Detect AWS region for S3 inside containers

[hakman]

AWS detection assumes that /sys/devices/virtual/dmi/id/product_uuid is readable. This is not the case inside containers like kops-controller. If there is an error reading the file, AWS api should be queried anyway as a fallback.

Fixes: #9856

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hakman

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [hakman]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[johngmyers]

Another possibility would be to set AWS_REGION in the manifest.

[hakman]

Another possibility would be to set AWS_REGION in the manifest.

This is a more generic fix that will work in any container and I don't think it has any downside.

[johngmyers]

Some security systems block access to AWS metadata from pods in order to deny them use of the node's IAM roles.

[hakman]

Some security systems block access to AWS metadata from pods in order to deny them use of the node's IAM roles.

Ok, I would still leave this as is and create a new PR that adds AWS_REGION to env vars. Sounds reasonable?

[w3irdrobot]

Can confirm this works.

➜ k -n kube-system logs $(k -n kube-system get po -l k8s-app=kops-controller -o name)
...
I0904 14:23:11.412699       1 s3context.go:328] unable to read /sys/devices/virtual/dmi/id/product_uuid, assuming not running on EC2: open /sys/devices/virtual/dmi/id/product_uuid: permission denied
I0904 14:23:11.415665       1 s3context.go:166] got region from metadata: "us-west-1"
I0904 14:23:11.478280       1 s3context.go:213] found bucket in region "us-west-1"
...

Slack convo link

[hakman]

@johngmyers any thoughts on merging this?

[johngmyers]

/lgtm

[ryan-dyer-sp]

@hakman @johngmyers Can we get this back ported to 1.18? without this change the ability to use kops to deploy to aws govcloud regions is broken; at least without needing to manually update the kops-controller DS to include the AWS_REGION env.

[hakman]

@ryan-dyer-sp already cherry-picked into 1.18, will take another 2-4 for a new release. I hope this is ok for you.