Cherry pick 7086 (#7134)

* add changelog

* fix: allow IPv6 EKS Pod Identity host regardless of IMDS endpoint mode

ContainerCredentialsProvider rejects the EKS Pod Identity IPv6 endpoint
(http://[fd00:ec2::23]/v1/credentials) unless AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE
was explicitly set to IPV6. That variable configures the EC2 IMDS endpoint
(169.254.169.254 vs [fd00:ec2::254]) which is (I believe?) a separate subsystem from the container
credentials endpoint and EKS Pod Identity never sets it, so it defaults to the IPv4 allowlist. This behavior rejects valid IPv6 loopback hosts.

This change aligns the Java SDK with the C++, Python (botocore), Go v2, and JS v3 SDKs,
all of which allow the EKS IPv6 host unconditionally.

Related issue: aws/containers-roadmap#2683.

(cherry picked from commit e22c1cd)

---------

Co-authored-by: Jesse Tuglu <jtuglu@netflix.com>

Author: Fred1155

.changes/next-release/bugfix-AWSSDKforJavav2-94cb1c6.json

@@ -0,0 +1,6 @@
+{
+    "type": "bugfix",
+    "category": "AWS SDK for Java v2",
+    "contributor": "jtuglu1",
+    "description": "Fixed an issue where `ContainerCredentialsProvider` rejected the EKS Pod Identity IPv6 endpoint unless `AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE` was set to `IPv6`."
+}

core/auth/src/main/java/software/amazon/awssdk/auth/credentials/ContainerCredentialsProvider.java

@@ -307,11 +307,7 @@ private boolean matchesAllowedHostRules(InetAddress inetAddress) {
         }
 
         public boolean isMetadataServiceEndpoint(String host) {
-            String mode = SdkSystemSetting.AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE.getStringValueOrThrow();
-            if ("IPV6".equalsIgnoreCase(mode)) {
-                return VALID_LOOP_BACK_IPV6.contains(host);
-            }
-            return VALID_LOOP_BACK_IPV4.contains(host);
+            return VALID_LOOP_BACK_IPV4.contains(host) || VALID_LOOP_BACK_IPV6.contains(host);
         }
     }
 

core/auth/src/test/java/software/amazon/awssdk/auth/credentials/ContainerCredentialsEndpointProviderTest.java

@@ -164,6 +164,20 @@ private static Stream<Arguments> requestConstruction() {
                                                .headers(new HashMap<>())
                                                .build())),
 
+            // EKS Pod Identity sets the IPv6 container URI but does NOT set
+            // AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE (that controls IMDS, not the
+            // container credentials endpoint). The IPv6 host must be allowed with the
+            // mode left at its IPv4 default.
+            Arguments.of("http link-local EKS URI with IPv6, default endpoint mode",
+                         Collections.singletonList(Pair.of(FULL_URI_ENV, EKS_CONTAINER_HOST_IPV6 + "/credentials")),
+                         EKS_CONTAINER_HOST_IPV6 + "/credentials",
+                         new Result().type("success").sdkRequest(
+                             SdkHttpFullRequest.builder()
+                                               .uri(URI.create(EKS_CONTAINER_HOST_IPV6 + "/credentials"))
+                                               .method(SdkHttpMethod.GET)
+                                               .headers(new HashMap<>())
+                                               .build())),
+
             Arguments.of("complex full URI",
                          Collections.singletonList(Pair.of(FULL_URI_ENV, COMPLEX_URI)),
                          COMPLEX_URI,