Skip to content

IMDSv2 calls have no timeouts #10051

@sylr

Description

@sylr

Bug Report

Describe the bug

In order to harden our security in our kubernetes clusters we recently set the http-put-response-hop-limit to 1 instead of 2 on our instances so that containers wouldn't be able to assume the host instance's role.

This caused fluentbit (running in containers without host networking) to silently stop sending logs because the calls to imdsv2 are dropped by AWS if the number of hops are greater than the limit and because the aws filter calls to imdsv2 have no timeouts making fluentbit wait forever.

To Reproduce

Use the AWS filter in a container running on an instance having http-put-response-hop-limit set to 1.

Expected behavior

AWS filter fails with error if it is not able to reach imdsv2 endpoint.

Screenshots

Your Environment

  • Version used: 2.32.5
  • Configuration:
  • Environment name and version (e.g. Kubernetes? What version?):
  • Server type and version:
  • Operating System and version:
  • Filters and plugins:

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    Stalewaiting-for-userWaiting for more information, tests or requested changes

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions