mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 09:01:31 +00:00
Josh Siviour
b9898a7e88
Spinifex rejected HttpTokens=optional and served 401 to every untokened GET, which is stricter than AWS, whose own default is optional. That made Windows guests impossible: cloudbase-init is the only realistic Windows bootstrap agent and its EC2Service has no IMDSv2 token support in any released version, so a Windows instance never received its hostname, injected password or user-data. HttpTokens is now settable at launch and via ModifyInstanceMetadataOptions, accepting optional or required. The launch default stays required, so an instance that does not ask for IMDSv1 never gets it. Every other metadata-option field keeps its existing rejection. The untokened path is reachable without credentials, so the per-instance lookup is cached with a short TTL; without that a guest could drive unbounded DescribeInstances fan-outs. A valid token short-circuits before the lookup, so compliant IMDSv2 clients are unaffected.