OCPBUGS-85153 AWS custom security groups should address SG quotas#111466
OCPBUGS-85153 AWS custom security groups should address SG quotas#111466bscott-rh wants to merge 5 commits into
Conversation
|
/retest |
openshift-ci
Bot
added
the
size/S
openshift-ci
Bot
added
size/M
tthvo
left a comment
tthvo
left a comment
There was a problem hiding this comment.
LGTM. I just have some suggestions (nits) :D
tthvo
left a comment
tthvo
left a comment
There was a problem hiding this comment.
/lgtm
Looks great from my end 👍
mdeore
left a comment
mdeore
left a comment
There was a problem hiding this comment.
I have a few suggestions to improve clarity and understanding.
| |Security Groups on network interfaces | ||
| |Varies | ||
| |5 per network interface | ||
| |By default, {aws-short} allows 5 security groups per network interface. If you are installing a cluster into an existing VPC, and you add 3 or more additional security groups in the `install-config.yaml` file, the installation will fail. The installation will result in a `SecurityGroupsPerInterfaceLimitExceeded` error. You must increase the quota of security groups per network interface to a number equal to `3 + the number of additional security groups`, because the installation program creates 3 security groups for the control plane nodes. The maximum allowed quota is 16. |
There was a problem hiding this comment.
Suggestion:
By default, {aws-short} allows 5 security groups per network interface. If you are installing a cluster into an existing VPC and add 3 or more additional security groups in the install-config.yaml file, the installation completes successfully, but the additional security groups are applied only to compute nodes and not to control plane nodes and resulting in a SecurityGroupsPerInterfaceLimitExceeded error in installation logs. You must increase the quota for security groups per network interface to 3 + the number of additional security groups, because the installation program creates 3 security groups for the control plane nodes and 2 + the number of additional security groups for the compute nodes. The maximum supported quota is 16.
There was a problem hiding this comment.
-
Stating that the installation will fail is somewhat misleading for customers, because the installation completes successfully; however, the additional security groups are not applied to the control plane nodes.
-
As these security groups are also added to worker nodes, we should also add this
2 + the number of additional security groupsinformation.
|
|
||
| [IMPORTANT] | ||
| ==== | ||
| By default, {aws-short} allows 5 security groups per network interface. If you are installing a cluster into an existing VPC, and you add 3 or more additional security groups in the `install-config.yaml` file, the installation will fail. The installation will result in a `SecurityGroupsPerInterfaceLimitExceeded` error. |
There was a problem hiding this comment.
Suggestion:
By default, {aws-short} allows 5 security groups per network interface. If you are installing a cluster into an existing VPC and add 3 or more additional security groups in the install-config.yaml file, the installation completes successfully, but the additional security groups are applied only to compute nodes and not to control plane nodes, resulting in a SecurityGroupsPerInterfaceLimitExceeded error in installation logs. You must increase the quota for security groups per network interface to 3 + the number of additional security groups, because the installation program creates 3 security groups for the control plane nodes and 2 + the number of additional security groups for the compute nodes. The maximum supported quota is 16.
|
New changes are detected. LGTM label has been removed. |
|
@bscott-rh: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
5 participants
Version(s):
4.22
Issue:
https://redhat.atlassian.net/browse/OCPBUGS-85153
Link to docs preview:
Account limits
Optional: Security groups
QE review:
This PR also moves some links to Additional Resources to satisfy Vale.