Conversation
The info file reports a per-credential delivery status keyed by "<taskID>-<roleType>". A value of "0" means the provider assumed the role and wrote a credential file; any other value means no credential file was written for that entry. Parse this status and fetch a credential file only for entries marked delivered. Drop the role ARN from the info-file model and from TaskCredential, since it is no longer published in the info file. The refresher stores the task's own role ARN with the credential.
Update the scanner unit tests, refresher tests, and the mock IMDS
server to the delivery-status info file: entries map to a status
string ("0" for delivered) instead of a role ARN, and the credential
model no longer carries a role ARN. Add a case covering an entry not
marked delivered being skipped, and drop the role-ARN cross-check
cases that no longer apply.
The info file marks a credential with status "1" when the provider could not assume the role, so no credential file was written. Surface these roles from the scanner in a ScanResult alongside the retrieved credentials, so a consumer can distinguish a stale credential the customer must remediate from a broken delivery path. Add credentials-manager tracking keyed by credentials id (SetAssumeRoleFailedCredentials / IsCredentialsAssumeRoleFailed). A role marked failed leaves any credentials already held in place, and is cleared when credentials arrive for the id or the id is removed. The Docker-based agent only logs this for debugging; it does not track the roles in its credentials manager, since no metric is wired for emission.
Update the scanner tests to the ScanResult return type and cover a status "1" entry being recorded as an unassumable role rather than fetched, plus an unrecognized status being skipped. Add credentials manager tests for the failed-role tracking and its clearing on credential delivery or removal, and adapt the refresher test to the ScanResult scan output.
The IMDS query rate and scan interval were validated by load testing; remove the TODOs noting the values were pending it. The values are unchanged.
Mark the IMDS scanner, credentials manager, and refresher unit tests (and their subtests) with t.Parallel(). Each test and subtest builds its own mocks and manager and shares no mutable state, so they are safe to run concurrently. Verified with -race.
singholt
force-pushed
the
imds-credential-delivery-status
branch
from
September 18, 2026 21:32
d04f465 to
aea766c
Compare
singholt
marked this pull request as ready for review
September 18, 2026 23:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR updates how the ECS agent reads rotated task credentials from IMDS to match the new info-file contract.
The info file now maps each
taskID-roleTypeto a delivery status ("0"delivered,"1"the provider could not assume the role). The role ARN will no longer be delivered in IMDS. Its not needed as the agent gets that from ECS control-plane.The change is split into small commits to make review easier.
Functional commits
imds: parse credential delivery status from info file: read the per-credential status, fetch a credential file only for delivered ("0") entries, and drop the role ARN from the info-file model and the scanned credential.imds: track roles the provider could not assume: surface"1"roles from the scanner in aScanResult, and track them in the credentials manager (cleared when credentials arrive or the id is removed).imds: drop resolved load-testing TODOs: remove the TODOs now that the scan rate and interval are validated. Values are unchanged.Test commits
imds: update tests for delivery-status info file: update the scanner and refresher unit tests, the mock IMDS server, and the refresher integration test for the new contract.imds: tests for unassumable-role tracking: cover the"1"path in the scanner, the credentials manager, and end-to-end in the integration test.imds: run credential scanner and refresher tests in parallel: mark the tests and subtests witht.Parallel().Vendor commit
vendor: regenerate agent vendor for IMDS credential changes: isolated vendor sync so the functional and test commits stay vendor-free.Implementation details
"1"(no credential file exists for them), and skips unrecognized statuses.Testing
New tests cover the changes: yes, added/updated unit and integ tests
Description for the changelog
Enhancement - IMDS credentials refresher: read task credential delivery status from IMDS and skip roles the provider could not assume. (disabled in production)
Additional Information
Does this PR include breaking model changes? If so, Have you added transformation functions? No
Does this PR include the addition of new environment variables in the README? No
Licensing
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.