Instance metadata settings

The instance metadata service answers guests at 169.254.169.254 from tritonagent on each compute node. This page lists what an operator controls and what to look for when it does not answer. The tenant-facing routes and keys are in the instance metadata service reference. How the request reaches the agent is in Architecture.

Cluster settings

Set with tritonadm config set, from any host with a configured tritonadm.

Key	Type	Default	Effect
imds.enabled_default	Boolean	true	Whether an instance gets the service when no scope sets config/imds/enabled.
imds.hop_limit_default	Integer, 1 to 64	1	Intended default for config/imds/hop-limit. At this revision, nothing reads it: replies use 1 unless a scope sets the key.

tritond reads imds.enabled_default from the stored settings each time it compiles an instance port's network configuration, so a change applies without a restart, although tritonadm config get reports restart: yes. Set it with tritonadm config set. An environment variable on tritond does not change it, because the port compile does not consult environment overrides.

For example, to make the service opt-in across the cluster:

tritonadm config set imds.enabled_default false

Metadata keys

These two keys can be set at any scope. tritonadm meta reaches all four scopes, including silo. Tenants set them at tenant, project, or instance scope with tritonctl meta, and a narrower scope overrides a wider one.

Key	Type	Effect
config/imds/enabled	Boolean	false turns the service off for the instances under the scope.
config/imds/hop-limit	Integer, 1 to 64	IP time-to-live, or IPv6 hop limit, of every reply.

To turn the service off for every instance in one silo:

tritonadm meta set --scope silo --id <SILO> --key config/imds/enabled --value false

<SILO> is the silo name, UUID, or UUID prefix. A tenant can still set config/imds/enabled to true at tenant, project, or instance scope, and that setting wins for its instances.

Two paths read config/imds/enabled:

Path	When	Effect of false
Port compile in tritond	Each time the instance port's network configuration is compiled	No metadata route and no punt rule on the port. Requests to the metadata address are dropped, and the guest times out.
Request handling in tritonagent	Every request, through a 30-second cache	PUT /latest/api/token and the GET routes answer 404, imds disabled. Paths under /latest/dynamic/iam answer 404, not found, and DELETE /triton/guest/<KEY> answers 501, as they do when the service is on.

When no scope sets the key, the compile path uses imds.enabled_default. When tritond cannot build the instance's metadata view at all, the compile path treats the service as off. The agent path treats a missing key as true, and also uses true when it cannot reach tritond.

On the compute node

tritonagent starts the service at startup when it holds the per-compute-node token key, which signs and verifies every guest session token. tritond generates the key when it issues the node's credential and re-delivers it at each registration. The agent writes it beside its credential file, so issued tokens stay valid across a reboot of the compute node.

Item	Value
Credential file	/var/lib/tritonagent/credentials, or --credential-path / TRITONAGENT_CREDENTIAL_PATH
Token key file	imds-credentials.json in the same directory, mode 0600, with the key as 64 hex characters in imds_token_key_hex
Metadata reads	GET /internal/v1/agent/instances/{instance_id}/realized-meta on tritond
Guest writes	/internal/v1/agent/instances/{instance_id}/meta on tritond

tritond answers both agent calls only for instances hosted on the calling compute node, or migrating to it, and answers 404 for any other instance.

Log lines from tritonagent that mean the service is not running:

Log line	Cause
imds: disabled (no token key)	The agent has no token key.
registration response carried no IMDS token key; IMDS is unavailable for this CN	tritond returned no key at registration.
tritond returned a malformed IMDS token key; IMDS disabled	The key from tritond was not 64 hex characters.

An agent that resumes from an existing credential file reads the key from imds-credentials.json. When that file is missing, or has no imds_token_key_hex, the agent runs without the service.

See also

• Architecture for the agent, the dataplane, and the control plane.
• tritonadm config for config set, get, and reset.
• tritonadm command index for tritonadm meta.