Installer: AWS Shared VPC

[patrickdillon]

with private hosted zones in a separate account.

Installer poc PR: openshift/installer#7161

[patrickdillon]

First draft is up for early review,

[gcs278]

Looks good thanks

[patrickdillon]

Bumped this to make the primary suggestion updating the DNS config rather than the infrastructure config, which has been moved to the alternative section.

Also added some minor discussion around how we have a very limited number of existing clusters using this setup that might benefit from adopting the functionality outlined here. My biggest questions are around day 2 support.

[mtulio]

Overall looks good, I have minimal suggestions with regard to the further possibilities of using external credentials.

[mtulio]

@patrickdillon is there any claim for having the Public Hosted Zone (baseDomain) in another account?
Is the installer search for baseDomain to discover the HostedZoneId and create the records?
I wonder if there are restrictive customers that would like to keep the publicHostedZone in another account too (I can see in Azure that has a field specifying the Resource Group of the baseDomain/zone).

Thinking about that as we are introducing that external/extra authentication on installer, do you think that would be a good idea to structure the config for future requests? Having something like:

platform:
  aws:
    hostedZone: Z0743278N5ELJPLYA3H6 
    externalCredentials:
      hostedZone:
        iamRole: arn:aws:iam::<account-a>:role/<role-name>

Thinking on that structure, we could allow us to expand for future needs for something like:

baseDomain: example.com
platform:
  aws:
    hostedZone: Z0743278N5ELJPLYA3H6 
    externalCredentials:
      hostedZone:
        role: arn:aws:iam::<account-a>:role/<role-name>
      baseDomain:
        role: arn:aws:iam::<account-x>:role/<role-name>

Expanding a little bit more, but may require more permissions in external accounts: if we would like to teach the installer to create a cluster in shared VPC, creating the resources (fully automated), the following structure may be more flexible:

baseDomain: example.com
platform:
  aws:
    externalResources:
      sharedVPC:  # triggers the automation to create the VPC, subnets, GWs, and subnet resource sharing
        role: arn:aws:iam::<account-a>:role/<role-name>
      hostedZone:
        role: arn:aws:iam::<account-a>:role/<role-name>
      baseDomain:
        role: arn:aws:iam::<account-x>:role/<role-name>

I know that the last scenario could generate a lot of changes on installer, but it seems some scenario that could be exercised by our customers.

[patrickdillon]

is there any claim for having the Public Hosted Zone (baseDomain) in another account?

I don't believe so, but I am also looking for a definitive answer. The reason I don't believe this is the case, is because with a public zone, if the authoritative dns zone belongs to a different account, users should already be able to delegate to another public DNS zone in the cluster account.

[mrunalp]

@deads2k @JoelSpeed ptal for API review.

[JoelSpeed]

API structure generally looks good and anything I would add would likely be nits, can iron those out via the o/api PR

Few other nits while reading through but no major concerns from my side

[JoelSpeed]

Have you considered a feature gate?

Do we often backport features? Especially when they include API changes as described here?

[patrickdillon]

Added details on feature gate.

Do we often backport features? Especially when they include API changes as described here?

No, but this is being prioritized as an exception.

[mrunalp]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mrunalp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [mrunalp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@patrickdillon: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.