IMDSv2 and default tags

[gburke-ppb]

trafficstars

/kind bug

What steps did you take and what happened: When creating an EKS Cluster the AWSManagedMachinePool is adding some default tags, kubernetes.io/cluster/<cluster-name> being one. We have an account setup to use IMDSv2, and our Security team won't allow us to use IMDSv1 on it. One of the changes with IMDSv2 is the allowed characters in a tag name -- specifically / is no longer allowed (especially so with instance metadata tags enabled).

So we get this reconciler error:

E0530 11:10:10.864609       1 controller.go:329] "Reconciler error" err=<
    failed to reconcile machine pool for AWSManagedMachinePool my-cluster/my-cluster: failed to create nodegroup: failed to create nodegroup: InvalidRequestException: 'kubernetes.io/cluster/my-cluster' is not a valid tag key. Tag keys must match pattern ([0-9a-zA-Z\\-_+=,.@:]{1,255}), and must not be a reserved name ('.', '..', '_index')
    {
      RespMetadata: {
        StatusCode: 400,
        RequestID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
      },
      Message_: "'kubernetes.io/cluster/my-cluster' is not a valid tag key. Tag keys must match pattern ([0-9a-zA-Z\\\\-_+=,.@:]{1,255}), and must not be a reserved name ('.', '..', '_index')"
    }
 > controller="awsmanagedmachinepool" controllerGroup="infrastructure.cluster.x-k8s.io" controllerKind="AWSManagedMachinePool" AWSManagedMachinePool="my-cluster/my-cluster" namespace="my-cluster" name="my-cluster" reconcileID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

I have tried adding

...
              forProvider:
               manifest:
                 apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
                 kind: AWSManagedMachinePool
                 ...
                 spec:
                   ...
                   awsLaunchTemplate:
                     ...
                     metadataOptions:
                       httpTokens: required
                       httpPutResponseHopLimit: 2
                       instanceMetadataTags: disabled

(as per here) to no avail.

What did you expect to happen: Certainly not this.

Anything else you would like to add: [Miscellaneous information that will assist in solving the issue.]

Environment:

• Cluster-api-provider-aws version: v2.5.0
• Kubernetes version: (use kubectl version): 1.30
• OS (e.g. from /etc/os-release): Amazon Linux 2

Installing Provider="cluster-api" Version="v1.7.2" TargetNamespace="capi-system"
Installing Provider="bootstrap-kubeadm" Version="v1.7.2" TargetNamespace="capi-kubeadm-bootstrap-system"
Installing Provider="control-plane-kubeadm" Version="v1.7.2" TargetNamespace="capi-kubeadm-control-plane-system"
Installing Provider="infrastructure-aws" Version="v2.5.0" TargetNamespace="capa-system"

[k8s-ci-robot]

This issue is currently awaiting triage.

If CAPA/CAPI contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[gburke-ppb]

Interestingly, with these settings everything works!

The main setting that causes us issues is the “Access to tags in metadata” – if this is Enabled then we can’t create a nodegroup because of the tags with a / in them.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

@jwitko: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

This is still a real and valid issue. /reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.