Closed Volodymyr-Kuchinskyi closed 2 days ago
Voting for Prioritization
Volunteering to Work on This Issue
I would also like this feature.
Yes this would be an useful feature.
this is not controlled by Terraform - this is due to AL2023. From the EKS AMI release note on AL2023 support:
AL2023 requires IMDSv2 by default. IMDSv2 has several benefits that help improve security posture. It uses a session-oriented authentication method that requires the creation of a secret token in a simple HTTP PUT request to start the session. A session's token can be valid for anywhere between 1 second and 6 hours. For more information on how to transition from IMDSv1 to IMDSv2, see Transition to using Instance Metadata Service Version 2 and Get the full benefits of IMDSv2 and disable IMDSv1 across your AWS infrastructure. If you would like to use IMDSv1, you can still do so by manually overriding the settings using instance metadata option launch properties. For IMDSv2, the default hop count for managed node groups is set to 1. This means that containers won't have access to the node's credentials using IMDS. If you require container access to the node's credentials, you can still do so by manually overriding the HttpPutResponseHopLimit in a custom EC2 launch template, increasing it to 2, and by using EKS Pod Identity.
If you wish to change this, you will need to provide a custom launch template to your node group
With the above in mind, there's nothing for the AWS Provider team to do, so I'm going to close this issue. If you have additional requests in the future, please do let us know!
[!WARNING] This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.
Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.
Description
Recently I've updated
ami_type
of eks cluster (version1.28
) nodes from default oneAL2_x86_64
toAL2023_x86_64_STANDARD
and noticed that eksebs-csi-controller
(ebs-attacher) was not able to attach volume to the ec2 node, and I've received such an error:When I've checked the new launch template metadata options, i've noticed that HttpPutResponseHopLimit was set to 1 by default.However according to eks best practices it should be set to 2 if you need an access to IMDSv2 from the application pod itself, and for old AMI type
AL2_x86_64
it indeed was set to 2 by default, so when I switched back node group with deployed ebs-csi-controller toAL2_x86_64
, everything started to work properly again.It would be really helpful to specify all the
metadata_options
foraws_eks_node_group
resource itself for those who do not want to support their own launch_template for eks nodes.Affected Resource(s) and/or Data Source(s)
Potential Terraform Configuration
References
https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest/submodules/eks-managed-node-group#input_metadata_options
https://github.com/cloudposse/terraform-aws-eks-node-group/blob/main/README.md#input_metadata_http_put_response_hop_limit
Would you like to implement a fix?
None