Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IMDSv2 calls have no timeouts #10051

Open
sylr opened this issue Mar 6, 2025 · 1 comment
Open

IMDSv2 calls have no timeouts #10051

sylr opened this issue Mar 6, 2025 · 1 comment
Labels
waiting-for-user Waiting for more information, tests or requested changes

Comments

@sylr
Copy link
Contributor

sylr commented Mar 6, 2025

Bug Report

Describe the bug

In order to harden our security in our kubernetes clusters we recently set the http-put-response-hop-limit to 1 instead of 2 on our instances so that containers wouldn't be able to assume the host instance's role.

This caused fluentbit (running in containers without host networking) to silently stop sending logs because the calls to imdsv2 are dropped by AWS if the number of hops are greater than the limit and because the aws filter calls to imdsv2 have no timeouts making fluentbit wait forever.

To Reproduce

Use the AWS filter in a container running on an instance having http-put-response-hop-limit set to 1.

Expected behavior

AWS filter fails with error if it is not able to reach imdsv2 endpoint.

Screenshots

Your Environment

  • Version used: 2.32.5
  • Configuration:
  • Environment name and version (e.g. Kubernetes? What version?):
  • Server type and version:
  • Operating System and version:
  • Filters and plugins:

Additional context

@patrick-stephens
Copy link
Contributor

The version provided is not an OSS version, I'm guessing you're on an AWS specific version so I would raise it there or use an OSS version: https://github.com/aws/aws-for-fluent-bit

Please also follow the template, there is no actual config included.

@patrick-stephens patrick-stephens added waiting-for-user Waiting for more information, tests or requested changes and removed status: waiting-for-triage labels Mar 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
waiting-for-user Waiting for more information, tests or requested changes
Projects
None yet
Development

No branches or pull requests

2 participants