"Testing if IMDS is accessible" meant "Testing if IMDS could be accessed at the network level", without intelligence on what was returned nor any distinction between IMDSv1 and IMDSv2 (see #8)
Now:
We have 2 separate tests, one for IMDSv1 and one for IMDSv2
The IMDSv1 test ensures that the response contains something - if not, it's likely that IMDSV2 is enforced and the endpoint returns a 401 error with empty content (so we're "secure")
The IMDSv2 test works similarly, but handle timeouts differently due to how IMDS responds when IMDSv2 is enforced and max-response-hop is set to 1 (the TCP connection succeeds, but the subsequent socket read times out)
Sample result on an EKS cluster that has IMDSv2 enforced (but not blocked through a NetworkPolicy or response-max-hop=1)
Before:
Now:
Sample result on an EKS cluster that has IMDSv2 enforced (but not blocked through a NetworkPolicy or response-max-hop=1)