fix: skip IMDS credential discovery in _make_cognito_client#11
Merged
Conversation
On non-EC2 hosts (e.g., Home Assistant Yellow), the EC2 instance metadata endpoint at 169.254.169.254 can accept TCP connections but never send a response. When the Cognito IdToken expires and a refresh is needed, boto3 runs the full credential-provider chain — including an IMDS lookup — inside run_in_executor. The hanging thread blocks for the full OS-level TCP timeout, which exceeds the integration's 20-second async_setup budget and causes a spurious ConfigEntryNotReady. Cognito user-pool auth flows (CUSTOM_AUTH, REFRESH_TOKEN_AUTH) don't require AWS IAM credentials for public clients, so disabling IMDS via metadata_service_num_attempts=0 is safe. Also adds explicit connect and read timeouts to bound the Cognito API calls themselves.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On non-EC2 hosts (notably Home Assistant Yellow running HAOS), the EC2 instance metadata endpoint at
169.254.169.254accepts TCP connections but never responds. When the cached Cognito IdToken expires, the auth refresh path calls_make_cognito_client()in a thread viarun_in_executor. Boto3 runs its full credential-provider chain — including an IMDS lookup — which hangs for the OS-level TCP timeout, far exceeding the integration's 20-secondasyncio_setupbudget.Result: integration enters
setup_retrywith"Timed out fetching initial Quilt snapshot"on every HA restart after token expiry, even though the Quilt cloud is reachable.Fix
metadata_service_num_attempts=0on the botocore session to skip IMDS entirely.connect_timeout=5, read_timeout=15to bound the Cognito API calls.Cognito user-pool flows (
CUSTOM_AUTH,REFRESH_TOKEN_AUTH) don't require AWS IAM credentials for public clients, so disabling IMDS is safe.Deployment
After merge, push tag
v0.5.2to trigger the release workflow and PyPI publish. Then updatequilt-hp-python>=0.5.2in the HA integration manifest.