Enable `route53_zone_association` #463

ytsarev · 2023-01-24T16:17:00Z

Description of your changes

Addition to Enable vpc selector for Route53 Zone #456
Dedicate ZoneAssociation for more complex ZoneToVPC associations for a complex cases
According to investigation documented at Enable vpc selector for Route53 Zone #456 (comment) we will still need inline vpc field to instantiate private Zone first
Enable vpc selector for Route53 Zone #456 should be merged first so we can ehance ZoneAssociation example

Signed-off-by: Yury Tsarev [email protected]

I have:

Run make reviewable test to ensure this PR is ready for review.

How has this code been tested

Locally e2e, and full cross-account uptest run, see #463 (comment)

ytsarev · 2023-02-02T11:50:24Z

Together with @sergenyalcin and @ulucinar we decided to defer adding the association resource because:

From XRM perspective, we cannot avoid adding the inlined vpc as, to the best of our knowledge, it’s the only way to provision a “private” Route53 zone.
The association resource is discouraged and this is explicitly stated in the Terraform docs. What happens, if some point in time, they deprecate it (maybe after implementing the allegedly missing functionality somewhere else). This may or may not happen of course.
Because we anyways need to add the inline vpc (remember the private Zone constraint), we can always later add the association resource if a customer comes and tell us that the inline vpc functionality cannot cover their use case. But then, we may need to consider extending upjet with support for adding (for instance) the “ignore_changes” lifecycle meta-argument. Currently, if we add the association resource, we cannot implement what Terraform suggests its users to do.

patrickleet · 2023-06-08T20:53:49Z

I need this resource to implement cross-account vpc associations with a zone - it's not possible without this API as the zone needs to exist for the authorization, but can't exist without the authorization as is

ytsarev · 2023-06-08T21:00:20Z

@patrickleet thanks for the feedback, reopening. The PR will need some rebase though.

mmuthukrishnan · 2023-06-09T15:01:02Z

We are looking for the same feature and it will be very helpful for cross account associations of VPC.
@ytsarev

mmuthukrishnan · 2023-06-16T18:11:28Z

@sergenyalcin could you please review the changes. much needed though.
We are planning to have our master control plane controlling clusters in diff aws accounts requiring this cross account VPC associations

haarchri · 2023-06-18T11:12:51Z

we need this feature as well

ytsarev · 2023-06-19T08:22:04Z

/test-examples="examples/route53/zoneassociation.yaml"

* Addition to crossplane-contrib#456 * Dedicate `ZoneAssociation` for more complex ZoneToVPC associations for a complex cases * According to investigation documented at crossplane-contrib#456 (comment) we will still need inline `vpc` field to instantiate private Zone first * crossplane-contrib#456 should be merged first so we can ehance `ZoneAssociation` example Signed-off-by: Yury Tsarev <[email protected]>

ytsarev · 2023-06-19T08:42:19Z

/test-examples="examples/route53/zoneassociation.yaml"

haarchri · 2023-06-19T08:43:57Z

examples-generated/route53/zoneassociation.yaml

+  forProvider:
+    name: example.com
+    region: us-west-1
+    vpc:


@ytsarev in terraform documentation we can find the following:

Terraform provides both this standalone Zone VPC Association resource and exclusive VPC associations defined in-line in the [aws_route53_zone resource](https://registry.terraform.io/providers/hashicorp/aws/2.54.0/docs/resources/route53_zone) via vpc configuration blocks. At this time, you cannot use those in-line VPC associations in conjunction with this resource and the same zone ID otherwise it will cause a perpetual difference in plan output.

so i think we need for the primary vpc also an ZoneAssociation and in Zone resource we need to skip lateinit for vpc field ?

@haarchri thanks a lot for highlighting this one.

This is generated example so I left it as it is.

The crafted/tested example below does not use vpc spec in the Zone
https://github.com/upbound/provider-aws/pull/463/files/febb5711405ed06d4826007feffe3d802a940fd5#diff-0241fdef09239ca9bc31c3f588de9c70b3c894cee80a27fbcc1c5e9b3087b6d8R29-R32 , only in the ZoneAssociation

but i think we need to skip lateinit for vpc field in Zone resource - otherwise the provider will fill it or ?

Hm, not sure, it was good in my local tests without it. Let's wait for uptest-after-half-an-year-rebase :D

Ok, I confirm it's tricky :D crafting the example and possible PR extension

Signed-off-by: Yury Tsarev <[email protected]>

ytsarev · 2023-06-19T11:57:54Z

/test-examples="examples/route53/zoneassociation.yaml"

To test as close cross-account scenario as possible Signed-off-by: Yury Tsarev <[email protected]>

ytsarev · 2023-06-19T16:58:38Z

/test-examples="examples/route53/zoneassociation.yaml"

ytsarev · 2023-06-19T18:10:36Z

the uptest for examples/route53/zoneassociation.yaml is green locally, the failure above is related to restricted access of the test environment(sorting it out).

@haarchri was also so kind to test this change in his cross-account environment to get the full confidence that the implementation works.

ytsarev · 2023-06-20T08:19:08Z

/test-examples="examples/route53/zoneassociation.yaml"

ytsarev · 2023-06-20T11:40:23Z

/test-examples="examples/route53/zoneassociation.yaml"

ytsarev · 2023-06-21T17:54:32Z

/test-examples="examples/route53/zoneassociation.yaml"

ytsarev · 2023-06-21T18:39:31Z

/test-examples="examples/route53/zoneassociation.yaml"

Otherwise full cross-account testing of ZoneAssociation will fail with ``` is not authorized to perform: route53:AssociateVPCWithHostedZone on resource: arn:aws:route53:::hostedzone/ZXXX because no resource-based policy allows the route53:AssociateVPCWithHostedZone action ``` Signed-off-by: Yury Tsarev <[email protected]>

ytsarev · 2023-06-21T20:00:00Z

/test-examples="examples/route53/zoneassociation.yaml"

ytsarev · 2023-06-21T20:42:53Z

/test-examples="examples/route53/zoneassociation.yaml"

ytsarev · 2023-06-21T21:21:23Z

Finally, all green with full cross-account uptest setup :)

@haarchri VPCAssociationAuthorization is the key for cross-account setup, without it ZoneAssociation fails with

is not authorized to perform: route53:AssociateVPCWithHostedZone on resource: arn:aws:route53:::hostedzone/ZXXX because no resource-based policy allows the route53:AssociateVPCWithHostedZone action

Please double check on you side :)

sergenyalcin

Thanks @ytsarev LGTM!

haarchri · 2023-06-22T10:53:36Z

we tested in our environment with multiple accounts - its working
@ytsarev thanks for driving this topic =)

ytsarev · 2023-06-22T11:02:01Z

Thanks a ton for the feedback! Merging :)

mmuthukrishnan · 2023-06-22T11:22:58Z

@haarchri @sergenyalcin @ytsarev Thanks for getting this through. It will be much helpful for us.

mmuthukrishnan · 2023-06-22T11:24:02Z

How long does it take to get reflected in the upbound marketplace docs ?
https://marketplace.upbound.io/providers/upbound/provider-aws/v0.36.0/managed-resources

jeanduplessis · 2023-06-22T12:09:57Z

The next round of provider releases is due on 29 June.

shukla2009 · 2023-08-23T14:31:44Z

Hi , I am trying to use cross accounts zoneassociation and it goes in loop creating and deleting association
This is how TF fixed it hashicorp/terraform-provider-aws#14872

Error Reported something like this
Provider produced inconsistent result after apply: When applying changes to aws_route53_vpc_association_authorization.XXXYYZZ, provider "provider["registry.terraform.io/hashicorp/aws"]" produced an unexpected new value: Root resource was present, but now absent. This is a bug in the provider, which should be reported in the provider's own issue tracker.

ytsarev requested a review from ulucinar January 24, 2023 16:17

ytsarev mentioned this pull request Jan 24, 2023

Enable vpc selector for Route53 Zone #456

Merged

1 task

ytsarev closed this Feb 2, 2023

ytsarev mentioned this pull request Feb 2, 2023

Request for route53 zone_association resource #393

Closed

ytsarev mentioned this pull request Feb 13, 2023

Request for aws_route53_zone_association resource #510

Closed

ytsarev reopened this Jun 8, 2023

ytsarev requested a review from sergenyalcin as a code owner June 8, 2023 21:00

ytsarev force-pushed the r53-zone-assoc-392 branch from 7486a88 to 76f620d Compare June 19, 2023 08:19

ytsarev force-pushed the r53-zone-assoc-392 branch from 76f620d to febb571 Compare June 19, 2023 08:34

haarchri reviewed Jun 19, 2023

View reviewed changes

Make zone private in ZoneAssociation example

7f6f6c4

Signed-off-by: Yury Tsarev <[email protected]>

Add peer providerconfig to ZoneAssociation example

be3dd25

To test as close cross-account scenario as possible Signed-off-by: Yury Tsarev <[email protected]>

ytsarev mentioned this pull request Jun 20, 2023

Provide up-to-date UPTEST_CLOUD_CREDENTIALS export examples #743

Merged

1 task

sergenyalcin approved these changes Jun 22, 2023

View reviewed changes

haarchri approved these changes Jun 22, 2023

View reviewed changes

ytsarev merged commit bcfbe95 into crossplane-contrib:main Jun 22, 2023
8 checks passed

ytsarev deleted the r53-zone-assoc-392 branch June 22, 2023 11:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable `route53_zone_association` #463

Enable `route53_zone_association` #463

ytsarev commented Jan 24, 2023 •

edited

Loading

ytsarev commented Feb 2, 2023

patrickleet commented Jun 8, 2023

ytsarev commented Jun 8, 2023 •

edited

Loading

mmuthukrishnan commented Jun 9, 2023

mmuthukrishnan commented Jun 16, 2023 •

edited

Loading

haarchri commented Jun 18, 2023

ytsarev commented Jun 19, 2023

ytsarev commented Jun 19, 2023

haarchri Jun 19, 2023

ytsarev Jun 19, 2023

haarchri Jun 19, 2023

ytsarev Jun 19, 2023

ytsarev Jun 19, 2023

ytsarev commented Jun 19, 2023

ytsarev commented Jun 19, 2023

ytsarev commented Jun 19, 2023

ytsarev commented Jun 20, 2023

ytsarev commented Jun 20, 2023

ytsarev commented Jun 21, 2023

ytsarev commented Jun 21, 2023

ytsarev commented Jun 21, 2023

ytsarev commented Jun 21, 2023

ytsarev commented Jun 21, 2023

sergenyalcin left a comment

haarchri commented Jun 22, 2023

ytsarev commented Jun 22, 2023

mmuthukrishnan commented Jun 22, 2023

mmuthukrishnan commented Jun 22, 2023

jeanduplessis commented Jun 22, 2023

shukla2009 commented Aug 23, 2023 •

edited

Loading

Enable route53_zone_association #463

Enable route53_zone_association #463

Conversation

ytsarev commented Jan 24, 2023 • edited Loading

Description of your changes

How has this code been tested

ytsarev commented Feb 2, 2023

patrickleet commented Jun 8, 2023

ytsarev commented Jun 8, 2023 • edited Loading

mmuthukrishnan commented Jun 9, 2023

mmuthukrishnan commented Jun 16, 2023 • edited Loading

haarchri commented Jun 18, 2023

ytsarev commented Jun 19, 2023

ytsarev commented Jun 19, 2023

haarchri Jun 19, 2023

Choose a reason for hiding this comment

ytsarev Jun 19, 2023

Choose a reason for hiding this comment

haarchri Jun 19, 2023

Choose a reason for hiding this comment

ytsarev Jun 19, 2023

Choose a reason for hiding this comment

ytsarev Jun 19, 2023

Choose a reason for hiding this comment

ytsarev commented Jun 19, 2023

ytsarev commented Jun 19, 2023

ytsarev commented Jun 19, 2023

ytsarev commented Jun 20, 2023

ytsarev commented Jun 20, 2023

ytsarev commented Jun 21, 2023

ytsarev commented Jun 21, 2023

ytsarev commented Jun 21, 2023

ytsarev commented Jun 21, 2023

ytsarev commented Jun 21, 2023

sergenyalcin left a comment

Choose a reason for hiding this comment

haarchri commented Jun 22, 2023

ytsarev commented Jun 22, 2023

mmuthukrishnan commented Jun 22, 2023

mmuthukrishnan commented Jun 22, 2023

jeanduplessis commented Jun 22, 2023

shukla2009 commented Aug 23, 2023 • edited Loading

Enable `route53_zone_association` #463

Enable `route53_zone_association` #463

ytsarev commented Jan 24, 2023 •

edited

Loading

ytsarev commented Jun 8, 2023 •

edited

Loading

mmuthukrishnan commented Jun 16, 2023 •

edited

Loading

shukla2009 commented Aug 23, 2023 •

edited

Loading