[EKS Controller] IMDSv2 for node groups

[gecube]

Good day!

It is mandatory for many regulated business to select by default IMDSv2 on EC2 instances.
Even Amazon itself recommends to enable this setting:

Unfortunately, NodeGroup API does not support it at all.

https://aws-controllers-k8s.github.io/community/reference/eks/v1alpha1/nodegroup/

Despite the terraform provider https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest/submodules/eks-managed-node-group#input_metadata_options

[github-actions]

Hello @gecube 👋 Thank you for opening an issue in ACK! A maintainer will triage this issue soon.

We encourage community contributions, so if you're interested in tackling this yourself or suggesting a solution, please check out our Contribution and Code of Conduct guidelines.

You can find more information about ACK on our website.

[gecube]

related issues:

aws/aws-cdk#31124
hashicorp/terraform-provider-aws#38516

[michaelhtm]

Hi @gecube
It seems like there is no clear way to resolve this right now.
As you mentioned, this is not supported by the API, and the controller is limited to it.
cc: @rushmash91 @a-hilaly

[gecube]

@michaelhtm sorry to hear it, so it means that it should be clearly described how to get the working EKS cluster from the scratch with creating the proper EC2 launch template and then utilise it in EKS api.

[rushmash91]

Hi @gecube,

Yes, that is a great idea!

We can document how to create a nodegroup with a launchtemplate that have the parameters set up with the appropiate hop count in the launch template(we already support those for EC2):

something like this

spec:
  metadataOptions:
    httpEndpoint: enabled
    httpTokens: required
    httpPutResponseHopLimit: 2

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html

https://github.com/aws-controllers-k8s/ec2-controller/blob/main/config/crd/bases/ec2.services.k8s.aws_launchtemplates.yaml#L453-L468

and then reference that launch template to create a nodegroup (we can add a reference like we have for EC2 instances)

  launchTemplate:
    name: ...

https://github.com/aws-controllers-k8s/eks-controller/blob/main/config/crd/bases/eks.services.k8s.aws_nodegroups.yaml#L163-L183

[rushmash91]

Here is an example:

• Create a LaunchTemplate with the metadataOptions

apiVersion: ec2.services.k8s.aws/v1alpha1
kind: LaunchTemplate
metadata:
  name: eks-imdsv2-launch-template
spec:
  name: eks-imdsv2-launch-template
  data:
    metadataOptions:
      httpTokens: required
      httpEndpoint: enabled
      httpPutResponseHopLimit: 1

• Create a Nodegroup with the LaunchTemplate

apiVersion: eks.services.k8s.aws/v1alpha1
kind: Nodegroup
metadata:
  name: eks-managed-nodegroup
spec:
  name: eks-managed-nodegroup
  clusterName: my-cluster
  nodeRole: arn:aws:iam::111122223333:role/eks-node-group-role
  subnets:
    - subnet-xxxxxxxxxxxx1
    - subnet-xxxxxxxxxxxx2
  launchTemplate:
    name: eks-imdsv2-launch-template
    version: "1"
  scalingConfig:
    minSize: 1
    maxSize: 5
    desiredSize: 3

Remember to replace the following placeholder values with your actual values:

• my-cluster with your EKS cluster name
• arn: aws: iam::111122223333:role/eks-node-group-role with your actual node IAM role ARN
• subnet-xxxxxxxxxxxx1 and subnet-xxxxxxxxxxxx2 with your actual subnet IDs

[gecube]

@rushmash91 wow ! great example! thank you very much! I am totally sure that I should try in next few days.

[rushmash91]

/assign

[rushmash91]

Closing the issue. Feel free to reopen if you have further questions!
/close