• bug is open, matching expected state (open)
• bug target release (4.6.0) matches configured target release for branch (4.6.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1875773: ci-operator/step-registry/ipi/conf/aws/blackholenetwork/blackhole_vpc_yaml: Add EC2 endpoint

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

• ci-operator/step-registry/ipi/conf/aws/blackholenetwork/OWNERS [ewolinetz,wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

In response to this:

The machine-API currently ignores the proxy configuration, although future machine-API might grow support for it. That means CI jobs in the blackhole VPC die on i/o timeouts trying to reach https://ec2.${region}.amazonaws.com/ while provisioning compute machines, and the install subsequently dies because we fail to schedule monitoring, ingress, and other compute-hosted workloads. This commit adds a VPC endpoint to allow EC2 access from inside the cluster. It's similar to the existing S3 VPC endpoint, but:

• It's an interface type, while S3 needs the older gateway type. This avoids:

   Endpoint type (Gateway) does not match available service types ([Interface]). (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameter; Request ID: ...; Proxy: null)
  

  while creating the stack.

• There are no RouteTableIds, because the interface type does not support them. This avoids:

   Route table IDs are only supported for Gateway type VPC Endpoint. (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameter; Request ID: ...; Proxy: null)
  

  while creating the stack.

Rolled out to the CI account following 9b39dd2 (#10355):

for REGION in us-east-1 us-east-2 us-west-1 us-west-2
do
 COUNT=3
 if test us-west-1 = "${REGION}"
 then
   COUNT=2
 fi
 for INDEX in 1
 do
   NAME="do-not-delete-shared-vpc-blackhole-${INDEX}"
   aws --region "${REGION}" cloudformation update-stack --stack-name "${NAME}" --template-body "$(cat ci-operator/step-registry/ipi/conf/aws/blackholenetwork/blackhole_vpc_yaml.md)" --parameters "ParameterKey=AvailabilityZoneCount,ParameterValue=${COUNT}" >/dev/null
   aws --region "${REGION}" cloudformation wait stack-update-complete --stack-name "${NAME}"
   SUBNETS="$(aws --region "${REGION}" cloudformation describe-stacks --stack-name "${NAME}" | jq -c '[.Stacks[].Outputs[] | select(.OutputKey | endswith("SubnetIds")).OutputValue | split(",")[]]' | sed "s/\"/'/g")"
   echo "${REGION}_$((INDEX - 1))) subnets=\"${SUBNETS}\";;"
 done
done

We could also have deleted the previous stacks, used create-stack instead of update-stack, and used stack-create-complete instead of stack-update-complete.

Unsurprisingly, since we were not updating the subnets themselves, the output has not changed:

us-east-1_0) subnets="['subnet-0a7491aa76f9b88d7','subnet-0f0b2dcccdcbc7c1d','subnet-0680badf68cbf198c','subnet-02b25dd65f806e41b','subnet-010235a3bff34cf6f','subnet-085c78d8c562b5a51']";;
us-east-2_0) subnets="['subnet-0ea117d9499ef624f','subnet-00adc83d4719d4176','subnet-0b9399990fa424d7f','subnet-060d997b25f5bb922','subnet-015f4e65b0ef1b0e1','subnet-02296b47817923bfb']";;
us-west-1_0) subnets="['subnet-0d003f08a541855a2','subnet-04007c47f50891b1d','subnet-02cdb70a3a4beb754','subnet-0d813eca318034290']";;
us-west-2_0) subnets="['subnet-05d8f8ae35e720611','subnet-0f3f254b13d40e352','subnet-0e23da17ea081d614','subnet-0f380906f83c55df7','subnet-0a2c5167d94c1a5f8','subnet-01375df3b11699b77']";;

so no need to update ipi-conf-aws-blackholenetwork-commands.sh.

I generated the reaper keep-list following 1b21187 (#6949):

for REGION in us-east-1 us-east-2 us-west-1 us-west-2
do
 for INDEX in 1
 do
   NAME="do-not-delete-shared-vpc-blackhole-${INDEX}"
   aws --region "${REGION}" resourcegroupstaggingapi get-resources --tag-filters "Key=aws:cloudformation:stack-name,Values=${NAME}" --query 'ResourceTagMappingList[].ResourceARN[]' | jq -r ".[] | . + \"  # CI exclusion per DPP-4108, ${REGION} ${NAME}\""
 done
done | sort

and passed that along to the Developer Productivity Platform (DPP) folks so they can update their reaper config.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

In response to this:

Bug 1875773: ci-operator/step-registry/ipi/conf/aws/blackholenetwork/blackhole_vpc_yaml: Add EC2 endpoint

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.