Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara mengaktifkan emulator IMDS, yang mengemulasi layanan metadata instance (IMDS) AWS. Anda dapat menjalankan
emulator sebagai sidecar untuk memungkinkan workload lama berjalan di
node pool GKE di AWS. Jika Anda memiliki workload lama yang tidak mendukung Workload Identity Federation untuk GKE secara langsung, gunakan emulator ini untuk mengakses data IMDS.
Batasan
Cluster Anda harus menggunakan Kubernetes versi 1.24 atau yang lebih baru.
Server emulator IMDS hanya melayani permintaan kredensial
(API_VERSION/meta-data/iam/security-credentials/). Semua permintaan metadata lainnya
akan menampilkan error 404.
Deployment sidecar memerlukan container init untuk memiliki NET_ADMIN dan
NET_RAWkapasitas konteks keamanan.
Jika Anda tidak yakin apakah penampung memiliki konteks ini, hubungi tim keamanan Anda.
Token AWS STS dapat bertahan selama satu jam. Token peran dari metadata EC2
dapat bertahan selama 24 jam. Hal ini tidak akan memengaruhi penggunaan emulator Anda, tetapi Anda mungkin perlu mengetahui informasi ini selama audit keamanan.
Emulator IMDS hanya mengemulasi respons IMDSv1. IMDSv2 tidak didukung.
Mengaktifkan emulator
Untuk mengaktifkan emulator IMDS, tambahkan label dan anotasi ke metadata untuk
Pod. Anda juga dapat mengaktifkan emulator menggunakan Deployment, DaemonSet, atau resource lain yang membuat Pod:
Satu-satunya nilai yang dapat diterima untuk label ini adalah True. Semua nilai lainnya
(termasuk true dengan t huruf kecil) akan menonaktifkan emulator.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-07-31 UTC."],[],[],null,["# Enable the IMDS emulator\n\nThis page explains how you can enable the IMDS emulator, which emulates the AWS\ninstance metadata service (IMDS). You can run the\nemulator as a sidecar to enable legacy workloads to run in\nGKE on AWS node pools. If you have legacy workloads that don't\nsupport Workload Identity Federation for GKE directly, use this emulator to access IMDS data.\n\nLimitations\n-----------\n\n- Your cluster must use a Kubernetes version of 1.24 or later.\n- The emulator is not supported in the [previous generation](/kubernetes-engine/multi-cloud/docs/aws/previous-generation) of GKE on AWS.\n- The IMDS emulator server only serves credential requests (`API_VERSION/meta-data/iam/security-credentials/`). All other metadata requests return a 404 error.\n- A sidecar deployment requires the init container to have the `NET_ADMIN` and `NET_RAW` [security context capacities](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). If you're not sure if the container has these contexts, consult your security team.\n- The AWS STS token can last for one hour. The role token from EC2 metadata can last for 24 hours. This shouldn't affect your usage of the emulator, but you might need to know this information during a security audit.\n- The IMDS emulator only emulates IMDSv1 responses. IMDSv2 is not supported.\n\nEnable the emulator\n-------------------\n\nTo enable the IMDS emulator, add a label and an annotation to metadata for a\nPod. You can also enable the emulator using a Deployment, DaemonSet, or any\nother resource that creates Pods:\n\n1. Add the following label and value to your Pod:\n\n gkemulticloud.googleapis.com/aws-imds-emulator-enabled: \"True\"\n\n The only acceptable value for this label is `True`. All other values\n (including `true` with a lowercase `t`) disable the emulator.\n2. Add the following annotation to your Pod:\n\n gkemulticloud.googleapis.com/aws-imds-emulator-role-arn: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eARN_ROLE\u003c/span\u003e\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eARN_ROLE\u003c/var\u003e with an Amazon Resource Name\n (ARN) that specifies the role that you want the resource to have.\n\n### Example\n\nThe following example is a Pod with the IMDS emulator enabled: \n\n apiVersion: v1\n kind: Pod\n metadata:\n name: nginx\n labels:\n gkemulticloud.googleapis.com/aws-imds-emulator-enabled: \"True\"\n annotations:\n gkemulticloud.googleapis.com/aws-imds-emulator-role-arn: \"arn:aws:iam::123456789012:role/my-example-role\"\n spec:\n serviceAccountName: my-sa\n containers:\n - name: nginx\n image: nginx"]]
