    }
                  done
                else
                  for PACKAGE in ${!PACKAGE_LIST}
                  do
                    yum -y install ${!PACKAGE}
                  done
                fi

                yum install -y yum-plugin-versionlock
                # listing all the packages because wildcard does not work as expected
                yum versionlock ${!KERNEL_PACKAGES_PREFIX} ${!KERNEL_PACKAGES_PREFIX}-core ${!KERNEL_PACKAGES_PREFIX}-modules ${!KERNEL_PACKAGES_PREFIX}-modules-extra
                [[ $OS =~ rocky ]] && yum versionlock rocky-release rocky-repos
                [[ $OS =~ rhel ]] && yum versionlock redhat-release
                [[ $OS == almalinux8 ]] && yum versionlock almalinux-release almalinux-repos
              else
                apt-get -y install linux-headers-$(uname -r) linux-modules-extra-$(uname -r)
                apt-mark hold linux-aws linux-base linux-headers-aws linux-image-aws linux-modules-extra-aws
              fi
              echo "Kernel version is $(uname -a)"

      # Configure system and install prerequisites
      - name: ConfigureSystem
        action: ExecuteBash
        inputs:
          commands:
            - |
              set -x
              . /opt/parallelcluster/system_info
              
              # Disable Nouveau driver
              /bin/sed -r -i -e 's/GRUB_CMDLINE_LINUX="(.*)"/GRUB_CMDLINE_LINUX="\1 rd.driver.blacklist=nouveau nouveau.modeset=0"/' /etc/default/grub
              if [[ ${!PLATFORM} == RHEL ]]; then
                grub2-mkconfig -o /boot/grub2/grub.cfg
              elif [[ ${!PLATFORM} == DEBIAN ]]; then
                update-grub
              fi

              # Install prerequisites
              if [[ $PLATFORM == RHEL ]]; then
                yum -y groupinstall development && sudo yum -y install wget jq
                # Do not install curl on al2023 since curl-minimal-8.5.0-1.amzn2023* is already shipped and conflicts.
                [[ $OS != alinux2023 ]] && yum -y install curl
              else
                [[ "${CfnParamUpdateOsAndReboot}" == "false" ]] && {
                  # disable apt-daily.timer to avoid dpkg lock
                  flock $(apt-config shell StateDir Dir::State/d | sed -r "s/.*'(.*)\/?'$/\1/")/daily_lock systemctl disable --now apt-daily.timer apt-daily.service apt-daily-upgrade.timer apt-daily-upgrade.service
                  # disable unattended upgrades
                  sed "/Update-Package-Lists/s/\"1\"/\"0\"/; /Unattended-Upgrade/s/\"1\"/\"0\"/;" /etc/apt/apt.conf.d/20auto-upgrades > "/etc/apt/apt.conf.d/51pcluster-unattended-upgrades"
                }
                apt-get clean
                apt-get -y update
                apt-get -y install build-essential curl wget jq
              fi
              exit 0

      - name: RebootStep
        action: Reboot
        onFailure: Abort
        maxAttempts: 2
        inputs:
          delaySeconds: 10

      # Install Cinc and setup cookbooks
      - name: InstallCincAndCookbooks
        action: ExecuteBash
        inputs:
          commands:
            - |
              set -x
              . /opt/parallelcluster/system_info
              
              # Update CA certificates and install Cinc
              if [[ ${!PLATFORM} == RHEL ]]; then
                CA_CERTS_FILE=/etc/ssl/certs/ca-bundle.crt
                yum -y upgrade ca-certificates
              elif [[ ${!PLATFORM} == DEBIAN ]]; then
                CA_CERTS_FILE=/etc/ssl/certs/ca-certificates.crt
                apt-get -y --only-upgrade install ca-certificates
              fi
              
              OS="{{ build.OperatingSystemName.outputs.stdout }}"
              ChefVersion={{ ChefVersion }}
              [ -n "${CfnParamCincVersion}" ] && ChefVersion="${CfnParamCincVersion}"
              
              curl --retry 3 -L $CINC_URL | bash -s -- -v $ChefVersion
              
              [[ -e $CA_CERTS_FILE ]] && {
                mkdir -p /opt/cinc/embedded/ssl/certs
                ln -sf ${!CA_CERTS_FILE} /opt/cinc/embedded/ssl/certs/cacert.pem
              }
              
              # Download cookbook
              mkdir -p /etc/chef && sudo chown -R root:root /etc/chef
              delays=(1 2 4 8 16 32 64 128 256)
              for i in {0..8}; do
                HTTP_CODE=$(curl -sS -L -w '%{http_code}' -o /etc/chef/aws-parallelcluster-cookbook.tgz "$COOKBOOK_URL")
                if [[ "$HTTP_CODE" -eq 200 ]]; then
                  echo "Cookbook download succeeded (HTTP $HTTP_CODE)"
                  break
                fi
                echo "Cookbook download attempt $((i+1)) failed with HTTP $HTTP_CODE. Response body:"
                cat /etc/chef/aws-parallelcluster-cookbook.tgz
                echo ""
                sleep ${!delays[$i]}
              done
              
              cd /etc/chef && tar -xzf /etc/chef/aws-parallelcluster-cookbook.tgz --strip-components 1 && rm -f aws-parallelcluster-cookbook.tgz

      - name: CreateChefFiles
        action: CreateFile
        inputs:
          - path: /etc/chef/client.rb
            content: |
              cookbook_path ['/etc/chef/cookbooks']
            overwrite: true
          - path: /etc/parallelcluster/image_dna.json
            content: |
              ${CfnParamChefDnaJson}
            overwrite: true

      - name: InstallPClusterPackages
        action: ExecuteBash
        inputs:
          commands:
            - |
              set -ex
              . /opt/parallelcluster/system_info

              # Validate cookbook version matches expected ParallelCluster version
              ACTUAL_COOKBOOK_VER=$(awk -F\' '/^version/{print $2}' /etc/chef/cookbooks/aws-parallelcluster-entrypoints/metadata.rb)
              [ "${!ACTUAL_COOKBOOK_VER}" = "${CfnParamCookbookVersion}" ] || { echo "Cookbook version mismatch: expected ${CfnParamCookbookVersion}, found ${!ACTUAL_COOKBOOK_VER}"; exit 1; }

              echo "Calling chef-client with /etc/parallelcluster/image_dna.json"
              cat /etc/parallelcluster/image_dna.json
              cinc-client --local-mode --config /etc/chef/client.rb --log_level info --force-formatter --no-color --chef-zero-port 8889 --json-attributes /etc/parallelcluster/image_dna.json --override-runlist aws-parallelcluster-entrypoints::install
              # Create bootstrap file
              echo "$COOKBOOK_NAME" > /opt/parallelcluster/.bootstrapped

      - name: RemoveKernelPinAndCleanup
        action: ExecuteBash
        inputs:
          commands:
            - |
              set -x
              . /opt/parallelcluster/system_info
              
              # Remove kernel version lock
              if [[ ${!PLATFORM} == RHEL ]]; then
                yum versionlock delete ${!KERNEL_PACKAGES_PREFIX} ${!KERNEL_PACKAGES_PREFIX}-core ${!KERNEL_PACKAGES_PREFIX}-modules ${!KERNEL_PACKAGES_PREFIX}-modules-extra
                [[ $OS =~ rocky ]] && yum versionlock delete rocky-release rocky-repos
                [[ $OS =~ rhel ]] && yum versionlock delete redhat-release
                [[ $OS == almalinux8 ]] && yum versionlock delete almalinux-release almalinux-repos
              else
                apt-mark unhold linux-aws linux-base linux-headers-aws linux-image-aws linux-modules-extra-aws
              fi
              
              # Handle SSM agent
              if [[ -f /tmp/imagebuilder_service/ssm_installed ]]; then
                echo "Keeping SSM agent installed"
                rm -rf /tmp/imagebuilder_service/ssm_installed
              else
                 echo "SSM agent is installed by default"
              fi
              
              if [[ -f /opt/parallelcluster/pcluster_build_image_snap_hold ]]; then
                snap refresh --unhold 2>/dev/null || true
                rm -rf /opt/parallelcluster/pcluster_build_image_snap_hold
              fi
              
              # Final cleanup
              rm -f /opt/parallelcluster/system_info
              /usr/local/sbin/ami_cleanup.sh "${CfnParamIsOfficialAmiBuild}"

  - name: validate
    steps:
      - name: PClusterValidate
        action: ExecuteBash
        inputs:
          commands:
            - |
              echo "Check ParallelCluster software stack has been installed"