During the refresh process an error response from IMDS can be treated as an "empty" response and incorrectly set up policy routes.
The results in the removal of ec2net_alias.conf which breaks the connectivity on the secondary ip addresses.
In most cases, amazon-ec2-net-utils will not touch this config if there is an IMDS transient error because it will fail to complete the previous step of identifying device-numberand exit early. However, if device-number identification from IMDS succeeds and but then getting local-ipv4s fails, we run into this issue.
Jul 3 09:10:33 <hostname> systemd[1]: Starting refresh-policy-routes@ens6.service - Refresh policy routes for ens6...
Jul 3 09:10:33 <hostname> ec2net[<pid>]: Starting configuration refresh for ens6
Jul 3 09:10:33 <hostname> ec2net[<pid>]: Got IMDSv2 token for interface ens6 from http://169.254.169.254/latest via ens6
Jul 3 09:10:33 <hostname> ec2net[<pid>]: [get_meta] Querying IMDS for mac
Jul 3 09:10:33 <hostname> ec2net[<pid>]: [get_meta] Querying IMDS for network/interfaces/macs/<mac-address>/network-card
Jul 3 09:10:33 <hostname> ec2net[<pid>]: [get_meta] Querying IMDS for network/interfaces/macs/<mac-address>/device-number
Jul 3 09:10:34 <hostname> ec2net[<pid>]: Using existing cfgfile /run/systemd/network/70-ens6.network
Jul 3 09:10:34 <hostname> ec2net[<pid>]: [get_meta] Querying IMDS for network/interfaces/macs/<mac-address>/local-ipv4s
Jul 3 09:10:34 <hostname> ec2net[<pid>]: [get_meta] Querying IMDS for network/interfaces/macs/<mac-address>/ipv4-prefix
Jul 3 09:10:39 <hostname> ec2net[<pid>]: [get_meta] Querying IMDS for network/interfaces/macs/<mac-address>/local-ipv4s
Jul 3 09:10:39 <hostname> ec2net[<pid>]: install_and_reload removed: /run/systemd/network/70-ens6.network.d/ec2net_alias.conf
We are implementing a fix that validates the IMDS response in this case to gracefully retry and fail without impacting currently configured routes.
During the refresh process an error response from IMDS can be treated as an "empty" response and incorrectly set up policy routes.
The results in the removal of
ec2net_alias.confwhich breaks the connectivity on the secondary ip addresses.In most cases,
amazon-ec2-net-utilswill not touch this config if there is an IMDS transient error because it will fail to complete the previous step of identifyingdevice-numberand exit early. However, if device-number identification from IMDS succeeds and but then getting local-ipv4s fails, we run into this issue.We are implementing a fix that validates the IMDS response in this case to gracefully retry and fail without impacting currently configured routes.