Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable vpc selector for Route53 Zone #456

Merged
merged 1 commit into from
Feb 2, 2023

Conversation

ytsarev
Copy link
Collaborator

@ytsarev ytsarev commented Jan 19, 2023

Description of your changes

Follow the instuctions at https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association

Unless explicit association ordering is required (e.g., a separate cross-account association authorization), usage of this resource is not recommended. Use the vpc configuration blocks available within the aws_route53_zone resource instead.

and rely on the Zone resource for VPC association

  • Enable vpc section of Zone resource
  • It makes it compliant with community provider-aws HostedZone resource so ease the migration
  • Document disablement of route53_vpc_association resource
  • Remove route53_vpc_association related configuration

Signed-off-by: Yury Tsarev [email protected]

Fixes #392

I have:

  • Run make reviewable test to ensure this PR is ready for review.

How has this code been tested

@ytsarev ytsarev requested a review from ulucinar January 19, 2023 18:46
Follow the instuctions at https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association
```
Unless explicit association ordering is required (e.g., a separate cross-account association authorization), usage of this resource is not recommended. Use the vpc configuration blocks available within the aws_route53_zone resource instead.
```

and rely on the Zone resource for VPC association

* Enable `vpc` section of `Zone` resource
* It makes it compliant with community provider-aws HostedZone resource
  so ease the migration
* Document disablement of `route53_vpc_association` resource
* Remove `route53_vpc_association` related configuration

Signed-off-by: Yury Tsarev <[email protected]>
@ulucinar
Copy link
Collaborator

We had an offline discussion with @ytsarev and decided to continue by introducing the route53_vpc_association resource (due to XRM).

@ytsarev
Copy link
Collaborator Author

ytsarev commented Jan 24, 2023

@ulucinar it appeared to be a more tricky situation than we expected.

I enabled aws_route53_zone_association and tried to associate it with the zone

It failed with

    Message:               apply failed: error associating Route 53 Hosted Zone (Z003019637S1O3ZUFVPU8) to EC2 VPC (vpc-031f35532a485eb6e): PublicZoneVPCAssociation: Attempting to associate public zone: Z003019637S1O3ZUFVPU8 with vpc: vpc-031f35532a485eb6e

According to https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association , VPC associations can only be made on private zones..

The next obvious question is how to make the zone private.

If we look at https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone#private-zone the private zone is getting enabled by the inline vpc association.

So we have a chicken-egg problem here and it looks like we need both inline and dedicated association styles.

ytsarev added a commit to ytsarev/provider-aws-upbound that referenced this pull request Jan 24, 2023
* Addition to crossplane-contrib#456
* Dedicate `ZoneAssociation` for more complex ZoneToVPC associations for
  a complex cases
* According to investigation documented at crossplane-contrib#456 (comment)
  we will still need inline `vpc` field to instantiate private Zone
first
* crossplane-contrib#456 should be merged first so we can ehance `ZoneAssociation` example

Signed-off-by: Yury Tsarev <[email protected]>
@ytsarev ytsarev mentioned this pull request Jan 24, 2023
1 task
@ytsarev
Copy link
Collaborator Author

ytsarev commented Jan 24, 2023

Just opened #463 for dedicated route53_zone_association creation

Copy link
Collaborator

@sergenyalcin sergenyalcin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @ytsarev LGTM!

@ytsarev ytsarev merged commit d1f9ce4 into crossplane-contrib:main Feb 2, 2023
@ytsarev ytsarev deleted the r53-zone-392 branch February 2, 2023 11:47
ytsarev added a commit to ytsarev/provider-aws-upbound that referenced this pull request Jun 19, 2023
* Addition to crossplane-contrib#456
* Dedicate `ZoneAssociation` for more complex ZoneToVPC associations for
  a complex cases
* According to investigation documented at crossplane-contrib#456 (comment)
  we will still need inline `vpc` field to instantiate private Zone
first
* crossplane-contrib#456 should be merged first so we can ehance `ZoneAssociation` example

Signed-off-by: Yury Tsarev <[email protected]>
ytsarev added a commit to ytsarev/provider-aws-upbound that referenced this pull request Jun 19, 2023
* Addition to crossplane-contrib#456
* Dedicate `ZoneAssociation` for more complex ZoneToVPC associations for
  a complex cases
* According to investigation documented at crossplane-contrib#456 (comment)
  we will still need inline `vpc` field to instantiate private Zone
first
* crossplane-contrib#456 should be merged first so we can ehance `ZoneAssociation` example

Signed-off-by: Yury Tsarev <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Unable to specify a vpc with zones.route53 CRD
3 participants