OCPCLOUD-2710: implement extended AWS metadata service options

go.mod

@@ -2,6 +2,8 @@ module github.com/openshift/machine-api-provider-aws
 
 go 1.24.0
 
+replace github.com/openshift/api => ../api
+
 require (
 	github.com/aws/aws-sdk-go v1.55.8
 	github.com/blang/semver v3.5.1+incompatible

go.sum

@@ -355,8 +355,6 @@ github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns
 github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
 github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
 github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
-github.com/openshift/api v0.0.0-20251205114208-5eb46a7b4ce8 h1:kF1HhMhHSpipdHjHm92WngUCxhNC4Iy7wbF6RL739w0=
-github.com/openshift/api v0.0.0-20251205114208-5eb46a7b4ce8/go.mod h1:d5uzF0YN2nQQFA0jIEWzzOZ+edmo6wzlGLvx5Fhz4uY=
 github.com/openshift/client-go v0.0.0-20251202151200-fb4471581cf8 h1:97rgISdT4IOmXlmEUV5Wr6d8BzzjPclzAjCARLbSlT0=
 github.com/openshift/client-go v0.0.0-20251202151200-fb4471581cf8/go.mod h1:WVJnsrbSO1J8x8KceOmv1d5CpoN34Uzsaz1O4MIOKJI=
 github.com/openshift/cluster-api-actuator-pkg/testutils v0.0.0-20250910145856-21d03d30056d h1:+sqUThLi/lmgT5/scmmjnS6+RZFtbdxRAscNfCPyLPI=

pkg/actuators/machine/instances.go

@@ -719,6 +719,7 @@ func constructInstancePlacement(machine *machinev1beta1.Machine, machineProvider
 func getInstanceMetadataOptionsRequest(providerConfig *machinev1beta1.AWSMachineProviderConfig) *ec2.InstanceMetadataOptionsRequest {
 	imdsOptions := &ec2.InstanceMetadataOptionsRequest{}
 
+	// Handle Authentication (HttpTokens)
 	switch providerConfig.MetadataServiceOptions.Authentication {
 	case "":
 		// not set, let aws to pick a default. `optional` at this point.
@@ -729,6 +730,31 @@ func getInstanceMetadataOptionsRequest(providerConfig *machinev1beta1.AWSMachine
 		imdsOptions.HttpTokens = aws.String(ec2.HttpTokensStateRequired)
 	}
 
+	// Handle HTTPEndpoint
+	if providerConfig.MetadataServiceOptions.HTTPEndpoint != nil {
+		switch *providerConfig.MetadataServiceOptions.HTTPEndpoint {
+		case machinev1beta1.HTTPEndpointEnabled:
+			imdsOptions.HttpEndpoint = aws.String(ec2.InstanceMetadataEndpointStateEnabled)
+		case machinev1beta1.HTTPEndpointDisabled:
+			imdsOptions.HttpEndpoint = aws.String(ec2.InstanceMetadataEndpointStateDisabled)
+		}
+	}
+
+	// Handle HTTPPutResponseHopLimit
+	if providerConfig.MetadataServiceOptions.HTTPPutResponseHopLimit != nil {
+		imdsOptions.HttpPutResponseHopLimit = providerConfig.MetadataServiceOptions.HTTPPutResponseHopLimit
+	}
+
+	// Handle InstanceMetadataTags
+	if providerConfig.MetadataServiceOptions.InstanceMetadataTags != nil {
+		switch *providerConfig.MetadataServiceOptions.InstanceMetadataTags {
+		case machinev1beta1.InstanceMetadataTagsEnabled:
+			imdsOptions.InstanceMetadataTags = aws.String(ec2.InstanceMetadataTagsStateEnabled)
+		case machinev1beta1.InstanceMetadataTagsDisabled:
+			imdsOptions.InstanceMetadataTags = aws.String(ec2.InstanceMetadataTagsStateDisabled)
+		}
+	}
+
 	if *imdsOptions == (ec2.InstanceMetadataOptionsRequest{}) {
 		// return nil instead of empty struct if there is no options set
 		return nil

pkg/actuators/machine/instances_test.go

@@ -1416,6 +1416,104 @@ func TestGetInstanceMetadataOptionsRequest(t *testing.T) {
 			},
 			expected: nil,
 		},
+		{
+			name: "http endpoint enabled",
+			providerConfig: &machinev1beta1.AWSMachineProviderConfig{
+				MetadataServiceOptions: machinev1beta1.MetadataServiceOptions{
+					HTTPEndpoint: ptr.To(machinev1beta1.HTTPEndpointEnabled),
+				},
+			},
+			expected: &ec2.InstanceMetadataOptionsRequest{
+				HttpEndpoint: aws.String(ec2.InstanceMetadataEndpointStateEnabled),
+			},
+		},
+		{
+			name: "http endpoint disabled",
+			providerConfig: &machinev1beta1.AWSMachineProviderConfig{
+				MetadataServiceOptions: machinev1beta1.MetadataServiceOptions{
+					HTTPEndpoint: ptr.To(machinev1beta1.HTTPEndpointDisabled),
+				},
+			},
+			expected: &ec2.InstanceMetadataOptionsRequest{
+				HttpEndpoint: aws.String(ec2.InstanceMetadataEndpointStateDisabled),
+			},
+		},
+		{
+			name: "http put response hop limit set to 1",
+			providerConfig: &machinev1beta1.AWSMachineProviderConfig{
+				MetadataServiceOptions: machinev1beta1.MetadataServiceOptions{
+					HTTPPutResponseHopLimit: aws.Int64(1),
+				},
+			},
+			expected: &ec2.InstanceMetadataOptionsRequest{
+				HttpPutResponseHopLimit: aws.Int64(1),
+			},
+		},
+		{
+			name: "http put response hop limit set to 64",
+			providerConfig: &machinev1beta1.AWSMachineProviderConfig{
+				MetadataServiceOptions: machinev1beta1.MetadataServiceOptions{
+					HTTPPutResponseHopLimit: aws.Int64(64),
+				},
+			},
+			expected: &ec2.InstanceMetadataOptionsRequest{
+				HttpPutResponseHopLimit: aws.Int64(64),
+			},
+		},
+		{
+			name: "instance metadata tags enabled",
+			providerConfig: &machinev1beta1.AWSMachineProviderConfig{
+				MetadataServiceOptions: machinev1beta1.MetadataServiceOptions{
+					InstanceMetadataTags: ptr.To(machinev1beta1.InstanceMetadataTagsEnabled),
+				},
+			},
+			expected: &ec2.InstanceMetadataOptionsRequest{
+				InstanceMetadataTags: aws.String(ec2.InstanceMetadataTagsStateEnabled),
+			},
+		},
+		{
+			name: "instance metadata tags disabled",
+			providerConfig: &machinev1beta1.AWSMachineProviderConfig{
+				MetadataServiceOptions: machinev1beta1.MetadataServiceOptions{
+					InstanceMetadataTags: ptr.To(machinev1beta1.InstanceMetadataTagsDisabled),
+				},
+			},
+			expected: &ec2.InstanceMetadataOptionsRequest{
+				InstanceMetadataTags: aws.String(ec2.InstanceMetadataTagsStateDisabled),
+			},
+		},
+		{
+			name: "all options set",
+			providerConfig: &machinev1beta1.AWSMachineProviderConfig{
+				MetadataServiceOptions: machinev1beta1.MetadataServiceOptions{
+					Authentication:          machinev1beta1.MetadataServiceAuthenticationRequired,
+					HTTPEndpoint:            ptr.To(machinev1beta1.HTTPEndpointEnabled),
+					HTTPPutResponseHopLimit: aws.Int64(32),
+					InstanceMetadataTags:    ptr.To(machinev1beta1.InstanceMetadataTagsEnabled),
+				},
+			},
+			expected: &ec2.InstanceMetadataOptionsRequest{
+				HttpTokens:              aws.String(ec2.HttpTokensStateRequired),
+				HttpEndpoint:            aws.String(ec2.InstanceMetadataEndpointStateEnabled),
+				HttpPutResponseHopLimit: aws.Int64(32),
+				InstanceMetadataTags:    aws.String(ec2.InstanceMetadataTagsStateEnabled),
+			},
+		},
+		{
+			name: "mixed authentication and new fields",
+			providerConfig: &machinev1beta1.AWSMachineProviderConfig{
+				MetadataServiceOptions: machinev1beta1.MetadataServiceOptions{
+					Authentication:          machinev1beta1.MetadataServiceAuthenticationOptional,
+					HTTPPutResponseHopLimit: aws.Int64(5),
+					InstanceMetadataTags:    ptr.To(machinev1beta1.InstanceMetadataTagsEnabled),
+				},
+			},
+			expected: &ec2.InstanceMetadataOptionsRequest{
+				HttpTokens:              aws.String(ec2.HttpTokensStateOptional),
+				HttpPutResponseHopLimit: aws.Int64(5),
+				InstanceMetadataTags:    aws.String(ec2.InstanceMetadataTagsStateEnabled),
+			},
+		},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {