-
Notifications
You must be signed in to change notification settings - Fork 300
Description
Is your feature request related to a problem?/Why is this needed
This is a new feature request to use IMDS in InstanceMetadata function call when the node is local
Describe the solution you'd like in detail
The InstancesV2 API provides zone information via the InstanceMetadata method, which replaced the deprecated Zones API.
However, InstanceMetadata always queries the Azure Resource Manager (ARM) API, even for the local node. This requires Azure RBAC permissions (Microsoft.Resources/subscriptions/providers/read) that may not be available in all environments.
Could an optimization be added to use IMDS when querying the local node, similar to how InstanceID is implemented? This would allow retrieving zone information for the local node without requiring Azure credentials, matching the behavior of the previous Zones.GetZone method.
Additional Context
version: sigs.k8s.io/cloud-provider-azure v1.25.4
cloud-provider-azure/pkg/provider/azure_instances_v2.go
Lines 137 to 141 in a253418
| zone, err := az.GetZoneByNodeName(ctx, types.NodeName(node.Name)) | |
| if err != nil { | |
| klog.Errorf("InstanceMetadata: failed to get the node zone of %s: %v", node.Name, err) | |
| return &cloudprovider.InstanceMetadata{}, err | |
| } |
InstanceID call example with this optimization when az.UseInstanceMetadata is true
cloud-provider-azure/pkg/provider/azure_instances_v1.go
Lines 290 to 330 in 4a7333f
| func (az *Cloud) InstanceID(ctx context.Context, name types.NodeName) (string, error) { | |
| nodeName := mapNodeNameToVMName(name) | |
| unmanaged, err := az.IsNodeUnmanaged(nodeName) | |
| if err != nil { | |
| return "", err | |
| } | |
| if unmanaged { | |
| // InstanceID is same with nodeName for unmanaged nodes. | |
| klog.V(4).Infof("InstanceID: getting ID %q for unmanaged node %q", name, name) | |
| return nodeName, nil | |
| } | |
| if az.UseInstanceMetadata { | |
| metadata, err := az.Metadata.GetMetadata(ctx, azcache.CacheReadTypeDefault) | |
| if err != nil { | |
| return "", err | |
| } | |
| if metadata.Compute == nil { | |
| return "", fmt.Errorf("failure of getting instance metadata") | |
| } | |
| isLocalInstance, err := az.isCurrentInstance(name, metadata.Compute.Name) | |
| if err != nil { | |
| return "", err | |
| } | |
| // Not local instance, get instanceID from Azure ARM API. | |
| if !isLocalInstance { | |
| if az.VMSet != nil { | |
| return az.VMSet.GetInstanceIDByNodeName(ctx, nodeName) | |
| } | |
| // vmSet == nil indicates credentials are not provided. | |
| return "", fmt.Errorf("no credentials provided for Azure cloud provider") | |
| } | |
| return az.getLocalInstanceProviderID(metadata, nodeName) | |
| } | |
| return az.VMSet.GetInstanceIDByNodeName(ctx, nodeName) | |
| } |