account for disabled legacy metadata endpoints

[dekkagaijin]

What this PR does / why we need it:

GCE allows for users to disable access to legacy (0.1, v1beta1) metadata APIs from within an instance. GKE disables these by default for new 1.12+ clusters. This check allows for the test to know when it should expect a 403 from an unconcealed legacy metadata endpoint.

NONE

[dekkagaijin]

@mikedanese PTAL, this should fix the tests for 1.12

[idealhack]

/ok-to-test

[mikedanese]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dekkagaijin, mikedanese

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• test/images/OWNERS [mikedanese]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mikedanese]

/lgtm

[idealhack]

I guess a PR should be opened to cherry-pick this to 1.12?

[dekkagaijin]

@idealhack will do

[ixdy]

I think for this to have any effect, you need to bump the version in test/images/metadata-concealment/VERSION, then run make -C test/images all-push WHAT=metadata-concealment (from a machine with docker 18.06.0+) and then update test/utils/image/manifest.go to point to the new version.

[ixdy]

@mkumatag I'm forgetting, do we have docs anywhere describing how to update e2e test images? If not, we should probably write some.

[mkumatag]

@mkumatag I'm forgetting, do we have docs anywhere describing how to update e2e test images? If not, we should probably write some.

lemme create a GitHub issue right away - #70165