Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

allow disabling instance metadata service #1064

Open
tareksha opened this issue Sep 17, 2024 · 0 comments
Open

allow disabling instance metadata service #1064

tareksha opened this issue Sep 17, 2024 · 0 comments
Labels
area/control-plane Control plane related kind/enhancement Enhancement, improvement, extension platform/aws Amazon web services platform/infrastructure

Comments

@tareksha
Copy link
Contributor

tareksha commented Sep 17, 2024

/area control-plane
/kind enhancement
/platform aws

What would you like to be added:

Currently the worker config for AWS shoots allows customizing the hop limits and requiring IMDSv2 (#468). However it does not allow disabling IMDS altogether. Proposed API:

apiVersion: aws.provider.extensions.gardener.cloud/v1alpha1
kind: WorkerConfig
instanceMetadataOptions:
  enabled: false # or true

Why is this needed:

Many applications that run on gardener aws cluster do not use IMDS or need.

Furthermore, applications that go through security hardening will probably have to block access to IMDS via network policies or other methods, which further adds development and maintenance efforts. Disabling IMDS improves security and reduces repetitive effort.

@gardener-robot gardener-robot added area/control-plane Control plane related kind/enhancement Enhancement, improvement, extension platform/aws Amazon web services platform/infrastructure labels Sep 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/control-plane Control plane related kind/enhancement Enhancement, improvement, extension platform/aws Amazon web services platform/infrastructure
Projects
None yet
Development

No branches or pull requests

2 participants