gardener-extension-provider-aws icon indicating copy to clipboard operation
gardener-extension-provider-aws copied to clipboard

allow disabling instance metadata service

Open tareksha opened this issue 5 months ago • 0 comments

/area control-plane /kind enhancement /platform aws

What would you like to be added:

Currently the worker config for AWS shoots allows customizing the hop limits and requiring IMDSv2 (https://github.com/gardener/gardener-extension-provider-aws/issues/468). However it does not allow disabling IMDS altogether. Proposed API:

apiVersion: aws.provider.extensions.gardener.cloud/v1alpha1
kind: WorkerConfig
instanceMetadataOptions:
  enabled: false # or true

Why is this needed:

Many applications that run on gardener aws cluster do not use IMDS or need.

Furthermore, applications that go through security hardening will probably have to block access to IMDS via network policies or other methods, which further adds development and maintenance efforts. Disabling IMDS improves security and reduces repetitive effort.

tareksha avatar Sep 17 '24 13:09 tareksha