Bug 1746736: upi/aws/cloudformation/01_vpc: Drop PublicNetworkAcl

[wking]

We've had this since the templates landed in 39a926a (#1408). But our Terraform modules contain no analog using aws_network_acl and their presence in the UPI templates is breaking the ping-based network connectivity test.

[wking]

CC @kalexand-rh about this CloudFormation template change.

[wking]

/test e2e-aws-upi

[abhinavdahiya]

LGTM @cuppett ptal

[cuppett]

This generates the desired effect (no restrictions via the NACL on the public subnets).

[cuppett]

LGTM

[abhinavdahiya]

/lgtm

/retest

/hold

Would like to see the UPI pr go green

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abhinavdahiya, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [abhinavdahiya,wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[wking]

Previous UPI run:

Flaky tests:
[Feature:Platform] Managed cluster should have no crashlooping pods in core namespaces over two minutes [Suite:openshift/conformance/parallel]
[sig-api-machinery] CustomResourcePublishOpenAPI [Feature:CustomResourcePublishOpenAPI] works for CRD with validation schema [Suite:openshift/conformance/parallel] [Suite:k8s]
[sig-cli] Kubectl client [k8s.io] Kubectl client-side validation should create/apply a valid CR with arbitrary-extra properties for CRD with partially-specified validation schema [Suite:openshift/conformance/parallel] [Suite:k8s]

Failing tests:
[Feature:Builds][webhook] TestWebhook [Suite:openshift/conformance/parallel]

So at least we passed Networking should provide Internet connection for containers. And TestWebhook seems generally flaky.

[wking]

Ah, TestWebhook issue is timed out waiting for the condition, namespace is empty but is not yet removed.

[wking]

AWS UPI is green :). Although I dunno what's up with the tar errors:

2019/08/30 22:26:16 Pod e2e-aws-upi succeeded after 1h30m11s
tar: can't open './installer/sedXk9NiC': Permission denied
tar: can't open './installer/sedtuNq5B': Permission denied
tar: error exit delayed from previous errors
2019/08/30 22:26:33 Copied 286.40Mi of artifacts

[abhinavdahiya]

/hold cancel

[openshift-ci-robot]

@wking: The following tests failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-scaleup-rhel7	a24c67c	link	/test e2e-aws-scaleup-rhel7
ci/prow/e2e-libvirt	a24c67c	link	/test e2e-libvirt

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[wking]

e2e-aws hit a bunch of:

timed out waiting for the condition, namespace is empty but is not yet removed

/test e2e-aws

[kalexand-rh]

Thank you, @wking!

[openshift-ci-robot]

@wking: All pull requests linked via external trackers have merged. Bugzilla bug 1746736 has been moved to the MODIFIED state.

Details

In response to this:

Bug 1746736: upi/aws/cloudformation/01_vpc: Drop PublicNetworkAcl

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.