Merge pull request #58 from fnproject/support-imds-v2

Support oci v2 imds endpoint
fnproject · Jan 24, 2024 · e8ddcd5 · e8ddcd5
2 parents a556df1 + d076ab8
commit e8ddcd5
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 9 deletions.
diff --git a/provider/oracle/ip_provider.go b/provider/oracle/ip_provider.go
@@ -26,10 +26,19 @@ func NewIPProvider(configSource provider.ConfigSource, passphraseSource provider
 	compartmentID := configSource.GetString(CfgCompartmentID)
 	if compartmentID == "" {
 		// Get the local compartment ID from the metadata endpoint
-		resp, err := http.DefaultClient.Get(CompartmentMetadata)
+		req, err := http.NewRequest("GET", CompartmentMetadata, nil)
 		if err != nil {
 			return nil, fmt.Errorf("problem fetching compartment OCID from metadata endpoint %s", err)
 		}
+
+		// IMDS v2 requires authorisation header for any request
+		req.Header.Add("Authorization", "Bearer Oracle")
+
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return nil, fmt.Errorf("problem fetching compartment OCID from metadata endpoint %s", err)
+		}
+
 		body, err := ioutil.ReadAll(resp.Body)
 		if err != nil {
 			return nil, fmt.Errorf("problem fetching compartment OCID from metadata endpoint %s", err)

diff --git a/provider/oracle/oracle_common.go b/provider/oracle/oracle_common.go
@@ -26,9 +26,9 @@ const (
 	CfgCompartmentID                      = "oracle.compartment-id"
 	CfgImageCompartmentID                 = "oracle.image-compartment-id"
 	CfgDisableCerts                       = "oracle.disable-certs"
-	CompartmentMetadata                   = "http://169.254.169.254/opc/v1/instance/compartmentId"
+	CompartmentMetadata                   = "http://169.254.169.254/opc/v2/instance/compartmentId"
 	FunctionsAPIURLTmpl                   = "https://functions.%s.oci.%s"
-	realmDomainMetadata                   = "http://169.254.169.254/opc/v1/instance/regionInfo/realmDomainComponent"
+	realmDomainMetadata                   = "http://169.254.169.254/opc/v2/instance/regionInfo/realmDomainComponent"
 	requestHeaderOpcRequestID             = "Opc-Request-Id"
 	requestHeaderOpcCompId                = "opc-compartment-id"
 	requestHeaderOpcOboToken              = "opc-obo-token"
@@ -47,11 +47,11 @@ const (
 )
 
 type Response struct {
-	Annotations   Annotations `json:"annotations"`
-	CreatedAt     string      `json:"created_at"`
-	UpdatedAt     string      `json:"updated_at"`
-	Name          string      `json:"name"`
-	Shape         string      `json:shape`
+	Annotations Annotations `json:"annotations"`
+	CreatedAt   string      `json:"created_at"`
+	UpdatedAt   string      `json:"updated_at"`
+	Name        string      `json:"name"`
+	Shape       string      `json:shape`
 }
 
 type Annotations struct {
@@ -220,7 +220,16 @@ func GetRealmDomain() (string, error) {
 	client := &http.Client{
 		Timeout: time.Second * 10,
 	}
-	resp, err := client.Get(realmDomainMetadata)
+
+	req, err := http.NewRequest("GET", realmDomainMetadata, nil)
+	if err != nil {
+		return "", fmt.Errorf("problem fetching realm domain from metadata endpoint %s", err)
+	}
+
+	// IMDS v2 requires authorisation header for any request
+	req.Header.Add("Authorization", "Bearer Oracle")
+
+	resp, err := client.Do(req)
 	if err != nil {
 		return "", fmt.Errorf("problem fetching realm domain from metadata endpoint %s", err)
 	}