kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Set IMDS max hop limit to 1 for control plane nodes 

Update docs/releases/1.26-NOTES.md

Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>
This commit is contained in:
Ole Markus With 2022-11-16 14:22:10 +01:00
parent 2f59911458
commit 035fa79077
3 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/releases/1.26-NOTES.md
View File

@ -16,6 +16,8 @@ This is a document to gather the release notes prior to the release.
* The AWS Load Balancer, when enabled, will run on worker nodes if IRSA is enabled as of Kubernetes version 1.24. * The AWS Load Balancer, when enabled, will run on worker nodes if IRSA is enabled as of Kubernetes version 1.24.
* As of Kubernetes version 1.26 and with IRSA enabled, control plane nodes will now run with a max hop limit of 1 for the metadata service. This will prevent Pods without host networking from accessing the instance metadata service.
# Breaking changes # Breaking changes
## Other breaking changes ## Other breaking changes

2
tests/integration/create_cluster/minimal-1.26-irsa/expected-v1alpha2.yaml
View File

@ -70,7 +70,7 @@ metadata:
spec: spec:
image: 099720109477/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20221018 image: 099720109477/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20221018
instanceMetadata: instanceMetadata:
httpPutResponseHopLimit: 3 httpPutResponseHopLimit: 1
httpTokens: required httpTokens: required
machineType: m3.medium machineType: m3.medium
maxSize: 1 maxSize: 1

3
upup/pkg/fi/cloudup/new_cluster.go
View File

@ -855,6 +855,9 @@ func setupMasters(opt *NewClusterOptions, cluster *api.Cluster, zoneToSubnetMap
HTTPTokens: fi.String("required"), HTTPTokens: fi.String("required"),
} }
} }
if cluster.IsKubernetesGTE("1.26") && fi.BoolValue(cluster.Spec.IAM.UseServiceAccountExternalPermissions) {
g.Spec.InstanceMetadata.HTTPPutResponseHopLimit = fi.Int64(1)
}
} }
g.Spec.MachineType = opt.MasterSize g.Spec.MachineType = opt.MasterSize