installs python 3.9 from minimal base image into builder base

builder-base/Dockerfile

@@ -19,8 +19,9 @@
 
 ARG BUILDER_IMAGE
 ARG BASE_IMAGE
+ARG PYTHON_IMAGE
 ARG FINAL_STAGE_BASE
-
+ARG AL_TAG
 
 FROM ${BUILDER_IMAGE} as aws-cli
 ARG TARGETARCH
@@ -194,7 +195,29 @@ RUN --mount=type=cache,target=/var/cache/yum,sharing=locked \
     /install_bash.sh && \
     /remove_yum_packages.sh
 
-FROM ${BUILDER_IMAGE} as ansible
+# for al2 builds we pull python3.9 from the minimal image build since al2
+# does not ship 3.9
+FROM ${PYTHON_IMAGE} as python-3.9
+ARG ANSIBLE_VERSION
+ENV ANSIBLE_VERSION=$ANSIBLE_VERSION
+ARG PYWINRM_VERSION
+ENV PYWINRM_VERSION=$PYWINRM_VERSION
+RUN python3 -m ensurepip --upgrade && \
+    pip3 install --no-cache-dir ansible-core==$ANSIBLE_VERSION && \
+    pip3 install --no-cache-dir pywinrm==$PYWINRM_VERSION
+
+FROM ${BUILDER_IMAGE} as ansible-al2
+
+COPY --link --from=python-3.9 / /ansible
+# we want python2 to be the version symlinkd to python
+# we also do not want to overwrite the rpm db
+# this will leave the packages pulled in from the python image in
+# a slightly odd state in that they are installed yet not in the rpm db
+RUN set -x && \
+    unlink /ansible/usr/bin/python && \
+    rm -rf /var/lib/
+
+FROM ${BUILDER_IMAGE} as ansible-al2023
 ARG TARGETARCH
 WORKDIR /workdir
 ARG ANSIBLE_VERSION
@@ -208,6 +231,8 @@ RUN --mount=type=cache,target=/var/cache/yum,sharing=locked \
     /install_ansible.sh && \
     /remove_yum_packages.sh
 
+FROM ansible-${AL_TAG} as ansible
+
 FROM ${BUILDER_IMAGE} as golang-1.16
 ARG TARGETARCH
 ARG GOLANG_VERSION_116

builder-base/Makefile

@@ -28,7 +28,8 @@ LATEST_IMAGE=$(shell echo $(LATEST_TAGS) | sed "s/ \+/,/g")
 BASE_IMAGE_REPO?=public.ecr.aws/eks-distro-build-tooling
 BASE_IMAGE_NAME?=eks-distro-minimal-base-kind
 BASE_IMAGE?=$(BASE_IMAGE_REPO)/$(BASE_IMAGE_NAME):$(call BASE_TAG_FROM_TAG_FILE,$(BASE_IMAGE_NAME))
-
+PYTHON_IMAGE_NAME?=eks-distro-minimal-base-python
+PYTHON_IMAGE?=$(BASE_IMAGE_REPO)/$(PYTHON_IMAGE_NAME):$(call BASE_TAG_FROM_TAG_FILE,$(PYTHON_IMAGE_NAME)-3.9)
 # using the minimal-base-builder as the base for the download/gcc stages of
 # this build since it doesnt change too often, limiting churn/rebuilds
 BUILDER_IMAGE_NAME?=eks-distro-minimal-base
@@ -46,14 +47,16 @@ IGNORE_NO_CACHE?=false
 NETRC=--secret id=netrc,src=$(HOME)/.netrc
 
 define BASE_TAG_FROM_TAG_FILE
-$(shell yq e ".al$(AL_TAG).$(1)" $(MAKE_ROOT)/../EKS_DISTRO_TAG_FILE.yaml)
+$(shell yq e ".al$(AL_TAG).\"$(1)\"" $(MAKE_ROOT)/../EKS_DISTRO_TAG_FILE.yaml)
 endef
 
 define NEWLINE
 
 
 endef
 
+REALPATH=TZ=utc $(shell if [ "$$(uname -s)" = "Darwin" ] && command -v grealpath &> /dev/null; then echo grealpath; else echo realpath; fi)
+
 GOLANG_RPM_OUTPUT_DIR?=$(MAKE_ROOT)/tmp/golang-downloads
 # Resolves to the download-golang-% targets for each golang version present in ./versions.yaml
 # For example, the `GOLANG_VERSION_116: 1.16.15-3` entry in versions.yaml resolves to `download-golang-1.16.15-3`, and so on
@@ -91,10 +94,12 @@ images-%:
 		--frontend dockerfile.v0 \
 		--opt platform=$(BUILDKIT_PLATFORMS) \
 		--opt build-arg:BASE_IMAGE=$(BASE_IMAGE) \
+		--opt build-arg:PYTHON_IMAGE=$(PYTHON_IMAGE) \
 		--opt build-arg:BUILDER_IMAGE=$(BUILDER_IMAGE) \
 		--opt build-arg:GOPROXY=$(GOPROXY) \
+		--opt build-arg:AL_TAG=al$(AL_TAG) \
 		--opt build-arg:FINAL_STAGE_BASE=$(FINAL_STAGE_BASE) \
-		--opt build-arg:GOLANG_RPM_SOURCE_DIR=$(shell realpath --relative-to $(MAKE_ROOT) $(GOLANG_RPM_OUTPUT_DIR)) \
+		--opt build-arg:GOLANG_RPM_SOURCE_DIR=$(shell $(REALPATH) --relative-to $(MAKE_ROOT) $(GOLANG_RPM_OUTPUT_DIR)) \
 		$(foreach BUILD_ARG,$(IMAGE_BUILD_ARGS),--opt build-arg:$(BUILD_ARG)=$($(BUILD_ARG))) \
 		--export-cache type=inline \
 		$(foreach repo,$(IMPORT_CACHE_REPOS),--import-cache type=registry,ref=$(repo)/builder-base:$(word 1,$(LATEST))) \

builder-base/checksums/packer-amd64-checksum

@@ -1 +1 @@
-1f17a724e5ccc696010c842e6d2bb2c2749ab18ce7bf06482012d3ddb9edeef2  packer_1.8.5_linux_amd64.zip
+6cd5269c4245aa8c99e551d1b862460d63fe711c58bec618fade25f8492e80d9  packer_1.9.4_linux_amd64.zip

builder-base/checksums/packer-arm64-checksum

@@ -1 +1 @@
-28ad00415862586bd4877b6cb5db6b4340787728dcc570456b8c4fdc482ac498  packer_1.8.5_linux_arm64.zip
+f00a4fc221b20a166cfac8a63513054775988a068667517bb3edcfab8b1700ba  packer_1.9.4_linux_arm64.zip

builder-base/scripts/install_final.sh

@@ -79,8 +79,7 @@ if [ "${FINAL_STAGE_BASE}" = "full-copy-stage" ]; then
     yum install -y \
         gcc \
         openssl-devel \
-        pkgconfig \
-        python3-pip
+        pkgconfig 
 
     # for building containerd
     yum install -y \

builder-base/scripts/validate_components.sh

@@ -13,6 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+set -x
 set -e
 set -o pipefail
 
@@ -44,7 +45,8 @@ skopeo --version
 if [ "${FINAL_STAGE_BASE}" = "full-copy-stage" ]; then
     packer --version
     ansible --version
-
+    python3 --version
+    python --version
     node --version
 
     # validate default symlinks are correctly setup

builder-base/versions.yaml

@@ -1,5 +1,5 @@
 AMAZON_ECR_CRED_HELPER_VERSION: 0.6.0
-ANSIBLE_VERSION: 2.11.12
+ANSIBLE_VERSION: 2.15.3
 BUILDKIT_VERSION: v0.10.5
 DOCKER_BUILDX_VERSION: v0.9.1
 GITHUB_CLI_VERSION: 2.21.1
@@ -17,7 +17,7 @@ HUGO_VERSION: 0.85.0
 LINUXKIT_VERSION: v0.0.0-20220415093837-b710224cdf9a
 NODEJS_VERSION: v16.18.1
 OVERRIDE_BASH_VERSION: 4.3
-PACKER_VERSION: 1.8.5
+PACKER_VERSION: 1.9.4
 PYWINRM_VERSION: 0.4.1
 SKOPEO_VERSION: v1.5.2
 YQ_VERSION: v4.30.6