Fix GCP label issues

[atburke]

This change:

• Fixes Teleport starting up on isolated cloud nodes.
• Changes imds errors to logs in lib/service, so an unexpected imds error doesn't prevent Teleport from starting.

Fixes #42312.

Changelog: Fixed crashes related to importing GCP labels

[zmb3]

So if this fails, are we going to continue to call GetTags on a periodic basis and continue to return the same error over and over again?

[atburke]

For getNumericID() in particular, it's called in IsAvailable(), so if it fails (e.g. because we're on Yandex) Teleport won't create a GCP metadata client at all. In general, yes errors here are returned periodically, but we only log them once.

teleport/lib/labels/cloud.go

Lines 147 to 158 in a420d8b

	func (l *CloudImporter) Sync(ctx context.Context) error {
	tags, err := l.Client.GetTags(ctx)
	if err != nil {
	if trace.IsNotFound(err) || trace.IsAccessDenied(err) {
	// Only show the error the first time around.
	l.instanceTagsNotFoundOnce.Do(func() {
	l.Log.Warning(l.instanceMetadataHint)
	})
	return nil
	}
	return trace.Wrap(err)
	}

[greedy52]

How does this fix #42312?

[atburke]

It doesn't, that issue is fixed by the logging changes in lib/service (I originally also tried to parse the *url.Errors, but per feedback on this PR I removed that as it was redundant).

[greedy52]

how does the logging change fix that?

I see, now we are just logging the error instead of failing. Ignore this comment.

[greedy52]

How does this fix #42312?

[klizhentas]

This PR is closed as Yandex Cloud is not supported. The fix should be rescoped to address

GCP and AWS only.

#42312

Please resubmit once you address the comments and changes.

[roman-timoshevskii]

Hi @klizhentas,

According to the documentation Teleport should work on any k8s deployment including bare-metal installations as far as I understand.
So why we cannot just configure it not to check some specific clouds related metadata?
It worked for years in our cloud and now we cannot just update it anymore because of this issue.

Could you please tell if there's any chance to implement some workaround so we can continue using it as before?

Thanks in advance.

[drybalka-s]

I confirm that Yandex Cloud has broken since version 15.3.6
error example

WARN falling back to IMDSv1: operation error ec2imds: getToken, http response error StatusCode: 405, request to EC2 IMDS failed
ERROR: initialization failed
  strconv.ParseUint: parsing "fv53ug7t483ddt97mnih": invalid syntax