From afbb765a7319ac4e75b555006f8200a763900dd0 Mon Sep 17 00:00:00 2001 From: waris shaikh Date: Mon, 23 Feb 2026 09:35:59 -0500 Subject: [PATCH 1/2] fix: set instance_options at launch time for IMDSv2 support OCI security policies can deny instance creation when areLegacyEndpointsDisabled='false' at launch time. The current implementation sets instance_options via update_instance AFTER launch, which fails when such policies are in place. This change adds launch_instance_options to ComputeLaunchDetails to set instance_options in LaunchInstanceDetails, ensuring IMDSv2 is enabled from instance creation. --- lib/kitchen/driver/oci/instance/compute.rb | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lib/kitchen/driver/oci/instance/compute.rb b/lib/kitchen/driver/oci/instance/compute.rb index 47ac1c0..6954b2f 100644 --- a/lib/kitchen/driver/oci/instance/compute.rb +++ b/lib/kitchen/driver/oci/instance/compute.rb @@ -95,6 +95,17 @@ def instance_source_via_boot_volume def instance_metadata launch_details.metadata = metadata end + + # Adds the instance_options property to the launch_details to disable legacy IMDS endpoints at launch time. + # This ensures IMDSv2 is enabled from instance creation, which is required by OCI security policies + # that deny instance creation when areLegacyEndpointsDisabled='false'. + def launch_instance_options + opts = config[:instance_options] || {} + opts[:are_legacy_imds_endpoints_disabled] = true unless opts.key?(:are_legacy_imds_endpoints_disabled) + return if opts.empty? + + launch_details.instance_options = OCI::Core::Models::InstanceOptions.new(opts) + end end end end From 2f9857ffbefd20e753025f9880728c9a5b198d97 Mon Sep 17 00:00:00 2001 From: waris shaikh Date: Mon, 2 Mar 2026 02:00:47 -0500 Subject: [PATCH 2/2] test: update launch request expectations to include instance_options Aligns test expectations with the IMDSv2 launch-time fix by adding instance_options to launch_instance_request and launch_instance_from_bv_request. --- spec/spec_helper/compute_helper.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/spec/spec_helper/compute_helper.rb b/spec/spec_helper/compute_helper.rb index 0678bd5..e7bf1e8 100644 --- a/spec/spec_helper/compute_helper.rb +++ b/spec/spec_helper/compute_helper.rb @@ -55,6 +55,9 @@ nsg_ids: driver_config[:nsg_ids], subnet_id: subnet_ocid ) + l.instance_options = OCI::Core::Models::InstanceOptions.new( + are_legacy_imds_endpoints_disabled: true + ) l.freeform_tags = { kitchen: true } l.defined_tags = {} l.metadata = instance_metadata @@ -83,6 +86,9 @@ nsg_ids: driver_config[:nsg_ids], subnet_id: subnet_ocid ) + l.instance_options = OCI::Core::Models::InstanceOptions.new( + are_legacy_imds_endpoints_disabled: true + ) l.freeform_tags = { kitchen: true } l.defined_tags = {} l.metadata = instance_metadata