-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Description
Bug Report
Describe the bug
In order to harden our security in our kubernetes clusters we recently set the http-put-response-hop-limit
to 1
instead of 2
on our instances so that containers wouldn't be able to assume the host instance's role.
This caused fluentbit (running in containers without host networking) to silently stop sending logs because the calls to imdsv2 are dropped by AWS if the number of hops are greater than the limit and because the aws filter calls to imdsv2 have no timeouts making fluentbit wait forever.
To Reproduce
Use the AWS filter in a container running on an instance having http-put-response-hop-limit
set to 1
.
Expected behavior
AWS filter fails with error if it is not able to reach imdsv2 endpoint.
Screenshots
Your Environment
- Version used: 2.32.5
- Configuration:
- Environment name and version (e.g. Kubernetes? What version?):
- Server type and version:
- Operating System and version:
- Filters and plugins:
Additional context