search

concourse / docker-image-resource

a resource for docker images
Apache License 2.0
166 stars 260 forks source link

Is IMDS v2 or IRSA supported? #340

Open snakebyte91 opened 2 years ago

snakebyte91 commented 2 years ago

I need to force the usage of Instance Metadata Service v2 for my EKS nodes in AWS. With v1 docker-image-resource is able to pull images from ECR with the instance role. With v2 docker-image-resource seems not be able to use the instance role.

A other solution is to use IAM roles for service accounts (IRSA) in AWS. But this also does not work.

resource_types:
  - name: example
    type: docker-image
    source:
      repository: <account_id>.dkr.ecr.eu-central-1.amazonaws.com/<repository_name>
      tag: 0.0.1

Error messages: IMDS v2: ...credentials not found in native keychain... IRSA: ...401 not authorized...

airport533 commented 1 year ago

Hi

Any update on this please as I am having the same issues?

Thanks

pablokbs commented 1 year ago

For anyone that gets to this issue in the future, I have concourse running in Kubernetes with IMDSv2 enabled. The key was to set metadata_http_put_response_hop_limit to 3. Per the AWS doc

image