Merge pull request #26 from uswitch/airship-4631/node-problem-detector

Airship 4631: Rewrite to avoid imds

Author: mmcgarr

Dockerfile

@@ -1,16 +1,15 @@
-FROM registry.k8s.io/node-problem-detector/node-problem-detector:v1.35.1
+FROM registry.k8s.io/node-problem-detector/node-problem-detector:v1.35.2
 
 RUN set -eux; \
   apt-get update; \
   apt-get install -y --no-install-recommends \
     # required by plugin/spot_termination.sh
     curl \
-    # required by plugin/launch_config_drift.sh
-    awscli \
+    # required by plugin/local_dns_resolver.sh
     jq \
     # required by local_dns_resolver.sh and upstream_dns_resolver.sh plugins
     dnsutils \
   ; \
   rm -rf /var/lib/apt/lists/*;
 
-COPY config /config
+COPY config /config

config/aws-ec2-asg-lc-drift-plugin-monitor.json

@@ -19,10 +19,7 @@
       "type": "permanent",
       "condition": "NodeLocalDnsResolutionFailure",
       "reason": "NodeLocalDnsResolutionFailing",
-      "path": "./config/plugin/local_dns_resolver.sh",
-      "args": [
-        "kube-dns-upstream.kube-system.svc.cluster.local."
-      ]
+      "path": "./config/plugin/local_dns_resolver.sh"
     }
   ]
 }

config/local-dns-resolver-config.json

@@ -4,7 +4,21 @@ OK=0
 NONOK=1
 UNKNOWN=2
 
-readonly local_dns_resolver_ip="$1"
+if [ -z "${NODE_NAME}" ]; then
+    exit $UNKNOWN
+fi
+
+# Get the node-local-dns pod IP running on this node directly,
+# bypassing 169.254.20.10 which requires Cilium's eBPF path
+local_dns_resolver_ip="$(curl -s \
+    -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
+    --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
+    "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/namespaces/kube-system/pods?labelSelector=k8s-app%3Dnode-local-dns&fieldSelector=spec.nodeName%3D${NODE_NAME}" \
+    2>/dev/null | jq -r '.items[0].status.podIP')"
+
+if [ -z "${local_dns_resolver_ip}" ] || [ "${local_dns_resolver_ip}" = "null" ]; then
+    exit $UNKNOWN
+fi
 
 dig_cmd_out="$(dig -t TXT @"${local_dns_resolver_ip}" +tries=1 +retry=0 +time=33 +noqr +noall +comments kubernetes.default.svc. 2>&1)"
 dig_cmd_return_code="$?"