f67bb43a7a
Access to AWS Metadata may be configured in three distinct ways: 1 - Optional HTTP tokens and HTTP endpoint enabled: The default as it works today 2 - Required HTTP tokens and HTTP endpoint enabled: Which support is entirely missing today 3 - HTTP endpoint disabled: Which effectively forbids one to use Ec2Snitch or Ec2MultiRegionSnitch This commit makes the 2nd option the default which is not only AWS recommended option, but is also entirely compatible with the 1st option. In addition, we now validate the HTTP response when querying the IMDS server. Therefore - should a HTTP 403 be received - Scylla will properly notify users on what they are trying to do incorrectly in their setup. The commit was tested under the following circumstances (covering all 3 variants): - Ec2Snitch: IMDSv2 optional & required, and HTTP server disabled. - Ec2MultiRegionSnitch: IMDSv2 optional & required, and HTTP server disabled. Refs: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html https://github.com/scylladb/scylladb/issues/9987 Fixes: https://github.com/scylladb/scylladb/issues/10490 Closes: https://github.com/scylladb/scylladb/issues/10490 Closes #11636
38 lines
1.2 KiB
C++
38 lines
1.2 KiB
C++
/*
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*
|
|
* Modified by ScyllaDB
|
|
* Copyright (C) 2015-present ScyllaDB
|
|
*/
|
|
#pragma once
|
|
|
|
#include "locator/production_snitch_base.hh"
|
|
#include <seastar/http/response_parser.hh>
|
|
#include <seastar/net/api.hh>
|
|
|
|
namespace locator {
|
|
class ec2_snitch : public production_snitch_base {
|
|
public:
|
|
static constexpr const char* TOKEN_REQ_ENDPOINT = "/latest/api/token";
|
|
static constexpr const char* ZONE_NAME_QUERY_REQ = "/latest/meta-data/placement/availability-zone";
|
|
static constexpr const char* AWS_QUERY_SERVER_ADDR = "169.254.169.254";
|
|
static constexpr uint16_t AWS_QUERY_SERVER_PORT = 80;
|
|
|
|
ec2_snitch(const snitch_config&);
|
|
virtual future<> start() override;
|
|
virtual sstring get_name() const override {
|
|
return "org.apache.cassandra.locator.Ec2Snitch";
|
|
}
|
|
protected:
|
|
future<> load_config(bool prefer_local);
|
|
future<sstring> aws_api_call(sstring addr, uint16_t port, const sstring cmd, std::optional<sstring> token);
|
|
future<sstring> read_property_file();
|
|
private:
|
|
connected_socket _sd;
|
|
input_stream<char> _in;
|
|
output_stream<char> _out;
|
|
http_response_parser _parser;
|
|
sstring _req;
|
|
};
|
|
} // namespace locator
|