locals {
  aws_ami_name         = "bottlerocket"
  aws_ami_architecture = "x86_64"
  aws_ami_type         = "${upper(local.aws_ami_name)}_${local.aws_ami_architecture}"
}

data "aws_ssm_parameter" "eks_ami_image_version" {
  name = "/aws/service/${local.aws_ami_name}/aws-k8s-${aws_eks_cluster.eks.version}/${local.aws_ami_architecture}/latest/image_version"
}

resource "aws_eks_node_group" "blue-green-group" {
...
  ami_type        = local.aws_ami_type
  release_version = data.aws_ssm_parameter.eks_ami_image_version.value
...

  lifecycle {
    ignore_changes        = [release_version]
...
  }

ip-10-1-33-89.ec2.internal    NotReady   <none>   0s      v1.30.5-eks-baa6d11
ip-10-1-33-89.ec2.internal    NotReady   <none>   0s      v1.30.5-eks-baa6d11
ip-10-1-33-89.ec2.internal    NotReady   <none>   0s      v1.30.5-eks-baa6d11
ip-10-1-33-89.ec2.internal    NotReady   <none>   1s      v1.30.5-eks-baa6d11
ip-10-1-33-89.ec2.internal    NotReady   <none>   1s      v1.30.5-eks-baa6d11
ip-10-1-33-89.ec2.internal    NotReady   <none>   1s      v1.30.5-eks-baa6d11
ip-10-1-33-89.ec2.internal    NotReady   <none>   1s      v1.30.5-eks-baa6d11
ip-10-1-33-89.ec2.internal    NotReady   <none>   10s     v1.30.5-eks-baa6d11
ip-10-1-33-89.ec2.internal    Ready      <none>   13s     v1.30.5-eks-baa6d11

ip-10-1-34-52.ec2.internal    NotReady   <none>   0s      v1.30.5-eks-baa6d11
ip-10-1-34-52.ec2.internal    NotReady   <none>   0s      v1.30.5-eks-baa6d11
ip-10-1-34-52.ec2.internal    NotReady   <none>   0s      v1.30.5-eks-baa6d11
ip-10-1-34-52.ec2.internal    NotReady   <none>   0s      v1.30.5-eks-baa6d11
ip-10-1-34-52.ec2.internal    NotReady   <none>   0s      v1.30.5-eks-baa6d11
ip-10-1-34-52.ec2.internal    NotReady   <none>   0s      v1.30.5-eks-baa6d11
ip-10-1-34-52.ec2.internal    NotReady   <none>   0s      v1.30.5-eks-baa6d11
ip-10-1-34-52.ec2.internal    NotReady   <none>   5s      v1.30.5-eks-baa6d11
ip-10-1-34-52.ec2.internal    NotReady   <none>   10s     v1.30.5-eks-baa6d11
ip-10-1-34-52.ec2.internal    Ready      <none>   14s     v1.30.5-eks-baa6d11

memory.available: "100Mi" 
nodefs.available: "10%" 
nodefs.inodesFree: "5%" 
imagefs.available: "15%"

apiclient -u /settings | jq

[settings.kubernetes]
api-server = "${endpoint}"
cluster-certificate = "${cluster_auth_base64}"
cluster-name = "${cluster_name}"
pod-pids-limit = 1024
image-gc-high-threshold-percent = 85
image-gc-low-threshold-percent = 80
container-log-max-files = 50
container-log-max-size = "100Mi"
[settings.kubernetes.system-reserved]
cpu = "200m"
ephemeral-storage = "1Gi"
memory = "1Gi"
[settings.kubernetes.kube-reserved]
memory = "893Mi"
[settings.kernel]
lockdown = "integrity"
[settings.host-containers.admin]
enabled = ${enable_admin_container}
[settings.host-containers.control]
enabled = ${enable_control_container}
[settings.kubernetes.eviction-hard]
"memory.available" = "1Gi"
"nodefs.available" = "20%"
"nodefs.inodesFree" = "5%"
"imagefs.available" = "15%"
[settings.kubernetes.eviction-soft]
"memory.available" = "10%"
[settings.kubernetes.eviction-soft-grace-period]
"memory.available" = "30s"

resource "aws_launch_template" "node-launch-template" {
...
  user_data = base64encode(templatefile("${path.module}/../../templates/bottlerocket.tpl",
    {
      "cluster_name"             = aws_eks_cluster.eks.name #обязательный параметр!!!
      "endpoint"                 = aws_eks_cluster.eks.endpoint #обязательный параметр!!!
      "cluster_auth_base64"      = aws_eks_cluster.eks.certificate_authority[0].data #обязательный параметр!!!
      "aws_region"               = var.AWS_DEFAULT_REGION #обязательный параметр!!!
      "enable_admin_container"   = false
      "enable_control_container" = true
    }
  ))
}

The node had condition: [DiskPressure].
The node was low on resource: ephemeral-storage. Threshold quantity: 4281126156, available: 3438556Ki

resource "aws_launch_template" "node-launch-template" {
...
  block_device_mappings {
    device_name = "/dev/xvda"
    ebs {
      volume_size = 200
      volume_type = "gp3"
    }
  }
...

  lifecycle {
    ignore_changes 

kubectl get nodes -o yaml | grep -i -A6 ephemeral-storage

resource "aws_launch_template" "node-launch-template" {
...
# !!! вот тут много не надо, это для самой ноды, операционка, можно хоть 10
  block_device_mappings {
    device_name = "/dev/xvda"
    ebs {
      volume_size = 20
      volume_type = "gp3"
    }
  }
# !!! вот это добавляем, для POD-ов
  block_device_mappings {
    device_name = "/dev/xvdb"
    ebs {
      volume_size = 200
      volume_type = "gp3"
    }
  }

kubectl get nodes -o yaml | grep -i -A6 ephemeral-storage

# Доступ к системным логам, получению root-оболочки (sheltie), запуску journalctl, logdog и пр.
[settings.host-containers.admin]
enabled = true

# Доступ к Bottlerocket API для настроек и диагностики, но без глубокого доступа к логам и файловой системе ноды.
[settings.host-containers.control]
enabled = true

kubectl get pods -o wide | grep podname
...  ip-10-1-114-226.ec2.internal ...

kubectl get node -o yaml ip-10-1-114-226.ec2.internal | grep -A4 -i "nodeid"
... "i-09cd72826bee50209" ...

aws ssm start-session --target i-09cd72826bee50209

enter-admin-container

[root@admin]# sudo sheltie

ls /var/log/containers/
argo-cd-argocd-application-controller-0_argo-cd_application-controller-dfb4d12f601e71ac373b30bfaad8d02b56141218e7bcc5f1358f3a7d8f7df7f7.log
...

cat argo-cd-argocd-application-controller-0_argo-cd_application-controller-dfb4d12f601e71ac373b30bfaad8d02b56141218e7bcc5f1358f3a7d8f7df7f7.log

bash-5.1# logdog

logs are at: /var/log/support/bottlerocket-logs.tar.gz

kubectl get --raw "/api/v1/nodes/ip-10-1-114-226.ec2.internal/proxy/logs/support/bottlerocket-logs.tar.gz" > ./bottlerocket-logs.tar.gz