create-efs.sh not picking correct VPC

[Alan111S]

Given ... An AWS account containing multiple CPD systems, each in their own VPC, each with an EFS file system
When ... running Terraform apply (which is calling create-efs.sh) using a new VPC
Expected ... EFS file system to be created with Mount Targets and Security Groups applied
Actual ... create-efs.sh seems to set VPC_ID to multiple VPCs and the remainder of the script continues but fails to execute properly. The new EFS File System exists but has no Mount Targets.

create-efs-output.txt

[satyamodi]

In create-efs.sh script, we are filtering the VPC based on the CIDR address assigned to vpc while creating the cluster in the variables.tf file.

variable.tf

variable "vpc_cidr" {
description = "The CIDR block for the VPC, e.g: 10.0.0.0/16"
default = "10.0.0.0/16"
}

create-efs.sh

VPD_ID=aws ec2 describe-vpcs --filters "Name=cidr,Values=$2" --query 'Vpcs[*].VpcId' --output text | xargs

ocp-install.tf

"./create-efs.sh ${var.region} ${var.vpc_cidr}",

We are expecting a unique CIDR address for each VPC in a particular aws region.
In your efs log file, it looks like there is more than one vpc with the same cidr address.

[Alan111S]

That's correct. Each of our VPCs use 10.0.0.0/16.

So this is a restriction in your design? Since it is perfectly valid to re-use the same CIDR in different VPCs as they are effectively seperate isolated networks. So when you say 'We are expecting a unique CIDR address for each VPC in a particular aws region.', why are you setting that restriction?

[satyamodi]

I have fixed the issue, now create-efs.sh won't search for vpc based on cidr address.

regarding the use of same CIDR in different VPCs, as per aws best practices:
"while you can create multiple VPCs with overlapping IP address ranges, doing so will prohibit you from connecting these VPCs to a common home network via the hardware VPN connection. For this reason we recommend using non-overlapping IP address ranges." https://aws.amazon.com/vpc/faqs/

[Alan111S]

I see that there are some technical use cases where non-overlapping ranges might be important. Whether these use cases are relevant to setting up CPD, I'm not sure, but I'm willing to give you the benefit of the doubt ;)

In that case, it would be good to state in the documentation that the CIDR should be non-overlapping, as that information was not stated previously.