Shared AWS VPC when account has multiple Egress Only Internet Gateways fails

[rlees85]

/kind bug

1. What kops version are you running? The command kops version, will display
this information.

Client version: 1.34.1 (git-v1.34.1)

2. What Kubernetes version are you running? kubectl version will print the
version if a cluster is running or provide the Kubernetes version specified as
a kops flag.

N/A

3. What cloud provider are you using?

AWS

4. What commands did you run? What is the simplest way to reproduce this issue?

N/A

5. What happened after the commands executed?

KOPS complained that multiple Egress Only Internet Gateways matched tags. The AWS account has two Egress Only Internet Gateways but one of these is for a completely separate VPC.

6. What did you expect to happen?

KOPS to pick the Egress Only Internet Gateway for the VPC ID that is specified in my KOPS manifest.

7. Please provide your cluster manifest. Execute
kops get --name my.example.com -o yaml to display your cluster manifest.
You may want to remove your cluster name and other sensitive information.

N/A

8. Please run the commands with most verbose logging by adding the -v 10 flag.
Paste the logs into this report, or in a gist and provide the gist link here.

N/A

9. Anything else do we need to know?

See file: https://github.com/kubernetes/kops/blob/master/upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go

Function: Find

Expression:

		request.Filters = []ec2types.Filter{awsup.NewEC2Filter("attachment.vpc-id", *e.VPC.ID)}

This is not a valid filter for Egress Only Internet Gateway, thus, doesn't do anything.

See: https://docs.aws.amazon.com/cli/v1/reference/ec2/describe-egress-only-internet-gateways.html

Section: --filters

[rlees85]

I've got this working with a patch on the findEgressOnlyInternetGateway function that allows it to take a new argument vpcId and it just filters the result based on that, if its set.

A cleaner more concise approach might be to add Engress Only Internet Gateway ID to the cluster manifest, but that feels like a lot of work.

If no comments over the next few days I'll raise a PR with my fix. Maybe it can be tidied up a bit and be workable

[hakman]

@rlees85 Just wanted to mention that most maintainers will be busy with KubeCon for the next few weeks, so sorry in advance for the delay with feedback.

[rlees85]

Absolutely no issues at all. When I get a sec I'll PR what I have and when people are available we can discuss the better way to do it. Thanks for letting me know