gardener-extension-provider-aws
gardener-extension-provider-aws copied to clipboard
allow disabling instance metadata service
/area control-plane /kind enhancement /platform aws
What would you like to be added:
Currently the worker config for AWS shoots allows customizing the hop limits and requiring IMDSv2 (https://github.com/gardener/gardener-extension-provider-aws/issues/468). However it does not allow disabling IMDS altogether. Proposed API:
apiVersion: aws.provider.extensions.gardener.cloud/v1alpha1
kind: WorkerConfig
instanceMetadataOptions:
enabled: false # or true
Why is this needed:
Many applications that run on gardener aws cluster do not use IMDS or need.
Furthermore, applications that go through security hardening will probably have to block access to IMDS via network policies or other methods, which further adds development and maintenance efforts. Disabling IMDS improves security and reduces repetitive effort.