Configure IMDS2 for AWS instances per default [KIM/feature]

[tobiscr]

Description

To increase the overall security of our AWS clusters, the default configuration in Gardener should be adjusted to use IMDS2 as default.

Currently, new worker pools are created having IMDS1 enabled (this is the default if not explicit configuration is provided). We have to adjust the shoot-spec for Gardener to use IMDS2 per default.

AC:

• Align with SREs on the rollout of this feature as it requires a migration of old AWS instances from IMDS1 to IMDS2
• All AWS clusters are using IMDS2 as default value, IMDS1 is no longer used

[tobiscr]

Impacts default configuration of worker pools - see also #46

[Disper]

• related gardener announcement
• gardener-extension-provider-aws docs's workerconfig section
• related provisioner's code

Relevant fragment

The instanceMetadataOptions controls access to the instance metadata service (IMDS) for members of the worker. You can do the following operations:

• access IMDSv1 (default)
• access IMDSv2 - httpPutResponseHopLimit >= 2
• access IMDSv2 only (restrict access to IMDSv1) - httpPutResponseHopLimit >=2, httpTokens = "required"
• disable access to IMDS - httpTokens = "required"

Note: The accessibility of IMDS discussed in the previous point is referenced from the point of view of containers NOT running in the host network.
By default on host network IMDSv2 is already enabled (but not accessible from inside the pods).
It is currently not possible to create a VM with complete restriction to the IMDS service. It is however possible to restrict access from inside the pods by setting httpTokens to required and not setting httpPutResponseHopLimit (or setting it to 1).
You can find more information regarding the options in the AWS documentation.

[Disper]

Notes from today's alignment with @tobiscr and @ebensom
At the end, we need to make sure that those two fields:

• httpPutResponseHopLimit >=2
• httpTokens = "required"

will be configured for AWS for new clusters using a feature flag. SRE is willing to raise a PR with that change which @kyma-project/framefrog should review. Later, SRE will ensure that all shoots are upgraded to use those new values.

[tobiscr]

Fix for provisioner was created by @ebensom : kyma-project/control-plane@ea75326

[tobiscr]

Already covered in KIM