### Install QEMU Package

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-LOCAL.md

Installs the QEMU package required for running virtual machines locally. This is a prerequisite for the quickstart.

```shell
sudo dnf install qemu
```

--------------------------------

### Install Testsys Cluster Components

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/TESTING.md

Install the necessary components for the testsys testing system. This command should be run after setting up the 'kind' cluster and configuring kubeconfig.

```shell
cargo make setup-test
```

--------------------------------

### Example net.toml Configuration

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PROVISIONING-METAL.md

This TOML configuration demonstrates version 3 settings for network configuration, including comments.

```toml
version = 3

# Example configuration for network interfaces and VLANs

# Interface settings
# [[interfaces]]
# name = "eth0"
# miimon-updelay-ms = 100
# miimon-downdelay-ms = 100
# arpmon-interval-ms = 1000
# arpmon-validate = "active"
# arpmon-targets = ["192.168.1.1/24"]

# VLAN configuration
# [[interfaces]]
# kind = "vlan"
# device = "eth0"
# id = 100
# ip = "192.168.100.10/24"
# gateway = "192.168.100.1"

```

--------------------------------

### Example Instance Profile Name

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-EKS.md

An example of what an instance profile name might look like, typically generated by eksctl.

```text
eksctl-bottlerocket-nodegroup-ng-IDENTIFIER-NodeInstanceProfile-IDENTIFIER
```

--------------------------------

### Install Ubuntu Build Dependencies

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Installs essential packages required for building on Ubuntu systems.

```shell
apt install build-essential openssl libssl-dev pkg-config liblz4-tool
```

--------------------------------

### Install tuftool

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Install the tuftool utility, which is required for downloading Bottlerocket kmod kits. This command uses cargo to install the tool.

```shell
cargo install tuftool
```

--------------------------------

### Install cargo-make

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Installs the cargo-make tool, used for organizing build tasks in Rust projects.

```shell
cargo install cargo-make
```

--------------------------------

### Set Release Start Time for Repository

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PUBLISHING.md

Specifies the ISO 8601 formatted start time for a release, useful for preparing new versions in advance.

```shell
RELEASE_START_TIME="$(date '+%Y-%m-%dT%H:%M:%S%:z' -d 'Monday 10am')"
cargo make -e "RELEASE_START_TIME=${RELEASE_START_TIME}" repo
```

--------------------------------

### Example Bottlerocket Boot Configuration

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PROVISIONING-METAL.md

Defines kernel and init arguments for Bottlerocket's boot configuration initrd. Use this to set console devices and systemd log levels.

```ini
kernel {
    console = tty0, "ttyS1,115200n8"
}
init {
    systemd.log_level = debug
}
```

--------------------------------

### Configure Default Repo with Local Signing Key

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PUBLISHING.md

Example TOML configuration for a default repository, specifying the root role URL, its SHA512 checksum, and the path to a local signing key file.

```toml
[repo.default]
root_role_url = "https://example.com/root.json"
root_role_sha512 = "0123456789abcdef"
signing_keys = { file = { path = "/home/user/key.pem" } }
```

--------------------------------

### Install Fedora Build Dependencies

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Installs essential packages required for building on Fedora systems.

```shell
yum install make automake gcc openssl openssl-devel pkg-config lz4 perl-FindBin perl-lib
```

--------------------------------

### Create Bottlerocket Boot Configuration Initrd

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PROVISIONING-METAL.md

Uses the Bottlerocket SDK Docker image to create a boot configuration initrd. Ensure Docker is installed and the `bootconfig-input` file exists.

```shell
ARCH=$(uname -m)
SDK_VERSION="v0.26.0"
SDK_IMAGE="public.ecr.aws/bottlerocket/bottlerocket-sdk-${ARCH}:${SDK_VERSION}"

touch $(pwd)/bootconfig.data

docker run --rm \
   --network=none \
   --user "$(id -u):$(id -g)" \
   --security-opt label=disable \
   -v $(pwd)/bootconfig-input:/tmp/bootconfig-input \
   -v $(pwd)/bootconfig.data:/tmp/bootconfig.data \
   "${SDK_IMAGE}" \
   bootconfig -a /tmp/bootconfig-input /tmp/bootconfig.data
```

--------------------------------

### Launch Local Bottlerocket VM

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-LOCAL.md

Starts a local Bottlerocket VM using the start-local-vm script. It injects the net.toml and user-data.toml configuration files into the VM's private partition. The architecture is automatically detected.

```shell
./tools/start-local-vm --variant metal-dev --arch $(uname -m) --inject-file net.toml --inject-file user-data.toml
```

--------------------------------

### Configure Repo with KMS Signing Key

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PUBLISHING.md

Example TOML configuration for a repository using an AWS KMS key for signing. The `key_id` specifies the identifier for the KMS key.

```toml
signing_keys = { kms = { key_id = "abc-def-123" } }
```

--------------------------------

### Configure Custom Repo URLs at Runtime

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PUBLISHING.md

Set custom repository URLs in user data for Bottlerocket hosts. This example shows how to configure S3 bucket locations for targets and metadata.

```toml
[settings.updates]
targets-base-url = "https://my-bucket.s3-us-west-2.amazonaws.com/targets/"
metadata-base-url = "https://my-bucket.s3-us-west-2.amazonaws.com/aws-k8s-1.32/x86_64/"
```

--------------------------------

### Abbreviated Bottlerocket Settings Response

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/README.md

An example of an abbreviated JSON response showing current Bottlerocket settings. This illustrates the structure of the data returned by the 'apiclient get settings' command.

```json
{"motd": "...", {"kubernetes": {}}}
```

--------------------------------

### Configure Repo with SSM Signing Key

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PUBLISHING.md

Example TOML configuration for a repository using an AWS SSM Parameter Store parameter for signing. The `parameter` field specifies the name of the SSM parameter.

```toml
signing_keys = { ssm = { parameter = "/my/parameter" } }
```

--------------------------------

### Run a Busybox Pod on EKS

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-EKS.md

After setting up your EKS cluster with Bottlerocket nodes, you can use `kubectl` to deploy and manage pods. This example demonstrates running a simple busybox pod.

```shell
kubectl run -i -t busybox --image=busybox --restart=Never
```

--------------------------------

### Set User Data via VMware Guestinfo

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Encode user data to base64 and set it for Bottlerocket VMs using the `govc vm.change` command. Ensure these values are set before the VM starts for the first time.

```shell
export BR_USERDATA=$(base64 -w0 user-data.toml)

for node in 1 2 3; do
  govc vm.change -vm "${VM_NAME}-${node}" \
    -e guestinfo.userdata="${BR_USERDATA}" \
    -e guestinfo.userdata.encoding="base64"
done
```

--------------------------------

### Start SSM Session via AWS CLI

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/README.md

Use this command to initiate an AWS Systems Manager session with a Bottlerocket instance using the AWS CLI and session-manager-plugin.

```shell
aws ssm start-session --target INSTANCE_ID --region REGION_CODE
```

--------------------------------

### Download Bottlerocket bare metal image with tuftool

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PROVISIONING-METAL.md

Download the specified Bottlerocket bare metal image using tuftool. Ensure Rust and tuftool are installed. Adjust ARCH, VERSION, and VARIANT as needed.

```shell
ARCH="x86_64"
VERSION="v1.26.1" # New releases do not have metal-k8s variants
VARIANT="metal-k8s-1.28"
IMAGE="bottlerocket-${VARIANT}-${ARCH}-${VERSION}.img.lz4"
OUTDIR="${VARIANT}-${VERSION}"

tuftool download "${OUTDIR}" --target-name "${IMAGE}" \
   --root ./root.json \
   --metadata-url "https://updates.bottlerocket.aws/2020-07-07/${VARIANT}/x86_64/" \
   --targets-url "https://updates.bottlerocket.aws/targets/"
```

--------------------------------

### Run Bottlerocket Migration Test

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/TESTING.md

Executes the migration test using testsys. It automatically determines the starting AMI and migrates instances to the target version. Ensure necessary environment variables are set.

```shell
cargo make -e TESTSYS_TEST=migration test
```

--------------------------------

### Create NVIDIA Licenses TOML File

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Create a Licenses.toml file in the Bottlerocket root directory to specify NVIDIA license information. This is required before fetching licenses.

```toml
[nvidia]
spdx-id = "LicensesRef-NVIDIA-Customer-Use"
licenses = [
  { path = "LICENSE", license-url = "https://www.nvidia.com/en-us/drivers/nvidia-license/" }
]
```

--------------------------------

### Prepare Initial Bottlerocket Version for Migration

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/TESTING.md

Checks out a specific Bottlerocket version, builds it, creates AMI artifacts, and builds the TUF repository for migration testing.

```shell
git checkout "v1.9.0"
cargo make
cargo make ami
cargo make repo
```

--------------------------------

### Reboot System

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/README.md

Immediately reboots the Bottlerocket host. This is often used after an update has been applied to start the system with the new version.

```shell
apiclient reboot
```

--------------------------------

### Configure Package Licenses (Simple)

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Defines license information for a package, specifying the SPDX ID and a local license file.

```toml
[package]
spdx-id = "SPDX-ID"
licenses = [
  { path = "the-license.txt" }
]
```

--------------------------------

### Get Cluster Certificate Authority Data

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Retrieves the base64 encoded cluster certificate authority data from kubectl configuration.

```shell
export CLUSTER_CERTIFICATE="$(kubectl config view --raw -o=jsonpath='{.clusters[0].cluster.certificate-authority-data}')"
```

--------------------------------

### Retrieve EKS IAM Identity Mapping

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-EKS.md

Get the ARN of the IAM role created by eksctl for the EKS cluster nodegroup. Note down the INSTANCE_ROLE_NAME.

```shell
eksctl get iamidentitymapping --region us-west-2 --cluster bottlerocket
```

--------------------------------

### Launch Bottlerocket Instance on EKS

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-EKS.md

This command launches a Bottlerocket instance. Remember to replace placeholders like YOUR_KEY_NAME, SUBNET_ID, SECURITY_GROUP_ID_1, SECURITY_GROUP_ID_2, BOTTLEROCKET_AMI_ID, INSTANCE_PROFILE_NAME, and the user-data file path with your specific values. For public subnets, consider adding --associate-public-ip-address.

```shell
aws ec2 run-instances --key-name YOUR_KEY_NAME \
   --subnet-id SUBNET_ID \
   --security-group-ids SECURITY_GROUP_ID_1 SECURITY_GROUP_ID_2 \
   --image-id BOTTLEROCKET_AMI_ID \
   --instance-type c7.large \
   --region us-west-2 \
   --tag-specifications 'ResourceType=instance,Tags=[{Key=kubernetes.io/cluster/bottlerocket,Value=owned}]' \
   --user-data file://user-data.toml \
   --iam-instance-profile Name=INSTANCE_PROFILE_NAME
```

--------------------------------

### Kubernetes Pod Spec for Neuron Resources

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-EKS.md

Example Kubernetes pod specification requesting Neuron resources and configuring security context for device ownership.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  hostNetwork: true
  securityContext:
    runAsUser: 1001
    runAsGroup: 2001
    fsGroup: 3001
  restartPolicy: OnFailure
  containers:
  - name: test
    image: amazonlinux:2023
    resources:
      limits:
        aws.amazon.com/neuron: "1"

```

--------------------------------

### Get Current Bottlerocket Settings

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/README.md

Use the apiclient to retrieve all current settings in JSON format. This is useful for inspecting the current state of your Bottlerocket instance.

```shell
apiclient get settings
```

--------------------------------

### Get Subnet Information for EKS

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-EKS.md

Retrieve information about subnets created by eksctl, indicating whether they are public or private. Change the region if not using 'us-west-2'.

```shell
aws ec2 describe-subnets \
   --subnet-ids $(eksctl get cluster --region us-west-2 --name bottlerocket -o json | jq --raw-output '.[].ResourcesVpcConfig.SubnetIds[]') \
   --region us-west-2 \
   --query "Subnets[].[SubnetId, Tags[?Key=='aws:cloudformation:logical-id'].Value]" \
   | xargs -L2
```

--------------------------------

### Get Kubernetes Cluster DNS IP

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Retrieve the IP address of the kube-dns service in the kube-system namespace. This is required for DNS resolution within the cluster.

```shell
export CLUSTER_DNS_IP="$(kubectl -n kube-system get svc -l k8s-app=kube-dns -o=jsonpath='{.items[0].spec.clusterIP}')"
```

--------------------------------

### Apply Update and Reboot

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/README.md

Combines checking for the latest update, applying it, and initiating a reboot in a single command. This is a convenient way to perform a full update cycle.

```shell
apiclient update apply --check --reboot
```

--------------------------------

### Get Kubernetes API Server Address

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Extract the API server address from the kubectl configuration. This is needed for Bottlerocket nodes to connect to the Kubernetes control plane.

```shell
export API_SERVER="$(kubectl config view -o jsonpath='{.clusters[0].cluster.server}')"
```

--------------------------------

### Create Bottlerocket User Data TOML

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Creates a user-data.toml file with Kubernetes API server details, DNS IP, bootstrap token, and cluster certificate.

```shell
cat <<EOF > user-data.toml
[settings.kubernetes]
api-server = "${API_SERVER}"
cluster-dns-ip = "${CLUSTER_DNS_IP}"
bootstrap-token = "${BOOTSTRAP_TOKEN}"
cluster-certificate = "${CLUSTER_CERTIFICATE}"
EOF
```

--------------------------------

### Conditional SSM Parameter Template

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/tools/pubsys/policies/ssm/README.md

Define an SSM parameter that is only populated for specific variants and architectures. This example sets a special parameter for 'aarch64' builds of the 'aws-ecs-2' variant.

```toml
[[parameter]]
arch = ["aarch64"]
variant = ["aws-ecs-2"]
name = "/a/special/aarch64/ecs/parameter"
value = "{image_name}"
```

--------------------------------

### Prepare Target Bottlerocket Version for Migration

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/TESTING.md

Checks out the target Bottlerocket version (e.g., 'develop'), builds it, creates AMI artifacts, and builds the TUF repository for migration testing. Architecture and variant can be configured with BUILDSYS_ARCH and BUILDSYS_VARIANT.

```shell
WORKING_BRANCH="develop"
git checkout "${WORKING_BRANCH}"
cargo make
cargo make ami
cargo make repo
```

--------------------------------

### Retrieve Instance Profile Name

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-ECS.md

Get the instance profile name associated with your IAM role, which is needed for launching instances. Replace INSTANCE_ROLE_NAME with your role's name.

```shell
aws iam list-instance-profiles-for-role --role-name INSTANCE_ROLE_NAME --query "InstanceProfiles[*].InstanceProfileName" --output text
```

--------------------------------

### Download Kmod Kit with tuftool

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Download a specific Bottlerocket kmod kit using tuftool. Set ARCH, VERSION, and VARIANT variables to specify the desired kit. The output is saved to a tar.xz file.

```shell
ARCH=x86_64
VERSION=v1.31.0
VARIANT=aws-k8s-1.32
OUTDIR="${VARIANT}-${VERSION}"

tuftool download "${OUTDIR}" --target-name ${VARIANT}-${ARCH}-kmod-kit-${VERSION}.tar.xz \
   --root ./root.json \
   --metadata-url "https://updates.bottlerocket.aws/2020-07-07/${VARIANT}/${ARCH}/" \
   --targets-url "https://updates.bottlerocket.aws/targets/"
```

--------------------------------

### Sample Variant Directory Structure

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/variants/README.md

This shows the basic directory structure for a custom Bottlerocket variant.

```text
variants/my-variant
└── Cargo.toml
```

--------------------------------

### Describe Subnets in VPC

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-ECS.md

Get information about subnets within a specific VPC, including their IDs and public/private status. Replace VPC_ID with your VPC's ID and ensure the region is correct.

```shell
aws ec2 describe-subnets \
   --region us-west-2 \
   --filter=Name=vpc-id,Values=VPC_ID \
   | jq '.Subnets[] | {id: .SubnetId, public: .MapPublicIpOnLaunch, az: .AvailabilityZone}'
```

--------------------------------

### Apply Latest Update

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/README.md

Initiates the process to apply the latest available update. The system will migrate configurations and reboot into the new version upon the next system restart.

```shell
apiclient update apply
```

--------------------------------

### Verify User Data Setting

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Check if the user data was successfully set on a Bottlerocket VM using the `govc vm.info` command with the `-e` and `-r` flags.

```shell
govc vm.info -e -r -t "${VM_NAME}-1"
```

--------------------------------

### Set Bottlerocket Settings via API Client

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/README.md

Modify specific Bottlerocket settings using the apiclient command-line tool. This example demonstrates setting the message of the day and a Kubernetes node label.

```shell
apiclient set motd="hi there" kubernetes.node-labels.environment=test
```

--------------------------------

### Fetch Licenses with Cargo Make

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Use cargo make to fetch licenses, including those for NVIDIA variants. Ensure the BUILDSYS_UPSTREAM_LICENSE_FETCH environment variable is set.

```shell
cargo make -e BUILDSYS_UPSTREAM_LICENSE_FETCH=true fetch-licenses
```

--------------------------------

### Build with Accelerated Wave Policy

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PUBLISHING.md

Use this command to build a Bottlerocket repository with an accelerated update schedule. This is useful for more urgent deployments.

```shell
cargo make -e PUBLISH_WAVE_POLICY_PATH=sources/updater/waves/accelerated-waves.toml repo
```

--------------------------------

### Create a Temporary Kind Cluster

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/TESTING.md

Set up a temporary Kubernetes cluster using 'kind' for testing purposes. This cluster is intended for developer workflows and should not be shared.

```shell
kind create cluster --name testsys
```

--------------------------------

### Update Network in Spec and Import OVA

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Use jq to update the NetworkMapping.Network field in the spec file with the GOVC_NETWORK environment variable, then import the OVA using govc.

```shell
VM_NAME="bottlerocket-quickstart-${VERSION}"

jq --arg network "${GOVC_NETWORK}" 
  '.NetworkMapping[].Network = $network'
  bottlerocket_spec.json > bottlerocket_spec_edit.json

govc import.ova -options=bottlerocket_spec_edit.json -name="${VM_NAME}" "${OUTDIR}/${OVA}"
```

--------------------------------

### List Bottlerocket Boot Configuration Initrd Contents

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PROVISIONING-METAL.md

Validates the format and lists the contents of a Bottlerocket boot configuration initrd using the SDK Docker image. This command helps verify the created `bootconfig.data` file.

```shell
ARCH=$(uname -m)
SDK_VERSION="v0.26.0"
SDK_IMAGE="public.ecr.aws/bottlerocket/bottlerocket-sdk-${ARCH}:${SDK_VERSION}"

docker run --rm \
   --network=none \
   --user "$(id -u):$(id -g)" \
   --security-opt label=disable \
   -v $(pwd)/bootconfig.data:/tmp/bootconfig.data \
   "${SDK_IMAGE}" \
   bootconfig -l /tmp/bootconfig.data
```

--------------------------------

### Configure Neuron Devices in ECS Task Definition

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-ECS.md

Define Neuron device mappings and capabilities in your ECS task definition for Neuron Instance Types. This example maps `/dev/neuron0` and adds `IPC_LOCK` capability.

```json
{
  "containerDefinitions": [
      {
         "linuxParameters": 
            {
                     "devices": [
                        {
                              "containerPath": "/dev/neuron0",
                              "hostPath": "/dev/neuron0",
                              "permissions": [
                                 "read",
                                 "write"
                              ]
                        }
                     ],
                     "capabilities": {
                        "add": [
                           "IPC_LOCK"
                              
                        ]
                     }
            },
      }
   ]
}
```

--------------------------------

### Configure GPU Resources in ECS Task Definition

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-ECS.md

Specify GPU resource requirements for containers in your ECS task definition when using `aws-ecs-*-nvidia` variants. This example shows how to request 2 GPUs for a container.

```json
{
  "containerDefinitions": [
     {
        "resourceRequirements" : [
            {
               "type" : "GPU",
               "value" : "2"
            }
        ]
     }
  ]
}
```

--------------------------------

### Prepare Control Container User Data

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-LOCAL.md

Extracts the Activation ID and Code from the SSM activation output, formats them into a JSON object, base64 encodes it, and appends it to the user-data.toml file for the control container.

```shell
SSM_ACTIVATION_ID="$(jq -r '.ActivationId' <<< ${SSM_ACTIVATION})"
SSM_ACTIVATION_CODE="$(jq -r '.ActivationCode' <<< ${SSM_ACTIVATION})"
CONTROL_USER_DATA="$(echo '{"ssm": {"activation-id": "'${SSM_ACTIVATION_ID}'", "activation-code": "'${SSM_ACTIVATION_CODE}'", "region": "us-west-2"}}' | base64 -w0)"

cat <<EOF >>user-data.toml
[settings.host-containers.control]
enabled = true
user-data = "${CONTROL_USER_DATA}"
source = "public.ecr.aws/bottlerocket/bottlerocket-control:v0.6.1"
EOF
```

--------------------------------

### Generate Local Secure Boot Keys Profile

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/sbkeys/README.md

Use this command to generate a local Secure Boot Keys profile using openssl, gpg, and virt-fw-vars. Dependencies are run within a container. This profile is not recommended for production.

```shell
# replace v0.61.0 with the current SDK version
SDK_VERSION="v0.61.0"
./generate-local-sbkeys \
  --sdk-image "public.ecr.aws/bottlerocket/bottlerocket-sdk:${SDK_VERSION}" \
  --output-dir "${PWD}/my-local-profile"
```

--------------------------------

### Kubernetes Pod Security Policy

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/SECURITY_GUIDANCE.md

This Pod Security Policy is designed to enforce security best practices for pods. It restricts privileged access, drops all capabilities, and enforces specific user and group IDs. Use this as a starting point for your own security policies.

```yaml
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted-psp

  # Ensure that the default seccomp filter is used.
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'

spec:
  # Do not allow containers to run as privileged.
  privileged: false

  # Do not allow containers to gain new privileges.
  allowPrivilegeEscalation: false

  # Remove all capabilities from the default set.
  requiredDropCapabilities:
    - ALL

  # Run all containers with the less privileged container_t label.
  seLinux:
    rule: 'MustRunAs'
    seLinuxOptions:
      user: system_u
      role: system_r
      type: container_t
      level: s0

  # Do not allow containers to run as any system user.
  runAsUser:
    rule: 'MustRunAs'
    ranges:
      - min: 1000
        max: 65535

  # Do not allow containers to run as any system group.
  runAsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1000
        max: 65535

  # Do not allow containers to add other system groups.
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1000
        max: 65535

  # Do not allow containers to use other system groups for volumes.
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1000
        max: 65535

  # Do not allow containers to share host namespaces.
  hostNetwork: false
  hostIPC: false
  hostPID: false

  # Do not allow containers to use or write to host paths.
  allowedHostPaths:
    - pathPrefix: "/tmp"
      readOnly: true

  # Allow minimal set of core volume types.
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'

```

--------------------------------

### Clone Bottlerocket VMs from Template

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Clone three Bottlerocket VMs from the template created in the previous step. The VMs are cloned but left powered off to allow for user data configuration.

```shell
for node in 1 2 3; do
  govc vm.clone -vm "${VM_NAME}" -on=false "${VM_NAME}-${node}"
done
```

--------------------------------

### Configure Package Licenses (Multiple/Remote)

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Configures license information for packages with multiple licenses or licenses fetched from remote URLs. It specifies local paths for saving fetched licenses.

```toml
[package]
spdx-id = "SPDX-ID AND SPDX-ID-2" # Package with multiple licenses
licenses = [
  # This file is copied from a file system, and will be saved as `path`
  { license-url = "file:///path/to/spdx-id-license.txt", path = "spdx-id-license.txt" },
  # This file is fetched from an https endpoint, and will be saved as `path`
  { license-url = "https://localhost/spdx-id-license-v2.txt", path = "spdx-id-license-2.txt" }
]
```

--------------------------------

### Build and Register Bottlerocket AMI

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PUBLISHING-AWS.md

Use the 'cargo make ami' command to build and register a Bottlerocket AMI. You can customize the AMI name and description using environment variables.

```shell
cargo make ami

```

```shell
cargo make -e PUBLISH_AMI_NAME=my-name -e PUBLISH_AMI_DESCRIPTION=my-desc ami

```

--------------------------------

### Specify Build Variant and Architecture

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PUBLISHING.md

Pass variant and architecture arguments to `cargo make` commands if you built your image for a different configuration.

```shell
cargo make -e BUILDSYS_VARIANT=my-variant -e BUILDSYS_ARCH=my-arch
```

--------------------------------

### Run Custom Test with Cargo Make and YAML

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/TESTING.md

After building the agent and creating the YAML file, run the custom test using `cargo make` with the specified test name and YAML file path.

```shell
cargo make -e TESTSYS_TEST=<CUSTOM-TEST-NAME> test -f <PATH-TO-YAML-FILE>
```

--------------------------------

### Launch Bottlerocket VMs

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Power on the Bottlerocket VMs using the `govc vm.power` command after configuring their user data.

```shell
for node in 1 2 3; do
  govc vm.power -on "${VM_NAME}-${node}"
done
```

--------------------------------

### Build Default Bottlerocket Image

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Initiates the build process for the default Bottlerocket OS image variant. The output image will be located in the 'build/images/' directory.

```shell
cargo make
```

--------------------------------

### Run aws-k8s Tests

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/TESTING.md

Execute tests for the `aws-k8s` variant. This command initiates the testing process after building and creating the AMI.

```shell
cargo make \
  -e BUILDSYS_VARIANT="aws-k8s-1.32" \
  -e BUILDSYS_ARCH="x86_64" \
  test
```

--------------------------------

### Mark OVA as Template

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Mark the imported Bottlerocket VM as a template in vSphere using govc vm.markastemplate. This allows for efficient cloning of multiple identical VMs.

```shell
govc vm.markastemplate "${VM_NAME}"
```

--------------------------------

### Launch Bottlerocket Instance with AWS CLI

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-ECS.md

Use this command to launch a Bottlerocket EC2 instance. Ensure you replace placeholders like YOUR_KEY_NAME, SUBNET_ID, BOTTLEROCKET_AMI_ID, and INSTANCE_PROFILE_NAME with your specific values. If using a public subnet, consider adding `--associate-public-ip-address`.

```shell
aws ec2 run-instances --key-name YOUR_KEY_NAME \
   --subnet-id SUBNET_ID \
   --image-id BOTTLEROCKET_AMI_ID \
   --instance-type c7.large \
   --region us-west-2 \
   --tag-specifications 'ResourceType=instance,Tags=[{Key=bottlerocket,Value=quickstart}]' \
   --user-data file://user-data.toml \
   --iam-instance-profile Name=INSTANCE_PROFILE_NAME
```

--------------------------------

### Upload VM Template with Overridden Datacenters

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PUBLISHING-VMWARE.md

Override the default list of datacenters for uploading a VM template by setting the `VMWARE_DATACENTERS` environment variable. The datacenters should be comma-separated.

```shell
cargo make vmware-template \
  -e BUILDSYS_VARIANT=vmware-k8s-1.32 \
  -e VMWARE_DATACENTERS="foo,bar"
```

--------------------------------

### Check for Available Updates

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/README.md

Use this command to see which system updates are available for your Bottlerocket host. The output will indicate the `chosen_update` and list all `available_updates`.

```shell
apiclient update check
```

--------------------------------

### Enable Bottlerocket Control Container

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/QUICKSTART-VMWARE.md

Enables the control container by generating base64 encoded user data with SSM activation ID, code, and region. Requires jq to parse SSM_ACTIVATION output.

```shell
SSM_ACTIVATION_ID="$(jq -r '.ActivationId' <<< ${SSM_ACTIVATION})"
SSM_ACTIVATION_CODE="$(jq -r '.ActivationCode' <<< ${SSM_ACTIVATION})"
CONTROL_USER_DATA="$(echo '{"ssm":{"activation-id":"'${SSM_ACTIVATION_ID}'","activation-code":"'${SSM_ACTIVATION_CODE}'","region":"us-west-2"}}' | base64 -w0)"

cat <<EOF >>user-data.toml
[settings.host-containers.control]
enabled = true
user-data = "${CONTROL_USER_DATA}"
EOF
```

--------------------------------

### Upload Bottlerocket OVA as VM Template

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/PUBLISHING-VMWARE.md

This command uploads the Bottlerocket OVA directly as a VM template in VMware. Set the `BUILDSYS_VARIANT` environment variable.

```shell
cargo make -e BUILDSYS_VARIANT=vmware-k8s-1.32 vmware-template
```

--------------------------------

### Specify Custom Secure Boot Keys Directory and Profile

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/sbkeys/README.md

Set both BUILDSYS_SBKEYS_DIR and BUILDSYS_SBKEYS_PROFILE environment variables to use a custom Secure Boot Keys profile located in a different directory.

```shell
cargo make \
  -e BUILDSYS_SBKEYS_DIR="${HOME}/my-sbkeys" \
  -e BUILDSYS_SBKEYS_PROFILE=my-custom-profile
```

--------------------------------

### Download Bottlerocket Root JSON

Source: https://github.com/bottlerocket-os/bottlerocket/blob/develop/BUILDING.md

Download the Bottlerocket root.json file, which is used by tuftool to verify the integrity of the kmod kit. Verify the download using sha512sum.

```shell
curl -O "https://cache.bottlerocket.aws/root.json"
sha512sum -c <<<"4fcb272345fd6adb94d4c04834400548178fecb57407ca79bc2c3d20e0428fc9ed3a82cea268d7f9c667b5803524a4f465acd701a86953d5d732bf6ecb064888  root.json"
```