use metadata endpoint to get instance info

Author: mmcgarr

config/plugin/launch_config_drift.sh

@@ -4,50 +4,51 @@ OK=0
 NONOK=1
 UNKNOWN=2
 
-# Get instance ID from Kubernetes node providerID
-if [ -z "${NODE_NAME}" ]; then
-    exit $UNKNOWN
-fi
+# Get IMDSv2 token
+TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
+  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" \
+  --max-time 3 --silent --fail 2>/dev/null)
 
-provider_id="$(curl -s -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
-  --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
-  "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/nodes/${NODE_NAME}" \
-  2>/dev/null | jq -r '.spec.providerID')"
-
-if [ -z "${provider_id}" ]; then
+if [ -z "${TOKEN}" ]; then
     exit $UNKNOWN
 fi
 
-# Extract instance ID from providerID (format: aws:///region/instance-id)
-instance_id="$(echo "${provider_id}" | awk -F'/' '{print $NF}')"
+# Get instance ID and launch template from IMDS
+instance_id=$(curl --max-time 3 --silent --fail \
+    -H "X-aws-ec2-metadata-token: $TOKEN" \
+    "http://169.254.169.254/latest/meta-data/instance-id")
 
 if [ -z "${instance_id}" ]; then
     exit $UNKNOWN
 fi
 
-instances="$(aws autoscaling describe-auto-scaling-instances --instance-ids "${instance_id}")"
+instance_launch_template=$(curl --max-time 3 --silent --fail \
+    -H "X-aws-ec2-metadata-token: $TOKEN" \
+    "http://169.254.169.254/latest/meta-data/tags/instance/aws:ec2launchtemplate:id")
+
+instance_asg=$(curl --max-time 3 --silent --fail \
+    -H "X-aws-ec2-metadata-token: $TOKEN" \
+    "http://169.254.169.254/latest/meta-data/tags/instance/aws:autoscaling:groupName")
 
-if [ "$(echo "${instances}" | jq '.AutoScalingInstances | length')" -eq "0" ]
-then
+if [ -z "${instance_asg}" ] || [ -z "${instance_launch_template}" ]; then
     exit $UNKNOWN
 fi
 
-instance="$(echo "${instances}" | jq '.AutoScalingInstances[0]')"
-instance_launch_config="$(echo "${instance}" | jq -r .LaunchTemplate.LaunchTemplateName)"
-instance_asg="$(echo "${instance}" | jq -r .AutoScalingGroupName)"
+# Get ASG's current launch template (still requires AWS API)
+asgs="$(aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names "${instance_asg}" 2>/dev/null)"
 
-asgs="$(aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names ${instance_asg})"
+if [ -z "${asgs}" ] || ! echo "${asgs}" | jq empty 2>/dev/null; then
+    exit $UNKNOWN
+fi
 
-if [ "$(echo "${asgs}" | jq '.AutoScalingGroups | length')" -eq "0" ]
-then
+if [ "$(echo "${asgs}" | jq '.AutoScalingGroups | length')" -eq "0" ]; then
     exit $UNKNOWN
 fi
 
-asg_launch_config="$(echo "${asgs}" | jq -r '.AutoScalingGroups[0].MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification.LaunchTemplateName')"
+asg_launch_template="$(echo "${asgs}" | jq -r '.AutoScalingGroups[0].MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification.LaunchTemplateId')"
 
-if [ "${instance_launch_config}" = "${asg_launch_config}" ]
-then
+if [ "${instance_launch_template}" = "${asg_launch_template}" ]; then
     exit $OK
 else
     exit $NONOK
-fi
+fi

config/plugin/spot_termination.sh

@@ -4,34 +4,18 @@ OK=0
 NONOK=1
 UNKNOWN=2
 
-# Get instance ID from Kubernetes node providerID
-if [ -z "${NODE_NAME}" ]; then
-    exit $UNKNOWN
-fi
+TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
+  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" \
+  --max-time 3 --silent --fail 2>/dev/null)
 
-provider_id="$(curl -s -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
-  --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
-  "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/nodes/${NODE_NAME}" \
-  2>/dev/null | jq -r '.spec.providerID')"
+status_code=$(curl --max-time 3 --silent --output /dev/stderr --write-out "%{http_code}" \
+    -H "X-aws-ec2-metadata-token: $TOKEN" \
+    "http://169.254.169.254/latest/meta-data/spot/instance-action")
 
-if [ -z "${provider_id}" ]; then
-    exit $UNKNOWN
-fi
-
-# Extract instance ID from providerID (format: aws:///region/instance-id)
-instance_id="$(echo "${provider_id}" | awk -F'/' '{print $NF}')"
-
-if [ -z "${instance_id}" ]; then
-    exit $UNKNOWN
-fi
-
-# Check for spot instance interruption via EC2 API
-interruption_time=$(aws ec2 describe-instances --instance-ids "${instance_id}" \
-  --query 'Reservations[0].Instances[0].DisruptionTime' \
-  --output text 2>/dev/null)
-
-if [ "${interruption_time}" = "None" ] || [ -z "${interruption_time}" ]; then
+if [ "${status_code}" -eq "404" ]; then
     exit $OK
-else
+elif [ "${status_code}" -eq "200" ]; then
     exit $NONOK
+else
+    exit $UNKNOWN
 fi