Add metadata-options to AWS node driver templates

[Oats87]

What kind of request is this (question/bug/enhancement/feature request): Enhancement

Steps to reproduce (least amount of steps as possible): In order to enable IMDSv2 on AWS instances, you must start them using an option like

aws ec2 run-instances \
    --image-id ami-<BLAH> \
    --instance-type c3.large \
    --key-name MyKeyPair \
    --metadata-options "HttpEndpoint=enabled,HttpTokens=required"

specifically the --metadata-options. We should be able to set a value for --metadata-options when provisioning instances using the Rancher Machine AWS EC2 driver.

Result: N/A

The current version of Rancher at the time of filing this request is v2.3.4

[askldjd]

So to work around this limitation, I wrote a cronjob to turn on IMDSv2 in the background as Rancher creates new EC2 nodes. Once the cronjob was implemented, we started seeing high percentage of kubelet failure.

It turns out that kubelet failed to talk to IMDSv2 to resolve AZ information on startup.

Digging a bit deeper, I found out that aws-sdk-go 1.25.38 added support for imdsv2. Based on the godep information, that means only K8s 1.18+ supports IMDSv2.

To workaround this, I would only turn on IMDSv2 after kubelet is up and the node joins the K8s cluster.

[aiyengar2]

Should be able to add httpTokens: required|optional and httpEndpoint: enabled|disabled as flags on a node template now to specify those metadata options within 2.4 head and master head.

[sowmyav27]

Verified on master-head commit id: 217656d19 and 2.4-head commit id: c761bcd4d

• Set the following options in the node template - httpTokens: required|optional and httpEndpoint: enabled|disabled (as a standard user)
• On the node - aws ec2 describe-instances --instance-ids <instance id>

"MetadataOptions": {
                        "State": "applied",
                        "HttpTokens": "required",
                        "HttpPutResponseHopLimit": 1,
                        "HttpEndpoint": "disabled"
                    }

• Validated all possible combinations.

Upgrade from 2.4.5 to 2.4-head

• Deploy an AWS rke cluster
• Upgrade to 2.4-head
• by default the values of httpTokens and httpEndpoint are Optional and Enabled on the existing node
• edit the node template
• change the disk size. Values for httpTokens is Optional and httpEndpoint is Enabled by default.
• Add nodes to the cluster.
• On the new nodes httpTokens is Optional and httpEndpoint is Enabled