Skip to content

Use IMDS for local node zone in InstancesV2 #9648

@jmclong

Description

@jmclong

Is your feature request related to a problem?/Why is this needed

This is a new feature request to use IMDS in InstanceMetadata function call when the node is local

Describe the solution you'd like in detail

The InstancesV2 API provides zone information via the InstanceMetadata method, which replaced the deprecated Zones API.

However, InstanceMetadata always queries the Azure Resource Manager (ARM) API, even for the local node. This requires Azure RBAC permissions (Microsoft.Resources/subscriptions/providers/read) that may not be available in all environments.

Could an optimization be added to use IMDS when querying the local node, similar to how InstanceID is implemented? This would allow retrieving zone information for the local node without requiring Azure credentials, matching the behavior of the previous Zones.GetZone method.

Additional Context

version: sigs.k8s.io/cloud-provider-azure v1.25.4

zone, err := az.GetZoneByNodeName(ctx, types.NodeName(node.Name))
if err != nil {
klog.Errorf("InstanceMetadata: failed to get the node zone of %s: %v", node.Name, err)
return &cloudprovider.InstanceMetadata{}, err
}

InstanceID call example with this optimization when az.UseInstanceMetadata is true

func (az *Cloud) InstanceID(ctx context.Context, name types.NodeName) (string, error) {
nodeName := mapNodeNameToVMName(name)
unmanaged, err := az.IsNodeUnmanaged(nodeName)
if err != nil {
return "", err
}
if unmanaged {
// InstanceID is same with nodeName for unmanaged nodes.
klog.V(4).Infof("InstanceID: getting ID %q for unmanaged node %q", name, name)
return nodeName, nil
}
if az.UseInstanceMetadata {
metadata, err := az.Metadata.GetMetadata(ctx, azcache.CacheReadTypeDefault)
if err != nil {
return "", err
}
if metadata.Compute == nil {
return "", fmt.Errorf("failure of getting instance metadata")
}
isLocalInstance, err := az.isCurrentInstance(name, metadata.Compute.Name)
if err != nil {
return "", err
}
// Not local instance, get instanceID from Azure ARM API.
if !isLocalInstance {
if az.VMSet != nil {
return az.VMSet.GetInstanceIDByNodeName(ctx, nodeName)
}
// vmSet == nil indicates credentials are not provided.
return "", fmt.Errorf("no credentials provided for Azure cloud provider")
}
return az.getLocalInstanceProviderID(metadata, nodeName)
}
return az.VMSet.GetInstanceIDByNodeName(ctx, nodeName)
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions