OCPCLOUD-2710: implement extended AWS metadata service options

[RadekManak]

This PR extends the AWS Instance Metadata Service (IMDS) configuration options in Machine API Provider for AWS (MAPA) to achieve parity with Cluster API Provider AWS (CAPA).

What this PR does

Adds support for three new metadata service options when creating AWS instances:

1. HTTPEndpoint - Controls whether the HTTP metadata endpoint is enabled or disabled on EC2 instances

   • Enabled: The metadata endpoint is accessible
   • Disabled: The metadata endpoint is not accessible

2. HTTPPutResponseHopLimit - Configures the desired HTTP PUT response hop limit for instance metadata requests (valid range: 1-64). This is useful for containers and multi-hop network setups where the default hop limit of 1 may be insufficient.

3. InstanceMetadataTags - Controls whether instance tags are accessible from the instance metadata service

   • Enabled: Allows instance tags to be retrieved from IMDS
   • Disabled: Instance tags are not accessible from IMDS

These options are plumbed into the InstanceMetadataOptionsRequest when calling the EC2 RunInstances API.

Why this is needed

CAPA currently supports these metadata service configuration options while MAPA does not. This gap causes issues during CAPI to MAPI conversion when these fields are populated. By implementing these options in MAPA:

• We achieve feature parity with CAPA
• We eliminate conversion errors in CAPI2MAPI when these fields are configured
• We provide users with more granular control over their instance metadata configuration

API PR: openshift/api#2654

Summary by CodeRabbit

• New Features

  • Added support for configuring additional instance metadata service options, including HTTP endpoint access, IPv6 protocol behavior, response hop limits, and instance metadata tags.
  • Provider settings can now explicitly override automatic IPv6 metadata behavior in dual-stack environments.

• Bug Fixes

  • Improved handling of authentication and metadata service configuration combinations.

• Chores

  • Updated supporting infrastructure and Kubernetes-related components.

[openshift-ci-robot]

@RadekManak: This pull request references OCPCLOUD-2710 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This PR extends the AWS Instance Metadata Service (IMDS) configuration options in Machine API Provider for AWS (MAPA) to achieve parity with Cluster API Provider AWS (CAPA).

What this PR does

Adds support for three new metadata service options when creating AWS instances:

1. HTTPEndpoint - Controls whether the HTTP metadata endpoint is enabled or disabled on EC2 instances

• Enabled: The metadata endpoint is accessible
• Disabled: The metadata endpoint is not accessible

2. HTTPPutResponseHopLimit - Configures the desired HTTP PUT response hop limit for instance metadata requests (valid range: 1-64). This is useful for containers and multi-hop network setups where the default hop limit of 1 may be insufficient.

3. InstanceMetadataTags - Controls whether instance tags are accessible from the instance metadata service

• Enabled: Allows instance tags to be retrieved from IMDS
• Disabled: Instance tags are not accessible from IMDS

These options are plumbed into the InstanceMetadataOptionsRequest when calling the EC2 RunInstances API.

Why this is needed

CAPA currently supports these metadata service configuration options while MAPA does not. This gap causes issues during CAPI to MAPI conversion when these fields are populated. By implementing these options in MAPA:

• We achieve feature parity with CAPA
• We eliminate conversion errors in CAPI2MAPI when these fields are configured
• We provide users with more granular control over their instance metadata configuration

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nrb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@RadekManak: This pull request references OCPCLOUD-2710 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This PR extends the AWS Instance Metadata Service (IMDS) configuration options in Machine API Provider for AWS (MAPA) to achieve parity with Cluster API Provider AWS (CAPA).

What this PR does

Adds support for three new metadata service options when creating AWS instances:

1. HTTPEndpoint - Controls whether the HTTP metadata endpoint is enabled or disabled on EC2 instances

• Enabled: The metadata endpoint is accessible
• Disabled: The metadata endpoint is not accessible

2. HTTPPutResponseHopLimit - Configures the desired HTTP PUT response hop limit for instance metadata requests (valid range: 1-64). This is useful for containers and multi-hop network setups where the default hop limit of 1 may be insufficient.

3. InstanceMetadataTags - Controls whether instance tags are accessible from the instance metadata service

• Enabled: Allows instance tags to be retrieved from IMDS
• Disabled: Instance tags are not accessible from IMDS

These options are plumbed into the InstanceMetadataOptionsRequest when calling the EC2 RunInstances API.

Why this is needed

CAPA currently supports these metadata service configuration options while MAPA does not. This gap causes issues during CAPI to MAPI conversion when these fields are populated. By implementing these options in MAPA:

• We achieve feature parity with CAPA
• We eliminate conversion errors in CAPI2MAPI when these fields are configured
• We provide users with more granular control over their instance metadata configuration

API PR: openshift/api#2654

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[damdo]

@RadekManak this will soon also need HTTPProtocolIPv6

[perdasilva]

@RadekManak this was been open for a little while. Is it still relevant?

[RadekManak]

/remove-lifecycle stale

Still relevant — rebased, added HTTPProtocolIPv6 plumbing (and dual-stack default behavior), and updated tests.

API PR: openshift/api#2654
DNM vendor replace stays until api merges; verify-deps will stay red until then.

[openshift-ci-robot]

@RadekManak: This pull request references OCPCLOUD-2710 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

This PR extends the AWS Instance Metadata Service (IMDS) configuration options in Machine API Provider for AWS (MAPA) to achieve parity with Cluster API Provider AWS (CAPA).

What this PR does

Adds support for three new metadata service options when creating AWS instances:

1. HTTPEndpoint - Controls whether the HTTP metadata endpoint is enabled or disabled on EC2 instances

• Enabled: The metadata endpoint is accessible
• Disabled: The metadata endpoint is not accessible

2. HTTPPutResponseHopLimit - Configures the desired HTTP PUT response hop limit for instance metadata requests (valid range: 1-64). This is useful for containers and multi-hop network setups where the default hop limit of 1 may be insufficient.

3. InstanceMetadataTags - Controls whether instance tags are accessible from the instance metadata service

• Enabled: Allows instance tags to be retrieved from IMDS
• Disabled: Instance tags are not accessible from IMDS

These options are plumbed into the InstanceMetadataOptionsRequest when calling the EC2 RunInstances API.

Why this is needed

CAPA currently supports these metadata service configuration options while MAPA does not. This gap causes issues during CAPI to MAPI conversion when these fields are populated. By implementing these options in MAPA:

• We achieve feature parity with CAPA
• We eliminate conversion errors in CAPI2MAPI when these fields are configured
• We provide users with more granular control over their instance metadata configuration

API PR: openshift/api#2654

Summary by CodeRabbit

• New Features

• Added support for configuring additional instance metadata service options, including HTTP endpoint access, IPv6 protocol behavior, response hop limits, and instance metadata tags.

• Provider settings can now explicitly override automatic IPv6 metadata behavior in dual-stack environments.

• Bug Fixes

• Improved handling of authentication and metadata service configuration combinations.

• Chores

• Updated supporting infrastructure and Kubernetes-related components.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

---

Walkthrough

The module graph is updated, and instance metadata request construction now maps HTTP endpoint, IPv6 protocol, hop limit, and metadata tag settings. Tests add coverage for explicit values, dual-stack fallback behavior, and combined metadata configurations.

Changes

IMDS Metadata Options

Layer / File(s)	Summary
Go module graph updates go.mod	Adds the local OpenShift API replacement and updates, adds, and removes indirect dependency versions.
Instance metadata request mapping pkg/actuators/machine/instances.go, pkg/actuators/machine/instances_test.go	Maps additional metadata service settings into EC2 requests, including explicit IPv6 overrides and dual-stack fallback, with expanded table-driven tests.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: mdbooth, nrb

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the PR's main change: adding extended AWS metadata service options.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The changed test file uses only static, literal subtest names; no Ginkgo titles or dynamic identifiers were introduced.
Test Structure And Quality	✅ Passed	The added tests are table-driven unit tests, not Ginkgo/cluster tests; no setup/cleanup or Eventually waits are needed, and assertion style matches repo patterns.
Microshift Test Compatibility	✅ Passed	Touched tests are plain Go unit tests; no Ginkgo e2e specs, MicroShift guards, or unsupported OpenShift APIs/features were introduced.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the modified test file uses standard Go testing and contains no SNO-sensitive multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The PR only changes EC2 IMDS option plumbing/tests and dependency versions; it adds no pod scheduling constraints, replicas, selectors, or affinity rules.
Ote Binary Stdout Contract	✅ Passed	Changed files only touch library code and tests; no added process-level stdout writes were found, and suite/TestMain logging stays on stderr.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only unit tests and IMDS plumbing changed; no new Ginkgo e2e tests, IPv4-only assumptions, or external connectivity were added.
No-Weak-Crypto	✅ Passed	Patched source only adds IMDS option plumbing/tests; no MD5/SHA1/DES/RC4/3DES/Blowfish, ECB, custom crypto, or secret comparisons were added.
Container-Privileges	✅ Passed	No non-vendor manifests changed, and the exact privilege flags were absent from all changed manifest-like files.
No-Sensitive-Data-In-Logs	✅ Passed	The IMDS commits add option mapping and tests only; no new logs or string interpolations expose passwords, tokens, PII, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@RadekManak: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-serial-2of2	b73bc9b	link	true	/test e2e-aws-serial-2of2
ci/prow/verify-deps	b73bc9b	link	true	/test verify-deps
ci/prow/e2e-aws-upgrade	b73bc9b	link	true	/test e2e-aws-upgrade
ci/prow/govet	b73bc9b	link	true	/test govet
ci/prow/e2e-aws-serial-1of2	b73bc9b	link	true	/test e2e-aws-serial-1of2
ci/prow/unit	b73bc9b	link	true	/test unit
ci/prow/e2e-aws-operator	b73bc9b	link	true	/test e2e-aws-operator
ci/prow/e2e-aws	b73bc9b	link	true	/test e2e-aws
ci/prow/okd-scos-images	b73bc9b	link	true	/test okd-scos-images
ci/prow/regression-clusterinfra-aws-ipi-mapi	b73bc9b	link	false	/test regression-clusterinfra-aws-ipi-mapi

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.