Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

confd not able to retrieve credentials with IMDSv2 #857

Open
bellackj opened this issue Feb 15, 2022 · 3 comments
Open

confd not able to retrieve credentials with IMDSv2 #857

bellackj opened this issue Feb 15, 2022 · 3 comments

Comments

@bellackj
Copy link

Hello. I am unable to retrieve aws credentials associated with my EC2 instance Role. I believe this is due to confd using an http GET request of the instance metadata. IMDSv2 requires an http PUT request. Is there a solution for using cond with IMDSv2?
@abtreece
Copy link
Contributor

Hey @bellackj you could give my fork of confd a shot. My guess is this is due to old library versions of aws-sdk-go in this version.

Config'ed an instance to require the used of IMDSv2 ...

ubuntu@ip-10-20-4-149:~$ aws ec2 modify-instance-metadata-options --instance-id i-0a356f51af7f5a26a --http-tokens required --http-endpoint enabled
{
    "InstanceId": "i-0a356f51af7f5a26a",
    "InstanceMetadataOptions": {
        "State": "pending",
        "HttpTokens": "required",
        "HttpPutResponseHopLimit": 1,
        "HttpEndpoint": "enabled"
    }
}

Tested with the unmaintained version...

ubuntu@ip-10-20-4-149:~$ ./confd-0.16.0-linux-amd64 --version
confd 0.16.0 (Git SHA: 7217b0ca, Go Version: go1.10.2)

ubuntu@ip-10-20-4-149:~$ ./confd-0.16.0-linux-amd64 --onetime --interval 5 --backend ssm
2022-02-23T01:34:10Z ip-10-20-4-149 ./confd-0.16.0-linux-amd64[1212]: INFO Backend set to ssm
2022-02-23T01:34:10Z ip-10-20-4-149 ./confd-0.16.0-linux-amd64[1212]: INFO Starting confd
2022-02-23T01:34:10Z ip-10-20-4-149 ./confd-0.16.0-linux-amd64[1212]: INFO Backend source(s) set to
2022-02-23T01:34:10Z ip-10-20-4-149 ./confd-0.16.0-linux-amd64[1212]: FATAL NoCredentialProviders: no valid providers in chain. Deprecated.
	For verbose messaging see aws.Config.CredentialsChainVerboseErrors

Tested with the last release from my fork...

ubuntu@ip-10-20-4-149:~$ confd --version
confd 0.18.4 (Git SHA: e230733, Go Version: go1.16.4)

$ confd --onetime --log-level debug --interval 5 --backend ssm
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: INFO Backend set to ssm
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: INFO Starting confd
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: INFO Backend source(s) set to
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Region: us-east-1
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Loading template resources from confdir /etc/confd
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Found template: /etc/confd/conf.d/basic.toml
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Loading template resource from /etc/confd/conf.d/basic.toml
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Retrieving keys from store
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Key prefix set to /
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Processing key=/database/host
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Processing key=/database/password
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Processing key=/database/port
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Processing key=/database/username
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Got the following map from store: map[/database/host:127.0.0.1 /database/password:p@sSw0rd /database/port:3306 /database/username:confd]
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Using source template /etc/confd/templates/basic.conf.tmpl
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Compiling source template /etc/confd/templates/basic.conf.tmpl
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Comparing candidate config to /tmp/confd-basic-test.conf
2022-02-23T01:35:32Z ip-10-20-4-149 confd[1221]: DEBUG Target config /tmp/confd-basic-test.conf in sync

@bellackj
Copy link
Author

bellackj commented Feb 25, 2022 via email

@abtreece
Copy link
Contributor

abtreece commented Mar 4, 2022

@bellackj ... I'm not sure I follow. did you clone https://github.com/abtreece/confd and then build confd from that codebase?

If all you want to do is pull down and run confd you could use a prebuilt binary from the latest release

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@abtreece @bellackj