Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(vpcv2): implementation of add gateway method #31224

Merged
merged 51 commits into from
Sep 12, 2024
Merged
Show file tree
Hide file tree
Changes from 44 commits
Commits
Show all changes
51 commits
Select commit Hold shift + click to select a range
31d3f48
Add RouteTable addRoute method
Aug 9, 2024
727b164
Update packages/@aws-cdk/aws-ec2-alpha/lib/route.ts
shikha372 Aug 9, 2024
cb8c941
Change CfnRoute to Route L2
Aug 12, 2024
d21be53
Update README.md
Aug 12, 2024
42830e7
Merge branch 'main' into vpcv2-rt-addroute
Leo10Gama Aug 12, 2024
2f48ab2
Update integ test to use only one EIGW
Aug 12, 2024
f904a97
Add subnet associateRouteTable method
Aug 13, 2024
b52d498
Appease the linter
Aug 13, 2024
1aef528
Update subnet with public routeTable again
Aug 13, 2024
9b15a4b
Update subnet-v2.ts
shikha372 Aug 14, 2024
bc56a77
Update subnet-v2.ts
shikha372 Aug 14, 2024
cc8db35
Extend IRouteTable into IRouteTableV2
Aug 14, 2024
285da27
Merge branch 'main' into vpcv2-rt-addroute
shikha372 Aug 14, 2024
98f9d53
ok so route table v2 was not a great idea lol
Aug 14, 2024
b3e08c1
Merge branch 'main' into vpcv2-rt-addroute
Leo10Gama Aug 14, 2024
1211fde
Update testing
Aug 15, 2024
ca9c385
Merge branch 'main' into vpcv2-rt-addroute
shikha372 Aug 15, 2024
eaa7ccb
add method associateRouteTable
shikha372 Aug 14, 2024
a25bb78
fixing route class
shikha372 Aug 15, 2024
1721026
making ipam props private
shikha372 Aug 15, 2024
bc393c2
successful build
shikha372 Aug 15, 2024
aed940f
adding validation for ipv4
shikha372 Aug 15, 2024
499c6c8
fixing egw route and subnet snapshot
shikha372 Aug 16, 2024
f296f3e
fixing readme and route unit test
shikha372 Aug 16, 2024
0002de5
fixing vpc snapshot
shikha372 Aug 16, 2024
909f7da
Update route snapshot
Aug 16, 2024
1b907c1
Update route snapshot
Aug 16, 2024
0dba8bb
Merge branch 'main' into vpcv2-rt-addroute
shikha372 Aug 23, 2024
8ca0a3c
adding EGW method to VPC
shikha372 Aug 23, 2024
f42666d
(feat): add EIGW implementation
shikha372 Aug 26, 2024
36a9511
adding unit and integ tests
shikha372 Aug 26, 2024
5bd279b
updating readme and snapshot for EGW
shikha372 Aug 26, 2024
6023ecd
Implement addNatGateway command
Aug 27, 2024
85eafa2
Test cleanup
Aug 27, 2024
09d3ae0
resolving conflicts
shikha372 Aug 27, 2024
c5f2b96
add vpn gateway v2
shikha372 Aug 27, 2024
5a05757
feat(vpcv2): add igw implementation
shikha372 Aug 29, 2024
391ae8e
fix validation for natGW
shikha372 Aug 29, 2024
aba5e66
add VPN route propogation to L2
shikha372 Aug 29, 2024
aeba62b
remove associate routetable
shikha372 Aug 29, 2024
2f1e60c
adding unit tests for internet gateway
shikha372 Aug 30, 2024
e060278
adding unit tests for VPN gateway
shikha372 Aug 30, 2024
74adb43
fixing all integ snapshots
shikha372 Sep 3, 2024
d136789
Merge branch 'main' into vpcv2-rt-addGateway
shikha372 Sep 3, 2024
5d63c6c
Apply suggestions from code review
shikha372 Sep 5, 2024
669c735
Apply suggestions from code review
shikha372 Sep 5, 2024
a9096f5
fix readme
shikha372 Sep 5, 2024
5c7548c
fixing nits for defining default
shikha372 Sep 9, 2024
4b4fb6b
Apply suggestions from code review
shikha372 Sep 11, 2024
dcb11e6
fix nits
shikha372 Sep 11, 2024
f30e1da
Merge branch 'main' into vpcv2-rt-addGateway
mergify[bot] Sep 12, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
112 changes: 79 additions & 33 deletions packages/@aws-cdk/aws-ec2-alpha/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,10 @@ To create a VPC with both IPv4 and IPv6 support:
```ts

const stack = new Stack();
new vpc_v2.VpcV2(this, 'Vpc', {
primaryAddressBlock: vpc_v2.IpAddresses.ipv4('10.0.0.0/24'),
new VpcV2(this, 'Vpc', {
primaryAddressBlock: IpAddresses.ipv4('10.0.0.0/24'),
secondaryAddressBlocks: [
vpc_v2.IpAddresses.amazonProvidedIpv6({cidrBlockName: 'AmazonProvidedIpv6'}),
IpAddresses.amazonProvidedIpv6({cidrBlockName: 'AmazonProvidedIpv6'}),
],
});
```
Expand All @@ -43,17 +43,17 @@ This new construct can be used to add subnets to a `VpcV2` instance:
```ts

const stack = new Stack();
const myVpc = new vpc_v2.VpcV2(this, 'Vpc', {
const myVpc = new VpcV2(this, 'Vpc', {
secondaryAddressBlocks: [
vpc_v2.IpAddresses.amazonProvidedIpv6({ cidrBlockName: 'AmazonProvidedIp'}),
IpAddresses.amazonProvidedIpv6({ cidrBlockName: 'AmazonProvidedIp'}),
],
});

new vpc_v2.SubnetV2(this, 'subnetA', {
new SubnetV2(this, 'subnetA', {
vpc: myVpc,
availabilityZone: 'us-east-1a',
ipv4CidrBlock: new vpc_v2.IpCidr('10.0.0.0/24'),
ipv6CidrBlock: new vpc_v2.IpCidr('2a05:d02c:25:4000::/60'),
ipv4CidrBlock: new IpCidr('10.0.0.0/24'),
ipv6CidrBlock: new IpCidr('2a05:d02c:25:4000::/60'),
subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
})
```
Expand All @@ -73,28 +73,28 @@ const ipam = new Ipam(this, 'Ipam', {
operatingRegion: ['us-west-1']
});
const ipamPublicPool = ipam.publicScope.addPool('PublicPoolA', {
addressFamily: vpc_v2.AddressFamily.IP_V6,
addressFamily: AddressFamily.IP_V6,
awsService: AwsServiceName.EC2,
locale: 'us-west-1',
publicIpSource: vpc_v2.IpamPoolPublicIpSource.AMAZON,
publicIpSource: IpamPoolPublicIpSource.AMAZON,
});
ipamPublicPool.provisionCidr('PublicPoolACidrA', { netmaskLength: 52 } );

const ipamPrivatePool = ipam.privateScope.addPool('PrivatePoolA', {
addressFamily: vpc_v2.AddressFamily.IP_V4,
addressFamily: AddressFamily.IP_V4,
});
ipamPrivatePool.provisionCidr('PrivatePoolACidrA', { netmaskLength: 8 } );

new vpc_v2.VpcV2(this, 'Vpc', {
primaryAddressBlock: vpc_v2.IpAddresses.ipv4('10.0.0.0/24'),
new VpcV2(this, 'Vpc', {
primaryAddressBlock: IpAddresses.ipv4('10.0.0.0/24'),
secondaryAddressBlocks: [
vpc_v2.IpAddresses.amazonProvidedIpv6({ cidrBlockName: 'AmazonIpv6' }),
vpc_v2.IpAddresses.ipv6Ipam({
IpAddresses.amazonProvidedIpv6({ cidrBlockName: 'AmazonIpv6' }),
IpAddresses.ipv6Ipam({
ipamPool: ipamPublicPool,
netmaskLength: 52,
cidrBlockName: 'ipv6Ipam',
}),
vpc_v2.IpAddresses.ipv4Ipam({
IpAddresses.ipv4Ipam({
ipamPool: ipamPrivatePool,
netmaskLength: 8,
cidrBlockName: 'ipv4Ipam',
Expand All @@ -112,11 +112,11 @@ Since `VpcV2` does not create subnets automatically, users have full control ove

```ts

const myVpc = new vpc_v2.VpcV2(this, 'Vpc');
const routeTable = new vpc_v2.RouteTable(this, 'RouteTable', {
const myVpc = new VpcV2(this, 'Vpc');
const routeTable = new RouteTable(this, 'RouteTable', {
vpc: myVpc,
});
const subnet = new vpc_v2.SubnetV2(this, 'Subnet', {
const subnet = new SubnetV2(this, 'Subnet', {
vpc: myVpc,
routeTable,
availabilityZone: 'eu-west-2a',
Expand All @@ -129,47 +129,65 @@ const subnet = new vpc_v2.SubnetV2(this, 'Subnet', {

```ts
const stack = new Stack();
const myVpc = new vpc_v2.VpcV2(this, 'Vpc');
const routeTable = new vpc_v2.RouteTable(this, 'RouteTable', {
const myVpc = new VpcV2(this, 'Vpc');
const routeTable = new RouteTable(this, 'RouteTable', {
vpc: myVpc,
});
const subnet = new vpc_v2.SubnetV2(this, 'Subnet', {
const subnet = new SubnetV2(this, 'Subnet', {
vpc: myVpc,
availabilityZone: 'eu-west-2a',
ipv4CidrBlock: new IpCidr('10.0.0.0/24'),
subnetType: ec2.SubnetType.PRIVATE_ISOLATED });

const igw = new vpc_v2.InternetGateway(this, 'IGW', {
const igw = new InternetGateway(this, 'IGW', {
vpc: myVpc,
});
new vpc_v2.Route(this, 'IgwRoute', {
new Route(this, 'IgwRoute', {
routeTable,
destination: '0.0.0.0/0',
target: { gateway: igw },
});
```

Alternatively, `Route`s can be created via a method in the `RouteTable` class. An example using the `EgressOnlyInternetGateway` construct can be seen below:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. Routes looks weird.
  2. Maybe mention the method routeTable.addRoute. Right now it's immediately followed with An example using Egress...which doesn't have anything to do withRoutes can be created via ...`

Copy link
Contributor Author

@shikha372 shikha372 Sep 5, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. corrected
  2. it does relate with creating the route in line , you cannot create a route without a target so we need a target first(in this case, it is EgressOnlyInternetGateway).
    routeTable.addRoute('::/0', { gateway: eigw });
    To make it more clear mentioned the method name

Note: `EgressOnlyInternetGateway` can only be used to set up outbound IPv6 routing.

```ts
import * as vpc_v2 from '@aws-cdk/aws-ec2-alpha';

const myVpc = new VpcV2(stack, 'Vpc', {...});
const routeTable = new RouteTable(stack, 'RouteTable', {
vpc: vpc.myVpc,
});
const subnet = new SubnetV2(stack, 'Subnet', {...});

const eigw = new EgressOnlyInternetGateway(stack, 'EIGW', {
vpcId: vpc.myVpc,
});
routeTable.addRoute('::/0', { gateway: eigw });
```

Other route targets may require a deeper set of parameters to set up properly. For instance, the example below illustrates how to set up a `NatGateway`:

```ts

const myVpc = new vpc_v2.VpcV2(this, 'Vpc');
const routeTable = new vpc_v2.RouteTable(this, 'RouteTable', {
const myVpc = new VpcV2(this, 'Vpc');
const routeTable = new RouteTable(this, 'RouteTable', {
vpc: myVpc,
});
const subnet = new vpc_v2.SubnetV2(this, 'Subnet', {
const subnet = new SubnetV2(this, 'Subnet', {
vpc: myVpc,
availabilityZone: 'eu-west-2a',
ipv4CidrBlock: new IpCidr('10.0.0.0/24'),
subnetType: ec2.SubnetType.PRIVATE_ISOLATED });

const natgw = new vpc_v2.NatGateway(this, 'NatGW', {
const natgw = new NatGateway(this, 'NatGW', {
subnet: subnet,
vpc: myVpc,
connectivityType: NatConnectivityType.PRIVATE,
privateIpAddress: '10.0.0.42',
});
new vpc_v2.Route(this, 'NatGwRoute', {
new Route(this, 'NatGwRoute', {
routeTable,
destination: '0.0.0.0/0',
target: { gateway: natgw },
Expand All @@ -180,11 +198,11 @@ It is also possible to set up endpoints connecting other AWS services. For insta

```ts

const myVpc = new vpc_v2.VpcV2(this, 'Vpc');
const routeTable = new vpc_v2.RouteTable(this, 'RouteTable', {
const myVpc = new VpcV2(this, 'Vpc');
const routeTable = new RouteTable(this, 'RouteTable', {
vpc: myVpc,
});
const subnet = new vpc_v2.SubnetV2(this, 'Subnet', {
const subnet = new SubnetV2(this, 'Subnet', {
vpc: myVpc,
availabilityZone: 'eu-west-2a',
ipv4CidrBlock: new IpCidr('10.0.0.0/24'),
Expand All @@ -195,9 +213,37 @@ const dynamoEndpoint = new ec2.GatewayVpcEndpoint(this, 'DynamoEndpoint', {
vpc: myVpc,
subnets: [subnet],
});
new vpc_v2.Route(this, 'DynamoDBRoute', {
new Route(this, 'DynamoDBRoute', {
routeTable,
destination: '0.0.0.0/0',
target: { endpoint: dynamoEndpoint },
});
```

## Adding Egress-Only Internet Gateway to VPC

An egress-only internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows outbound communication over IPv6 from instances in your VPC to the internet, and prevents the internet from initiating an IPv6 connection with your instances. For more information see@ https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html

VPCv2 supports adding an egress only internet gateway to VPC with the help of `addEgressOnlyInternetGateway` method as well.

By Default, it sets up a route to all outbound IPv6 Address ranges unless specified to a specific destination by the user. It can only be set up for IPv6 enabled VPCs.
`Subnets` takes in value of `SubnetFilter` which can be based on a SubnetType in VPCV2. A new route will be added to route tables of all subnets filtered out with this property.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You explained SubnetFilter but I don't see it in the example below?

Copy link
Contributor Author

@shikha372 shikha372 Sep 5, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Selecting a type of subnet is a SubnetFilter :)
subnets: [subnetType: {SubnetType.PUBLIC}]


```ts

const myVpc = new VpcV2(this, 'Vpc');
const routeTable = new RouteTable(this, 'RouteTable', {
vpc: myVpc,
});
const subnet = new SubnetV2(this, 'Subnet', {
vpc: myVpc,
availabilityZone: 'eu-west-2a',
ipv4CidrBlock: new IpCidr('10.0.0.0/24'),
subnetType: ec2.SubnetType.PRIVATE });

myVpc.addEgressOnlyInternetGateway({
subnets: [{SubnetType.PUBLIC}],
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Haven't looked into implementation but this already looks weird to me.

Copy link
Contributor Author

@shikha372 shikha372 Sep 5, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is as per the current implementations we have in place for addInterfaceEndpoint and addgatewayEndpoint and provides a better way for the users to select multiple subnets at once without forming an array list first and then pass it. This seems to be the best option for specifying multiple subnets as an input.
Let me know if you've thoughts on any other way to do it.

destination: '::/60',
})

```
3 changes: 2 additions & 1 deletion packages/@aws-cdk/aws-ec2-alpha/awslint.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
"exclude": [
"from-method:@aws-cdk/aws-ec2-alpha.VpcV2",
"attribute-tag:@aws-cdk/aws-ec2-alpha.RouteTable.routeTableId",
"from-method:@aws-cdk/aws-ec2-alpha.SubnetV2"
"from-method:@aws-cdk/aws-ec2-alpha.SubnetV2",
"from-method:@aws-cdk/aws-ec2-alpha.Route"
Comment on lines +5 to +6
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For my knowledge, what does these two lines do?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is enforced from awslint to have the import methods in classes extending Resource , since we haven't introduced it yet these are part of exceptions

]
}
Loading
Loading