ENI Config Label/Annotation Def Concatenation

[tanguyfalconnet]

What would you like to be added: Currently, with Custom Networking, VPC CNI can easily use one subnet and security group per AZ when reading failure-domain.beta.kubernetes.io/zone label. But if we want to use multiple custom network per AZ, we can't rely on only one label. We should be able to concanate labels/annotations in ENI_CONFIG_LABEL_DEF and ENI_CONFIG_ANNOTATION_DEF.

Example of ENIConfig with 3 subnets : name : eu-west-1a, subnet : 10.0.0.0/18 name : eu-west-1b, subnet : 10.0.64.0/18 name : eu-west-1c, subnet : 10.0.128.0/18 ENI_CONFIG_LABEL_DEF = failure-domain.beta.kubernetes.io/zone

Example of ENIConfig with 6 subnets : name : sub1-eu-west-1a, subnet : 10.0.0.0/18 name : sub1-eu-west-1b, subnet : 10.0.64.0/18 name : sub1-eu-west-1c, subnet : 10.0.128.0/18 name : sub2-eu-west-1a, subnet : 10.1.0.0/18 name : sub2-eu-west-1b, subnet : 10.1.64.0/18 name : sub2-eu-west-1c, subnet : 10.1.128.0/18 ENI_CONFIG_LABEL_DEF = some_label_containing_sub_name,failure-domain.beta.kubernetes.io/zone

Why is this needed: We would like to be able to use more IPs than provided by three /18 subnets for our pods.

[prabhushan]

This is really needed.. Can anyone check the status of this one?

[jayanthvn]

Hi,

Sure I can discuss internally and we will prioritize this, so instead of sub1-eu-west-1a and sub2-eu-west-1a would it be fine if we have list of subnets something like -

cat <<EOF | kubectl apply -f -
apiVersion: crd.k8s.amazonaws.com/v1alpha1
kind: ENIConfig
metadata:
 name: $AZ2
spec:
  securityGroups: 
    - sg-xxxxxxxxxxxx
  subnet: 
    - $CUST_SNET1
    - $CUST_SNET2
EOF

[niroowns]

Hi @jayanthvn - any update on this?

[jayanthvn]

@niroowns - Sorry we haven't got a chance to look into this enhancement. I will take a look next month and provide an update.

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days

[sidewinder12s]

This is still a requirement.

[technotaff-nbs]

I was about to raise a ticket suggesting this feature and found it has already been requested.

This feature is required, we need to have the option of a per-nodeGroup subnet and/or security group.

Currently all the options are per-cluster (via ENVIRONMENT_VARIABLES), we need some way or extending the ENIConfig name with a prefix or suffix via a node label!

e.g. "k8s.amazonaws.com/eniConfigSuffix" = "-pci"

Would force vpc-cni in eu-west-2a to use the ENIConfig called "eu-west-2a-pci".

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days

[sidewinder12s]

/remove-lifecycle stale

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days

[elasticdotventures]

stale=not