Removing meta-data-v2 extension #238
Conversation
| @@ -5,8 +5,8 @@ web_vm_type: production-concourse-web | |||
| worker_vm_type: production-concourse-worker | |||
| iaas_worker_vm_type: production-concourse-iaas-worker | |||
| web_vm_extensions: [production-concourse-lb] | |||
| worker_vm_extensions: [production-concourse-profile, meta-data-v2] | |||
There was a problem hiding this comment.
Are you sure that the settings will still apply on Concourse VMs? I ask because these settings are the crux of making sure that BOSH builds take minutes rather than hours
There was a problem hiding this comment.
Yes. The setting is configured when the VM is created. To put it in place we either wait for a stemcell or recreate the vms (what I've been doing).
If we find that this is not working for some reason, the vm_extension configuration has a higher priority than the CPI configuration, I won't be removing the vm_extension from the cloud config until it is removed as a separate configuration in deployment manifests.
There was a problem hiding this comment.
This is the configuration at the CPI layer:
- type: replace
path: /instance_groups/name=bosh/properties/aws/metadata_options?/http_tokens?
value: required
- type: replace
path: /instance_groups/name=bosh/properties/aws/metadata_options?/http_put_response_hop_limit?
value: 2
They are the same two values set by #235 only now this is happening for ALL vms
Changes proposed in this pull request:
meta-data-v2cloud config vm_extension, this is now configured globally in the BOSH CPI with Require IMDSv2 deploy-bosh#625security considerations
Continues the use of a token to access metadata information