Commit 36ca2b49 authored by Linus Heckemann's avatar Linus Heckemann
Browse files

nixos/ec2: use only curl in metadata fetcher, log to console 

We don't need both wget and curl, so let's use only curl (which is
part of a minimal NixOS closure, unlike wget).

Logging to the console is helpful for debugging.
parent 6fb582e0

nixos/modules/virtualisation/amazon-image.nix

+4 −5
Original line number Diff line number Diff line
@@ -75,12 +75,11 @@ in 


    systemd.services.fetch-ec2-metadata = {

      wantedBy = [ "multi-user.target" ];

      path = [ pkgs.wget ];

      script = pkgs.callPackage ./ec2-metadata-fetcher.nix {

        targetRoot = "/";

        wgetExtraOptions = "";

      };

      after = ["network-online.target"];

      path = [ pkgs.curl ];

      script = builtins.readFile ./ec2-metadata-fetcher.sh;

      serviceConfig.Type = "oneshot";

      serviceConfig.StandardOutput = "journal+console";

    };



    # Allow root logins only using the SSH key that the user specified

nixos/modules/virtualisation/ec2-metadata-fetcher.nix

deleted100644 → 0
+0 −77
Original line number Diff line number Diff line 
{ curl, targetRoot, wgetExtraOptions }:

# Note: be very cautious about dependencies, each dependency grows

# the closure of the initrd. Ideally we would not even require curl,

# but there is no reasonable way to send an HTTP PUT request without

# it. Note: do not be fooled: the wget referenced in this script

# is busybox's wget, not the fully featured one with --method support.

#

# Make sure that every package you depend on here is already listed as

# a channel blocker for both the full-sized and small channels.

# Otherwise, we risk breaking user deploys in released channels.

#

# Also note: OpenStack's metadata service for its instances aims to be

# compatible with the EC2 IMDS. Where possible, try to keep the set of

# fetched metadata in sync with ./openstack-metadata-fetcher.nix .

''

  metaDir=${targetRoot}etc/ec2-metadata

  mkdir -m 0755 -p "$metaDir"

  rm -f "$metaDir/*"



  get_imds_token() {

    # retry-delay of 1 selected to give the system a second to get going,

    # but not add a lot to the bootup time

    ${curl}/bin/curl \

      -v \

      --retry 3 \

      --retry-delay 1 \

      --fail \

      -X PUT \

      --connect-timeout 1 \

      -H "X-aws-ec2-metadata-token-ttl-seconds: 600" \

      http://169.254.169.254/latest/api/token

  }



  preflight_imds_token() {

    # retry-delay of 1 selected to give the system a second to get going,

    # but not add a lot to the bootup time

    ${curl}/bin/curl \

      -v \

      --retry 3 \

      --retry-delay 1 \

      --fail \

      --connect-timeout 1 \

      -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \

      http://169.254.169.254/1.0/meta-data/instance-id

  }



  try=1

  while [ $try -le 3 ]; do

    echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..."

    IMDS_TOKEN=$(get_imds_token) && break

    try=$((try + 1))

    sleep 1

  done



  if [ "x$IMDS_TOKEN" == "x" ]; then

    echo "failed to fetch an IMDS2v token."

  fi



  try=1

  while [ $try -le 10 ]; do

    echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..."

    preflight_imds_token && break

    try=$((try + 1))

    sleep 1

  done



  echo "getting EC2 instance metadata..."



  wget_imds() {

    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@";

  }



  wget_imds -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path || true

  (umask 077 && wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data || true)

  wget_imds -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname || true

  wget_imds -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key || true

''

nixos/modules/virtualisation/ec2-metadata-fetcher.sh

0 → 100644
+67 −0
Original line number Diff line number Diff line 
metaDir=/etc/ec2-metadata

mkdir -m 0755 -p "$metaDir"

rm -f "$metaDir/*"



get_imds_token() {

  # retry-delay of 1 selected to give the system a second to get going,

  # but not add a lot to the bootup time

  curl \

    --silent \

    --show-error \

    --retry 3 \

    --retry-delay 1 \

    --fail \

    -X PUT \

    --connect-timeout 1 \

    -H "X-aws-ec2-metadata-token-ttl-seconds: 600" \

    http://169.254.169.254/latest/api/token

}



preflight_imds_token() {

  # retry-delay of 1 selected to give the system a second to get going,

  # but not add a lot to the bootup time

  curl \

    --silent \

    --show-error \

    --retry 3 \

    --retry-delay 1 \

    --fail \

    --connect-timeout 1 \

    -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \

    -o /dev/null \

    http://169.254.169.254/1.0/meta-data/instance-id

}



try=1

while [ $try -le 3 ]; do

  echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..."

  IMDS_TOKEN=$(get_imds_token) && break

  try=$((try + 1))

  sleep 1

done



if [ "x$IMDS_TOKEN" == "x" ]; then

  echo "failed to fetch an IMDS2v token."

fi



try=1

while [ $try -le 10 ]; do

  echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..."

  preflight_imds_token && break

  try=$((try + 1))

  sleep 1

done



echo "getting EC2 instance metadata..."



get_imds() {

  # Intentionally no --fail here, so that we proceed even if e.g. a

  # 404 was returned (but we still fail if we can't reach the IMDS

  # server).

  curl --silent --show-error --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@"

}



get_imds -o "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path

(umask 077 && get_imds -o "$metaDir/user-data" http://169.254.169.254/1.0/user-data)

get_imds -o "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname

get_imds -o "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key