cluster-api-provider-aws icon indicating copy to clipboard operation
cluster-api-provider-aws copied to clipboard

No validation done when only `PublicIP == true` but public subnet has `MapPublicIPOnLauch == false`

Open r4f4 opened this issue 11 months ago • 2 comments

/kind bug

What steps did you take and what happened:

  1. Create a shared VPC with private and public subnets, where all public subnets have MapPublicIPOnLaunch == false.
  2. Create an AWSMachine with PublicIP = true and Subnet = nil

What did you expect to happen: CAPA throws an error letting the user know that no public IP will be assigned to the instance.

Instead what happens is the machine only has a private IP assigned and cannot talk to the internet because the internet gateway doesn't provide NAT.

Anything else you would like to add: https://cluster-api-aws.sigs.k8s.io/topics/bring-your-own-aws-infrastructure does not say that having MapPublicIPOnLaunch == true is a requirement for public subnets, even though it expects that. Note that the condition is checked if a subnet ID is set in the AWSMachine spec: https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/pkg/cloud/services/ec2/instances.go#L337-L340

Environment:

  • Cluster-api-provider-aws version: main @ d62768f507f85b25db1e5a74e0e820ed1f8e4414
  • Kubernetes version: (use kubectl version): 1.29
  • OS (e.g. from /etc/os-release): RHCOS

r4f4 avatar Mar 20 '24 14:03 r4f4