Cluster-api-provider-aws: Allow Specifying Internal Subnets for Control Plane

Created on 6 May 2020 · 9Comments · Source: kubernetes-sigs/cluster-api-provider-aws

/kind feature

As a controlPlaneLoadBalancer with a scheme set to internal I would like to be able to specify which subnets that load balancer goes into, because there are security controls expecting it to go into certain subnets.

Describe the solution you'd like
Related to https://github.com/kubernetes-sigs/cluster-api-provider-aws/pull/1714 it's currently just looping through the internal subnets, I'd like to be able to map it intentionally.

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]

Environment:

Cluster-api-provider-aws version:
Kubernetes version: (use kubectl version):
OS (e.g. from /etc/os-release):

arevpc help wanted kinapi-change kinfeature prioritimportant-longterm

Source

voor

All 9 comments

I believe in unmanaged mode you can specify the subnets intentionally in the awscluster.spec.networkSpec.subnets

bagnaram on 18 May 2020

/priority important-longterm

detiber on 18 May 2020

@bagnaram That might fit the use case -- are you saying that if you specify the VPC ID you can specify a subset of subnets to use? @scottslowe made it seem like if you specify a VPC ID it'll ignore the subnets and populate it automatically.

voor on 18 May 2020

@voor @bagnaram It is my understanding (based on conversations I had while creating the content for #1560) that a) the list of subnets isn't required when operating in unmanaged mode, and b) you can't "constrain" CAPA to use only a subset of the subnets by providing the list (it will use all discovered subnets regardless of what you provide).

scottslowe on 18 May 2020

👍1

Just want to confirm that specifying the VPC ID will overwrite and otherwise ignore whatever is in the subnet section. If you try to set something as isPublic for example, it'll just overwrite it with the actual state of the world.

voor on 28 Jun 2020

@voor That is my understanding, yes, although I have not specifically tested the behavior.

scottslowe on 28 Jun 2020

👍1

/help

randomvariable on 14 Aug 2020

@randomvariable:
This request has been marked as needing help from a contributor.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.