kops, Run To AWS's Door With A Parsed Cluster Spec
kops on EL 10 from the GitHub release; get_url refuses it unless its SHA-256 is in the vendor's per-asset .sha256, and the live test re-checks it, then has create -f load a Cluster manifest against a local state store and stop at the EC2 credential lookup with the metadata service off. Pinned. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-21 · podman 4.9.3 · ansible 2.21.4 · how we verify
Documentation
kops
Kubernetes kops on EL 10 from the vendor's release, checked against the
published SHA-256, pinned to a version, installed as root's binary
in /usr/local/bin. Original role for EL 10, live-tested with podman on
Rocky Linux 10.
No package worth the name. EL 10 carries no kops, and a
third-party repository is one more key to trust. This role takes the
release from kops.sigs.k8s.io, has Ansible's get_url refuse the asset unless
its SHA-256 is the published one, and the live test checks the asset on
disk against the same published value again.
Pinned. kops_version is what gets installed, kept in a directory
of its own so the checksum file and the asset it names stay together. A
newer release is a variable change and a run; the same version is
changed=0.
Proven to run. The live test runs kops create -f /tmp/kops-p/cluster.yaml --state /tmp/kops-p/state and expects
"get credentials" - the binary ran all the way to the point where it
needed something this host does not have.
Run to AWS's door with a parsed cluster spec. kops builds clusters
in a cloud account the lane does not have. The live test writes a Cluster
manifest and has kops create -f load it against a local state store:
kops parses the spec, then asks EC2 for its regions and stops at "get
credentials" with the metadata service disabled - the manifest, the state
store and the AWS client all ran. The vendor publishes one bare .sha256
per asset.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
aws-eks
Opinionated EKS cluster with node groups, core add-ons, Pod Identity, and KMS secret encryption.
ansible-aws-iam-authenticator
aws-iam-authenticator on EL 10 from the GitHub release; get_url refuses it unless its SHA-256 is in the vendor's checksums file, and the live test re-checks it, then runs token -i with no credentials and the metadata service disabled and expects it to stop at 'get credentials'. Pinned. Original role, live-tested on Rocky Linux 10.
ansible-eksctl
eksctl on EL 10 from the GitHub release, refused by Ansible's get_url unless its SHA-256 is the one in the vendor's checksums file, and re-checked by the live test, which runs eksctl get cluster with no credentials and expects it to stop at 'get credentials'. Pinned; a newer release is a variable change. Original role, live-tested on Rocky Linux 10.