Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check environment fails with IMDSv2 #192

Closed
peter-svensson opened this issue Dec 19, 2023 · 0 comments
Closed

Check environment fails with IMDSv2 #192

peter-svensson opened this issue Dec 19, 2023 · 0 comments

Comments

@peter-svensson
Copy link
Contributor

During startup a check is performed that the necessary env variables are present in the container.
If using in K8s running on EC2 instances with IMDSv2 enabled/enforced the checks will fail:

/docker-entrypoint.sh: Launching /docker-entrypoint.d/00-check-for-required-env.sh
Required S3_ACCESS_KEY_ID environment variable missing
Required S3_SECRET_KEY environment variable missing

I guess the reason for this are the following lines:

elif curl --output /dev/null --silent --head --fail --connect-timeout 2 --max-time 5 "http://169.254.169.254"; then
echo "Running inside an EC2 instance, using IMDS for credentials"

Calling the http://169.254.169.254 endpoint requires a token (which is correctly done here for example):

async function _fetchEC2RoleCredentials() {
const tokenResp = await ngx.fetch(EC2_IMDS_TOKEN_ENDPOINT, {
headers: {

I guess we need to update 00-check-for-required-env.sh to fetch the token first as well, like:

elif TOKEN=`curl -X PUT --silent --fail --connect-timeout 2 --max-time 2 "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metada
ta-token-ttl-seconds: 21600"` && curl  -H "X-aws-ec2-metadata-token: $TOKEN" --output /dev/null --silent --head --fail --connect-timeout
2 --max-time 5 "http://169.254.169.254"; then 

Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html#instance-metadata-returns

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant