Skip to content

fix: allow IPv6 EKS Pod Identity host regardless of IMDS endpoint mode#7086

Open
jtuglu1 wants to merge 1 commit into
aws:masterfrom
jtuglu1:fix-credential-refresh-for-pod-identity-with-ipv6
Open

fix: allow IPv6 EKS Pod Identity host regardless of IMDS endpoint mode#7086
jtuglu1 wants to merge 1 commit into
aws:masterfrom
jtuglu1:fix-credential-refresh-for-pod-identity-with-ipv6

Conversation

@jtuglu1

@jtuglu1 jtuglu1 commented Jun 26, 2026

Copy link
Copy Markdown

ContainerCredentialsProvider rejects the EKS Pod Identity IPv6 endpoint (http://[fd00:ec2::23]/v1/credentials) unless AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE was explicitly set to IPV6. That variable configures the EC2 IMDS endpoint (169.254.169.254 vs [fd00:ec2::254]) which is (I believe?) a separate subsystem from the container credentials endpoint and EKS Pod Identity never sets it, so it defaults to the IPv4 allowlist. This behavior rejects valid IPv6 loopback hosts.

This change aligns the Java SDK with the C++, Python (botocore), Go v2, and JS v3 SDKs, all of which allow the EKS IPv6 host unconditionally.

Related issue: aws/containers-roadmap#2683.

Motivation and Context

Modifications

Testing

Screenshots (if appropriate)

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)

Checklist

  • I have read the CONTRIBUTING document
  • Local run of mvn install succeeds
  • My code follows the code style of this project
  • My change requires a change to the Javadoc documentation
  • I have updated the Javadoc documentation accordingly
  • I have added tests to cover my changes
  • All new and existing tests passed
  • I have added a changelog entry. Adding a new entry must be accomplished by running the scripts/new-change script and following the instructions. Commit the new file created by the script in .changes/next-release with your changes.
  • My change is to implement 1.11 parity feature and I have updated LaunchChangelog

License

  • I confirm that this pull request can be released under the Apache 2 license

ContainerCredentialsProvider rejects the EKS Pod Identity IPv6 endpoint
(http://[fd00:ec2::23]/v1/credentials) unless AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE
was explicitly set to IPV6. That variable configures the EC2 IMDS endpoint
(169.254.169.254 vs [fd00:ec2::254]) which is (I believe?) a separate subsystem from the container
credentials endpoint and EKS Pod Identity never sets it, so it defaults to the IPv4 allowlist. This behavior rejects valid IPv6 loopback hosts.

This change aligns the Java SDK with the C++, Python (botocore), Go v2, and JS v3 SDKs,
all of which allow the EKS IPv6 host unconditionally.

Related issue: aws/containers-roadmap#2683.
@jtuglu1 jtuglu1 requested a review from a team as a code owner June 26, 2026 23:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant