nixos/ec2: use only curl in metadata fetcher, log to console
We don't need both wget and curl, so let's use only curl (which is part of a minimal NixOS closure, unlike wget). Logging to the console is helpful for debugging.
This commit is contained in:
Linus Heckemann
parent
6fb582e030
commit
36ca2b495f
3 changed files with 71 additions and 82 deletions
|
|
@ -75,12 +75,11 @@ in
|
|||
|
||||
systemd.services.fetch-ec2-metadata = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = [ pkgs.wget ];
|
||||
script = pkgs.callPackage ./ec2-metadata-fetcher.nix {
|
||||
targetRoot = "/";
|
||||
wgetExtraOptions = "";
|
||||
};
|
||||
after = ["network-online.target"];
|
||||
path = [ pkgs.curl ];
|
||||
script = builtins.readFile ./ec2-metadata-fetcher.sh;
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.StandardOutput = "journal+console";
|
||||
};
|
||||
|
||||
# Allow root logins only using the SSH key that the user specified
|
||||
|
|
|
|||
|
|
@ -1,77 +0,0 @@
|
|||
{ curl, targetRoot, wgetExtraOptions }:
|
||||
# Note: be very cautious about dependencies, each dependency grows
|
||||
# the closure of the initrd. Ideally we would not even require curl,
|
||||
# but there is no reasonable way to send an HTTP PUT request without
|
||||
# it. Note: do not be fooled: the wget referenced in this script
|
||||
# is busybox's wget, not the fully featured one with --method support.
|
||||
#
|
||||
# Make sure that every package you depend on here is already listed as
|
||||
# a channel blocker for both the full-sized and small channels.
|
||||
# Otherwise, we risk breaking user deploys in released channels.
|
||||
#
|
||||
# Also note: OpenStack's metadata service for its instances aims to be
|
||||
# compatible with the EC2 IMDS. Where possible, try to keep the set of
|
||||
# fetched metadata in sync with ./openstack-metadata-fetcher.nix .
|
||||
''
|
||||
metaDir=${targetRoot}etc/ec2-metadata
|
||||
mkdir -m 0755 -p "$metaDir"
|
||||
rm -f "$metaDir/*"
|
||||
|
||||
get_imds_token() {
|
||||
# retry-delay of 1 selected to give the system a second to get going,
|
||||
# but not add a lot to the bootup time
|
||||
${curl}/bin/curl \
|
||||
-v \
|
||||
--retry 3 \
|
||||
--retry-delay 1 \
|
||||
--fail \
|
||||
-X PUT \
|
||||
--connect-timeout 1 \
|
||||
-H "X-aws-ec2-metadata-token-ttl-seconds: 600" \
|
||||
http://169.254.169.254/latest/api/token
|
||||
}
|
||||
|
||||
preflight_imds_token() {
|
||||
# retry-delay of 1 selected to give the system a second to get going,
|
||||
# but not add a lot to the bootup time
|
||||
${curl}/bin/curl \
|
||||
-v \
|
||||
--retry 3 \
|
||||
--retry-delay 1 \
|
||||
--fail \
|
||||
--connect-timeout 1 \
|
||||
-H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
|
||||
http://169.254.169.254/1.0/meta-data/instance-id
|
||||
}
|
||||
|
||||
try=1
|
||||
while [ $try -le 3 ]; do
|
||||
echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..."
|
||||
IMDS_TOKEN=$(get_imds_token) && break
|
||||
try=$((try + 1))
|
||||
sleep 1
|
||||
done
|
||||
|
||||
if [ "x$IMDS_TOKEN" == "x" ]; then
|
||||
echo "failed to fetch an IMDS2v token."
|
||||
fi
|
||||
|
||||
try=1
|
||||
while [ $try -le 10 ]; do
|
||||
echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..."
|
||||
preflight_imds_token && break
|
||||
try=$((try + 1))
|
||||
sleep 1
|
||||
done
|
||||
|
||||
echo "getting EC2 instance metadata..."
|
||||
|
||||
wget_imds() {
|
||||
wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@";
|
||||
}
|
||||
|
||||
wget_imds -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path || true
|
||||
(umask 077 && wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data || true)
|
||||
wget_imds -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname || true
|
||||
wget_imds -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key || true
|
||||
''
|
||||
67
nixos/modules/virtualisation/ec2-metadata-fetcher.sh
Normal file
67
nixos/modules/virtualisation/ec2-metadata-fetcher.sh
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
metaDir=/etc/ec2-metadata
|
||||
mkdir -m 0755 -p "$metaDir"
|
||||
rm -f "$metaDir/*"
|
||||
|
||||
get_imds_token() {
|
||||
# retry-delay of 1 selected to give the system a second to get going,
|
||||
# but not add a lot to the bootup time
|
||||
curl \
|
||||
--silent \
|
||||
--show-error \
|
||||
--retry 3 \
|
||||
--retry-delay 1 \
|
||||
--fail \
|
||||
-X PUT \
|
||||
--connect-timeout 1 \
|
||||
-H "X-aws-ec2-metadata-token-ttl-seconds: 600" \
|
||||
http://169.254.169.254/latest/api/token
|
||||
}
|
||||
|
||||
preflight_imds_token() {
|
||||
# retry-delay of 1 selected to give the system a second to get going,
|
||||
# but not add a lot to the bootup time
|
||||
curl \
|
||||
--silent \
|
||||
--show-error \
|
||||
--retry 3 \
|
||||
--retry-delay 1 \
|
||||
--fail \
|
||||
--connect-timeout 1 \
|
||||
-H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
|
||||
-o /dev/null \
|
||||
http://169.254.169.254/1.0/meta-data/instance-id
|
||||
}
|
||||
|
||||
try=1
|
||||
while [ $try -le 3 ]; do
|
||||
echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..."
|
||||
IMDS_TOKEN=$(get_imds_token) && break
|
||||
try=$((try + 1))
|
||||
sleep 1
|
||||
done
|
||||
|
||||
if [ "x$IMDS_TOKEN" == "x" ]; then
|
||||
echo "failed to fetch an IMDS2v token."
|
||||
fi
|
||||
|
||||
try=1
|
||||
while [ $try -le 10 ]; do
|
||||
echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..."
|
||||
preflight_imds_token && break
|
||||
try=$((try + 1))
|
||||
sleep 1
|
||||
done
|
||||
|
||||
echo "getting EC2 instance metadata..."
|
||||
|
||||
get_imds() {
|
||||
# Intentionally no --fail here, so that we proceed even if e.g. a
|
||||
# 404 was returned (but we still fail if we can't reach the IMDS
|
||||
# server).
|
||||
curl --silent --show-error --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@"
|
||||
}
|
||||
|
||||
get_imds -o "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
|
||||
(umask 077 && get_imds -o "$metaDir/user-data" http://169.254.169.254/1.0/user-data)
|
||||
get_imds -o "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
|
||||
get_imds -o "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
|
||||
Loading…
Reference in a new issue