From f5f257892b551a2aab6179e7013a287eb6681729 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Radek=20Ma=C5=88=C3=A1k?= Date: Wed, 6 May 2026 15:37:57 +0200 Subject: [PATCH] OCPCLOUD-2710: extend AWS metadata service options in MAPA Add four new optional fields to MetadataServiceOptions in the AWS provider config, exposing the remaining EC2 instance metadata service (IMDS) settings that MAPA manages: - httpEndpoint: enable or disable the HTTP metadata endpoint - httpProtocolIPv6: enable or disable the IPv6 IMDS endpoint - httpPutResponseHopLimit: maximum hop limit for metadata tokens (1-64) - instanceMetadataTags: enable or disable access to instance tags via IMDS New types (HTTPEndpointState, HTTPProtocolIPv6State, InstanceMetadataTagsState) and their constants are introduced alongside the fields. All new fields use pointer types, following the convention for Go-validated provider specs where the zero value must be distinguishable from an unset field. The existing authentication field comment is updated to match the consistent style of the new fields. Generated deepcopy and OpenAPI docs are updated accordingly. --- machine/v1beta1/types_awsprovider.go | 81 ++++++++++++++++++- machine/v1beta1/zz_generated.deepcopy.go | 22 ++++- .../zz_generated.swagger_doc_generated.go | 8 +- .../generated_openapi/zz_generated.openapi.go | 30 ++++++- openapi/openapi.json | 19 ++++- 5 files changed, 151 insertions(+), 9 deletions(-) diff --git a/machine/v1beta1/types_awsprovider.go b/machine/v1beta1/types_awsprovider.go index e3508d6679d..66fc25b4ccc 100644 --- a/machine/v1beta1/types_awsprovider.go +++ b/machine/v1beta1/types_awsprovider.go @@ -255,6 +255,7 @@ type SpotMarketOptions struct { MaxPrice *string `json:"maxPrice,omitempty"` } +// +kubebuilder:validation:Enum=Required;Optional type MetadataServiceAuthentication string const ( @@ -265,18 +266,90 @@ const ( MetadataServiceAuthenticationOptional = "Optional" ) +// HTTPEndpointState describes the state of the HTTP metadata endpoint. +// +kubebuilder:validation:Enum=Enabled;Disabled +type HTTPEndpointState string + +const ( + // HTTPEndpointDisabled disables the HTTP metadata endpoint. + HTTPEndpointDisabled HTTPEndpointState = "Disabled" + // HTTPEndpointEnabled enables the HTTP metadata endpoint. + HTTPEndpointEnabled HTTPEndpointState = "Enabled" +) + +// HTTPProtocolIPv6State describes the state of the IPv6 endpoint for the HTTP metadata service. +// +kubebuilder:validation:Enum=Enabled;Disabled +type HTTPProtocolIPv6State string + +const ( + // HTTPProtocolIPv6Disabled disables the IPv6 endpoint for the HTTP metadata service. + HTTPProtocolIPv6Disabled HTTPProtocolIPv6State = "Disabled" + // HTTPProtocolIPv6Enabled enables the IPv6 endpoint for the HTTP metadata service. + HTTPProtocolIPv6Enabled HTTPProtocolIPv6State = "Enabled" +) + +// InstanceMetadataTagsState describes the state of access to instance tags from the instance metadata. +// +kubebuilder:validation:Enum=Enabled;Disabled +type InstanceMetadataTagsState string + +const ( + // InstanceMetadataTagsDisabled disables access to instance tags from the instance metadata. + InstanceMetadataTagsDisabled InstanceMetadataTagsState = "Disabled" + // InstanceMetadataTagsEnabled enables access to instance tags from the instance metadata. + InstanceMetadataTagsEnabled InstanceMetadataTagsState = "Enabled" +) + // MetadataServiceOptions defines the options available to a user when configuring // Instance Metadata Service (IMDS) Options. type MetadataServiceOptions struct { + // httpEndpoint enables or disables the HTTP metadata endpoint on your instances. + // Valid values are "Enabled" and "Disabled". + // When set to Enabled, the HTTP metadata endpoint is accessible. + // When set to Disabled, you cannot access your instance metadata. + // When omitted, the value is determined by account-level settings in the AWS Region, or the AWS service default if not configured at the account level. + // The typical AWS service default is Enabled. + // +optional + HTTPEndpoint *HTTPEndpointState `json:"httpEndpoint,omitempty"` + + // httpProtocolIPv6 enables or disables the IPv6 endpoint for the instance metadata service. + // Valid values are "Enabled" and "Disabled". + // When set to Enabled, the IPv6 endpoint for the instance metadata service is accessible. + // When set to Disabled, the IPv6 endpoint for the instance metadata service is not accessible. + // When omitted, the AWS default is used and the IPv6 endpoint is disabled. + // +optional + HTTPProtocolIPv6 *HTTPProtocolIPv6State `json:"httpProtocolIPv6,omitempty"` + + // httpPutResponseHopLimit is the maximum number of hops that the metadata token can travel. + // Valid values range from 1 to 64. + // When omitted, the value is determined by AWS in the following order of precedence: + // 1) Account-level settings in the AWS Region (if configured) + // 2) AMI configuration: 1 when ImdsSupport is v1.0, 2 when ImdsSupport is v2.0 + // +kubebuilder:validation:Minimum:=1 + // +kubebuilder:validation:Maximum:=64 + // +optional + HTTPPutResponseHopLimit *int64 `json:"httpPutResponseHopLimit,omitempty"` + // authentication determines whether or not the host requires the use of authentication when interacting with the metadata service. - // When using authentication, this enforces v2 interaction method (IMDSv2) with the metadata service. - // When omitted, this means the user has no opinion and the value is left to the platform to choose a good - // default, which is subject to change over time. The current default is optional. + // When set to Required, this enforces v2 interaction method (IMDSv2) with the metadata service. + // When set to Optional, both IMDSv1 and IMDSv2 are allowed. + // When omitted, the value is determined by AWS in the following order of precedence: + // 1) Account-level settings in the AWS Region (if configured) + // 2) AMI configuration: Required when ImdsSupport is v2.0, Optional when ImdsSupport is v1.0 // At this point this field represents `HttpTokens` parameter from `InstanceMetadataOptionsRequest` structure in AWS EC2 API // https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html - // +kubebuilder:validation:Enum=Required;Optional // +optional Authentication MetadataServiceAuthentication `json:"authentication,omitempty"` + + // instanceMetadataTags enables or disables access to instance tags from the instance metadata. + // Valid values are "Enabled" and "Disabled". + // When set to Enabled, you can retrieve your instance tags from the instance metadata. + // When set to Disabled, instance tags are not accessible from the instance metadata. + // When omitted, the value is determined by account-level settings in the AWS Region, or the AWS service default if not configured at the account level. + // The typical AWS service default is Disabled. + // For more information, see the AWS documentation: + // https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS + // +optional + InstanceMetadataTags *InstanceMetadataTagsState `json:"instanceMetadataTags,omitempty"` } // AWSResourceReference is a reference to a specific AWS resource by ID, ARN, or filters. diff --git a/machine/v1beta1/zz_generated.deepcopy.go b/machine/v1beta1/zz_generated.deepcopy.go index 63b9bb5ff81..4ff08e8dc01 100644 --- a/machine/v1beta1/zz_generated.deepcopy.go +++ b/machine/v1beta1/zz_generated.deepcopy.go @@ -79,7 +79,7 @@ func (in *AWSMachineProviderConfig) DeepCopyInto(out *AWSMachineProviderConfig) *out = new(SpotMarketOptions) (*in).DeepCopyInto(*out) } - out.MetadataServiceOptions = in.MetadataServiceOptions + in.MetadataServiceOptions.DeepCopyInto(&out.MetadataServiceOptions) if in.PlacementGroupPartition != nil { in, out := &in.PlacementGroupPartition, &out.PlacementGroupPartition *out = new(int32) @@ -1538,6 +1538,26 @@ func (in *MachineTemplateSpec) DeepCopy() *MachineTemplateSpec { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *MetadataServiceOptions) DeepCopyInto(out *MetadataServiceOptions) { *out = *in + if in.HTTPEndpoint != nil { + in, out := &in.HTTPEndpoint, &out.HTTPEndpoint + *out = new(HTTPEndpointState) + **out = **in + } + if in.HTTPProtocolIPv6 != nil { + in, out := &in.HTTPProtocolIPv6, &out.HTTPProtocolIPv6 + *out = new(HTTPProtocolIPv6State) + **out = **in + } + if in.HTTPPutResponseHopLimit != nil { + in, out := &in.HTTPPutResponseHopLimit, &out.HTTPPutResponseHopLimit + *out = new(int64) + **out = **in + } + if in.InstanceMetadataTags != nil { + in, out := &in.InstanceMetadataTags, &out.InstanceMetadataTags + *out = new(InstanceMetadataTagsState) + **out = **in + } return } diff --git a/machine/v1beta1/zz_generated.swagger_doc_generated.go b/machine/v1beta1/zz_generated.swagger_doc_generated.go index e686cad25a6..95194f49f56 100644 --- a/machine/v1beta1/zz_generated.swagger_doc_generated.go +++ b/machine/v1beta1/zz_generated.swagger_doc_generated.go @@ -166,8 +166,12 @@ func (LoadBalancerReference) SwaggerDoc() map[string]string { } var map_MetadataServiceOptions = map[string]string{ - "": "MetadataServiceOptions defines the options available to a user when configuring Instance Metadata Service (IMDS) Options.", - "authentication": "authentication determines whether or not the host requires the use of authentication when interacting with the metadata service. When using authentication, this enforces v2 interaction method (IMDSv2) with the metadata service. When omitted, this means the user has no opinion and the value is left to the platform to choose a good default, which is subject to change over time. The current default is optional. At this point this field represents `HttpTokens` parameter from `InstanceMetadataOptionsRequest` structure in AWS EC2 API https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html", + "": "MetadataServiceOptions defines the options available to a user when configuring Instance Metadata Service (IMDS) Options.", + "httpEndpoint": "httpEndpoint enables or disables the HTTP metadata endpoint on your instances. Valid values are \"Enabled\" and \"Disabled\". When set to Enabled, the HTTP metadata endpoint is accessible. When set to Disabled, you cannot access your instance metadata. When omitted, the value is determined by account-level settings in the AWS Region, or the AWS service default if not configured at the account level. The typical AWS service default is Enabled.", + "httpProtocolIPv6": "httpProtocolIPv6 enables or disables the IPv6 endpoint for the instance metadata service. Valid values are \"Enabled\" and \"Disabled\". When set to Enabled, the IPv6 endpoint for the instance metadata service is accessible. When set to Disabled, the IPv6 endpoint for the instance metadata service is not accessible. When omitted, the AWS default is used and the IPv6 endpoint is disabled.", + "httpPutResponseHopLimit": "httpPutResponseHopLimit is the maximum number of hops that the metadata token can travel. Valid values range from 1 to 64. When omitted, the value is determined by AWS in the following order of precedence: 1) Account-level settings in the AWS Region (if configured) 2) AMI configuration: 1 when ImdsSupport is v1.0, 2 when ImdsSupport is v2.0", + "authentication": "authentication determines whether or not the host requires the use of authentication when interacting with the metadata service. When set to Required, this enforces v2 interaction method (IMDSv2) with the metadata service. When set to Optional, both IMDSv1 and IMDSv2 are allowed. When omitted, the value is determined by AWS in the following order of precedence: 1) Account-level settings in the AWS Region (if configured) 2) AMI configuration: Required when ImdsSupport is v2.0, Optional when ImdsSupport is v1.0 At this point this field represents `HttpTokens` parameter from `InstanceMetadataOptionsRequest` structure in AWS EC2 API https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html", + "instanceMetadataTags": "instanceMetadataTags enables or disables access to instance tags from the instance metadata. Valid values are \"Enabled\" and \"Disabled\". When set to Enabled, you can retrieve your instance tags from the instance metadata. When set to Disabled, instance tags are not accessible from the instance metadata. When omitted, the value is determined by account-level settings in the AWS Region, or the AWS service default if not configured at the account level. The typical AWS service default is Disabled. For more information, see the AWS documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS", } func (MetadataServiceOptions) SwaggerDoc() map[string]string { diff --git a/openapi/generated_openapi/zz_generated.openapi.go b/openapi/generated_openapi/zz_generated.openapi.go index 1d6da469fc3..80d6aa6aa61 100644 --- a/openapi/generated_openapi/zz_generated.openapi.go +++ b/openapi/generated_openapi/zz_generated.openapi.go @@ -47445,9 +47445,37 @@ func schema_openshift_api_machine_v1beta1_MetadataServiceOptions(ref common.Refe Description: "MetadataServiceOptions defines the options available to a user when configuring Instance Metadata Service (IMDS) Options.", Type: []string{"object"}, Properties: map[string]spec.Schema{ + "httpEndpoint": { + SchemaProps: spec.SchemaProps{ + Description: "httpEndpoint enables or disables the HTTP metadata endpoint on your instances. Valid values are \"Enabled\" and \"Disabled\". When set to Enabled, the HTTP metadata endpoint is accessible. When set to Disabled, you cannot access your instance metadata. When omitted, the value is determined by account-level settings in the AWS Region, or the AWS service default if not configured at the account level. The typical AWS service default is Enabled.", + Type: []string{"string"}, + Format: "", + }, + }, + "httpProtocolIPv6": { + SchemaProps: spec.SchemaProps{ + Description: "httpProtocolIPv6 enables or disables the IPv6 endpoint for the instance metadata service. Valid values are \"Enabled\" and \"Disabled\". When set to Enabled, the IPv6 endpoint for the instance metadata service is accessible. When set to Disabled, the IPv6 endpoint for the instance metadata service is not accessible. When omitted, the AWS default is used and the IPv6 endpoint is disabled.", + Type: []string{"string"}, + Format: "", + }, + }, + "httpPutResponseHopLimit": { + SchemaProps: spec.SchemaProps{ + Description: "httpPutResponseHopLimit is the maximum number of hops that the metadata token can travel. Valid values range from 1 to 64. When omitted, the value is determined by AWS in the following order of precedence: 1) Account-level settings in the AWS Region (if configured) 2) AMI configuration: 1 when ImdsSupport is v1.0, 2 when ImdsSupport is v2.0", + Type: []string{"integer"}, + Format: "int64", + }, + }, "authentication": { SchemaProps: spec.SchemaProps{ - Description: "authentication determines whether or not the host requires the use of authentication when interacting with the metadata service. When using authentication, this enforces v2 interaction method (IMDSv2) with the metadata service. When omitted, this means the user has no opinion and the value is left to the platform to choose a good default, which is subject to change over time. The current default is optional. At this point this field represents `HttpTokens` parameter from `InstanceMetadataOptionsRequest` structure in AWS EC2 API https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html", + Description: "authentication determines whether or not the host requires the use of authentication when interacting with the metadata service. When set to Required, this enforces v2 interaction method (IMDSv2) with the metadata service. When set to Optional, both IMDSv1 and IMDSv2 are allowed. When omitted, the value is determined by AWS in the following order of precedence: 1) Account-level settings in the AWS Region (if configured) 2) AMI configuration: Required when ImdsSupport is v2.0, Optional when ImdsSupport is v1.0 At this point this field represents `HttpTokens` parameter from `InstanceMetadataOptionsRequest` structure in AWS EC2 API https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html", + Type: []string{"string"}, + Format: "", + }, + }, + "instanceMetadataTags": { + SchemaProps: spec.SchemaProps{ + Description: "instanceMetadataTags enables or disables access to instance tags from the instance metadata. Valid values are \"Enabled\" and \"Disabled\". When set to Enabled, you can retrieve your instance tags from the instance metadata. When set to Disabled, instance tags are not accessible from the instance metadata. When omitted, the value is determined by account-level settings in the AWS Region, or the AWS service default if not configured at the account level. The typical AWS service default is Disabled. For more information, see the AWS documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS", Type: []string{"string"}, Format: "", }, diff --git a/openapi/openapi.json b/openapi/openapi.json index 93ff6752946..9c6d4ca0b9c 100644 --- a/openapi/openapi.json +++ b/openapi/openapi.json @@ -27382,7 +27382,24 @@ "type": "object", "properties": { "authentication": { - "description": "authentication determines whether or not the host requires the use of authentication when interacting with the metadata service. When using authentication, this enforces v2 interaction method (IMDSv2) with the metadata service. When omitted, this means the user has no opinion and the value is left to the platform to choose a good default, which is subject to change over time. The current default is optional. At this point this field represents `HttpTokens` parameter from `InstanceMetadataOptionsRequest` structure in AWS EC2 API https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html", + "description": "authentication determines whether or not the host requires the use of authentication when interacting with the metadata service. When set to Required, this enforces v2 interaction method (IMDSv2) with the metadata service. When set to Optional, both IMDSv1 and IMDSv2 are allowed. When omitted, the value is determined by AWS in the following order of precedence: 1) Account-level settings in the AWS Region (if configured) 2) AMI configuration: Required when ImdsSupport is v2.0, Optional when ImdsSupport is v1.0 At this point this field represents `HttpTokens` parameter from `InstanceMetadataOptionsRequest` structure in AWS EC2 API https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html", + "type": "string" + }, + "httpEndpoint": { + "description": "httpEndpoint enables or disables the HTTP metadata endpoint on your instances. Valid values are \"Enabled\" and \"Disabled\". When set to Enabled, the HTTP metadata endpoint is accessible. When set to Disabled, you cannot access your instance metadata. When omitted, the value is determined by account-level settings in the AWS Region, or the AWS service default if not configured at the account level. The typical AWS service default is Enabled.", + "type": "string" + }, + "httpProtocolIPv6": { + "description": "httpProtocolIPv6 enables or disables the IPv6 endpoint for the instance metadata service. Valid values are \"Enabled\" and \"Disabled\". When set to Enabled, the IPv6 endpoint for the instance metadata service is accessible. When set to Disabled, the IPv6 endpoint for the instance metadata service is not accessible. When omitted, the AWS default is used and the IPv6 endpoint is disabled.", + "type": "string" + }, + "httpPutResponseHopLimit": { + "description": "httpPutResponseHopLimit is the maximum number of hops that the metadata token can travel. Valid values range from 1 to 64. When omitted, the value is determined by AWS in the following order of precedence: 1) Account-level settings in the AWS Region (if configured) 2) AMI configuration: 1 when ImdsSupport is v1.0, 2 when ImdsSupport is v2.0", + "type": "integer", + "format": "int64" + }, + "instanceMetadataTags": { + "description": "instanceMetadataTags enables or disables access to instance tags from the instance metadata. Valid values are \"Enabled\" and \"Disabled\". When set to Enabled, you can retrieve your instance tags from the instance metadata. When set to Disabled, instance tags are not accessible from the instance metadata. When omitted, the value is determined by account-level settings in the AWS Region, or the AWS service default if not configured at the account level. The typical AWS service default is Disabled. For more information, see the AWS documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS", "type": "string" } }