eksctl
eksctl copied to clipboard
Add validation error when using private subnets with privateNetworking disabled
Description
Consider the following situation:
- we specify, by name, as instructed by docs, a private subnet within a certain nodegroup

- the same private subnet is specified as part of the VPC config we have within ClusterConfig
privateNetworkingis disabled
Since privateNetworking is disabled, we'd only be trying to map our subnet name to id by iterating through the public subnets configured as part of the VPC. Afterwards, since we're unable to map to the correct ID, we'd query the EC2 API by name, instead of ID, resulting in a subnet not found error. But in reality, the subnet might actually exist.
With this PR we're changing our mapping approach and will try to map the subnet name to id by looking both into the private and public subnet lists specified within the VPC, regardless of privateNetworking status. From here 2 cases arise.
- a private subnet name is used alongside
privateNetworking:false, thus we return an error - a public subnet name is used alongside
privateNetworking:true, thus we give the user a warning, as this scenario is totally possible and it is user's responsibility to make sure they only use private subnets in this case.
Closes: #5465
Manual tests
- Using private subnet with
privateNetworking:false
managedNodeGroups:
- name: kube-system-workers-5
desiredCapacity: 0
maxSize: 1
instanceType: m5.large
subnets:
- "project-subnet-private1-eu-north-1a"
privateNetworking: false
tiberiu-weave@192-168-0-100 eksctl % ./eksctl create nodegroup --config-file examples/01-simple-cluster.yaml
Error: could not find public subnets: could not select subnets from subnet IDs … subnet project-subnet-private1-eu-north-1a is specified as private in ClusterConfig, thus must only be used when `privateNetworking` is enabled
- Using public subnet with
privateNetworking:true
managedNodeGroups:
- name: kube-system-workers-5
desiredCapacity: 0
maxSize: 1
instanceType: m5.large
subnets:
- "project-subnet-public2-eu-north-1b"
privateNetworking: true
tiberiu-weave@192-168-0-100 eksctl % ./eksctl create nodegroup --config-file examples/01-simple-cluster.yaml
2022-09-16 12:20:17 [!] public subnet project-subnet-public2-eu-north-1b is being used with privateNetworking enabled, please ensure this is the desired behaviour
- When no VPC is specified within ClusterConfig, and, a private subnet is being used with
privateNetworking:false. In this case, CloudFormation already returns a relevant error.
tiberiu-weave@192-168-0-100 eksctl % eksctl create nodegroup --config-file examples/01-simple-cluster.yaml
2022-09-16 12:23:14 [✖] found mis-configured or non-public subnets ["subnet-0ce3025dd0af87062"]. Expected public subnets with property "MapPublicIpOnLaunch" enabled. Without it new nodes won't get an IP assigned
Checklist
- [x] Added tests that cover your change (if possible)
- [ ] Added/modified documentation as required (such as the
README.md, or theuserdocsdirectory) - [x] Manually tested
- [x] Made sure the title of the PR is a good description that can go into the release notes
- [x] (Core team) Added labels for change area (e.g.
area/nodegroup) and kind (e.g.kind/improvement)
BONUS POINTS checklist: complete for good vibes and maybe prizes?! :exploding_head:
- [ ] Backfilled missing tests for code in same general area :tada:
- [ ] Refactored something and made the world a better place :star2: