scope support for AWS deployments that have IMDSv1 disabled (Runner group)
Description
AWS is starting to recommend that their customers disable IMDSv1, for example EKS.
Customers who deploy GitLab with IMDSv1 disabled are likely to have a bad experience as some functionality will work, some functionality will not.
It is unclear what runner executors and capabilities depend on IMDS for functionality in AWS, such as obtaining IAM credentials.
- Support for docker machine was added; Issue: gitlab-org/ci-cd/docker-machine#15 (closed), MR: gitlab-org/ci-cd/docker-machine!49 (merged)
- Changing to the AWS SDK !2639 (closed) may resolve this issue.
A non exhaustive list of areas to review:
- Runners - shared cache (it looks like this doesn't work - see #16097 (comment 571694421))
- Runners - uploading artifacts
- Fargate runner executor
- Kubernetes executor
- Support Amazon container registry (ECR) as a source for runner containers
Purpose of this issue is to scope what won't work with IMDSv1 disabled.
This is one of a number of issues around GitLab support for deployments with only IMDSv2 enabled. For more information see the description and comments in: gitlab#334160 (closed)
Proposal
Scope which GitLab components owned by grouprunner use IMDS but won't work with IMDSv1 disabled.
Links to related issues and merge requests / references
Edited by Ben Prescott (ex-GitLab)