Support AWS Instance profiles

Hello machine-controller folks,

we're using kubeone to deploy k8s clusters, and we understand it uses machine-controller behind the scenes to create worker nodes. We're struggling a bit in making this work in our AWS setup as we're heavily relying on assuming roles in different accounts, rather having a IAM user that can access directly an underlying account.

Credentials in the environment where we're running kubeone are thus STS short-lived creds that last 8 hours maximum, and not too useful to be injected in machine-controller since it will stop working when the creds expire. We were hoping we could resort to the instance profile - it has enough permissions to create ec2 instances and so on - but editing the secrets out of the machine-controller deployment cause errors like the below:

E1001 10:23:25.552776       1 metrics.go:149] failed to call prov.SetInstanceNumberForMachines: errors: [failed to get EC2 instances: EmptyStaticCreds: static credentials are empty]
I1001 10:23:48.785995       1 migrations.go:147] CRD machines.machine.k8s.io not present, no migration needed
I1001 10:23:48.786014       1 migrations.go:53] Starting to migrate providerConfigs to providerSpecs
I1001 10:23:48.819680       1 migrations.go:135] Successfully migrated providerConfigs to providerSpecs
I1001 10:23:48.819734       1 plugin.go:97] looking for plugin "machine-controller-userdata-centos"
I1001 10:23:48.819761       1 plugin.go:125] checking "/usr/local/bin/machine-controller-userdata-centos"
I1001 10:23:48.819848       1 plugin.go:138] found '/usr/local/bin/machine-controller-userdata-centos'
I1001 10:23:48.819858       1 plugin.go:97] looking for plugin "machine-controller-userdata-coreos"
I1001 10:23:48.819870       1 plugin.go:125] checking "/usr/local/bin/machine-controller-userdata-coreos"
I1001 10:23:48.819889       1 plugin.go:138] found '/usr/local/bin/machine-controller-userdata-coreos'
I1001 10:23:48.819897       1 plugin.go:97] looking for plugin "machine-controller-userdata-ubuntu"
I1001 10:23:48.819908       1 plugin.go:125] checking "/usr/local/bin/machine-controller-userdata-ubuntu"
I1001 10:23:48.819926       1 plugin.go:138] found '/usr/local/bin/machine-controller-userdata-ubuntu'
E1001 10:25:18.192498       1 machine.go:360] Failed to reconcile machine "xxxxx-xxxxx-xxxx-5-xx-xxxx-xx-7d49b65947-6kkg5": failed to get instance from provider: failed to list instances from aws, due to EmptyStaticCreds: static credentials are empty

It feels like this is caused by the fact that https://github.com/kubermatic/machine-controller/blob/d925fa6e6b00fd7f09a7290cd04a10ba8928838e/pkg/cloudprovider/provider/aws/provider.go#L326 goes for static credentials directly, instead of using a credentials chain via ChainProvider (https://docs.aws.amazon.com/sdk-for-go/api/aws/credentials/#ChainProvider) that could fall back to the instance profile.

Do you have any plans of supporting instance profiles? It would simplify a lot credentials management when dealing with clusters in AWS!

Happy to help if we can.

Best,
Dario

Start in pkg/cloudprovider/provider/aws/provider.go around line 326 and review how AWS credentials are constructed, alongside the reported EmptyStaticCreds errors. Compare that path with the AWS SDK for Go ChainProvider documentation; done means machine-controller can use an instance profile when static credentials are absent without those errors.