CORS-4073: validate instance type support IPv6 in dual-stack

[tthvo]

In order to attach IPv6 addresses to the ENI of EC2 instances, the instance type must support IPv6 networking. The installer must validate it by inspecting the networking capabilities of instance type via EC2 API calls.

This takes inspiration from the AWS CLI command:

aws ec2 describe-instance-types \
  --region <region> \
  --instance-types <instance-type> \
  --query 'InstanceTypes[0].NetworkInfo.Ipv6Supported'

[openshift-ci-robot]

@tthvo: This pull request references CORS-4073 which is a valid jira issue.

Details

In response to this:

In order to attach IPv6 addresses to the ENI of EC2 instances, the instance type must support IPv6 networking. The installer must validate it by inspecting the networking capabilities of instance type via EC2 API calls.

This takes inspiration from the AWS CLI command:

aws ec2 describe-instance-types \
 --region <region> \
 --instance-types <instance-type> \
 --query 'InstanceTypes[0].NetworkInfo.Ipv6Supported'

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tthvo]

/label platform/aws
/cc @sadasu @yunjiang29 @barbacbd

[tthvo]

Note that we don't need to check if the instance type is nitro-based here, because that requirement is only for launching instances into IPv6-only subnets. From AWS docs, we see:

Amazon EC2 supports launching instances based on the Nitro System into IPv6-only subnets.

For dual-stack scenarios, subnets are dual-stack so checking IPv6 networking capability of the instance type is sufficient :D Also, the machinepool default instance types support IPv6.

[sadasu]

Are there any plans to move to "github.com/aws/aws-sdk-go-v2/aws" within ‎pkg/asset/installconfig/aws/instancetypes.go?

[tthvo]

Are there any plans to move to "github.com/aws/aws-sdk-go-v2/aws" within ‎pkg/asset/installconfig/aws/instancetypes.go?

Yes, exactly! I wanted to keep it as AWS SDK v1 for easy review. There will be future PRs to gradually migrate asset pkg to AWS SDK v2 later.

[tthvo]

There will be future PRs to gradually migrate asset pkg to AWS SDK v2 later.

Specifically, a small part of this commit 676434c in #9907. Please let me know if you'd like me to bring the SDK upgrade here too.

[tthvo]

From discussion with Sandhya, I updated this PR to use AWS SDK v2 :D

[sadasu]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sadasu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/asset/installconfig/aws/OWNERS [sadasu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sadasu]

There will be future PRs to gradually migrate asset pkg to AWS SDK v2 later.

Specifically, a small part of this commit 676434c in #9907. Please let me know if you'd like me to bring the SDK upgrade here too.

Yes, I am OK with using migrating to aws sdk v2 for the files touched here because they will get thoroughly tested as part of this feature. I believe, repeatedly taking this approach would eventually de-risk the migration as a whole.

[tthvo]

/retest

[tthvo]

/retest

[openshift-ci]

@tthvo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-default-config	adfe5e7	link	false	/test e2e-aws-default-config
ci/prow/e2e-aws-ovn-edge-zones	adfe5e7	link	false	/test e2e-aws-ovn-edge-zones
ci/prow/e2e-aws-ovn-single-node	adfe5e7	link	false	/test e2e-aws-ovn-single-node
ci/prow/e2e-aws-ovn-imdsv2	adfe5e7	link	false	/test e2e-aws-ovn-imdsv2
ci/prow/e2e-aws-ovn-fips	adfe5e7	link	false	/test e2e-aws-ovn-fips
ci/prow/e2e-aws-ovn-edge-zones-manifest-validation	adfe5e7	link	true	/test e2e-aws-ovn-edge-zones-manifest-validation
ci/prow/e2e-aws-ovn-heterogeneous	adfe5e7	link	false	/test e2e-aws-ovn-heterogeneous
ci/prow/e2e-aws-ovn-shared-vpc-edge-zones	adfe5e7	link	false	/test e2e-aws-ovn-shared-vpc-edge-zones
ci/prow/e2e-aws-ovn-shared-vpc-custom-security-groups	adfe5e7	link	false	/test e2e-aws-ovn-shared-vpc-custom-security-groups

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.