Skip to content

Commit c832f22

Browse files
mzazrivecmzazrivec
committed
OCM-14864 | fix: explicit AZs take priority over number of AZs
1 parent 6041a48 commit c832f22

File tree

3 files changed

+129
-117
lines changed

3 files changed

+129
-117
lines changed

‎cmd/create/network/cloudformation.go

Lines changed: 64 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,25 @@ Description: CloudFormation template to create a ROSA Quickstart default VPC.
88
This CloudFormation template may not work with rosa CLI versions later than 1.2.48.
99
Please ensure that you are using the compatible CLI version before deploying this template.
1010
11-
Transform: 'AWS::LanguageExtensions'
12-
1311
Parameters:
1412
AvailabilityZoneCount:
1513
Type: Number
1614
Description: "Number of Availability Zones to use"
1715
Default: 1
1816
MinValue: 1
1917
MaxValue: 3
20-
AvailabilityZones:
21-
Type: CommaDelimitedList
22-
Description: "List of Availability Zones to use"
18+
AZ1:
19+
Type: String
20+
Description: "First availability zone to use"
21+
Default: ""
22+
AZ2:
23+
Type: String
24+
Description: "Second availability zone to use"
25+
Default: ""
26+
AZ3:
27+
Type: String
28+
Description: "Third availability zone to use"
29+
Default: ""
2330
Region:
2431
Type: String
2532
Description: "AWS Region"
@@ -33,24 +40,20 @@ Parameters:
3340
Default: '10.0.0.0/16'
3441
3542
Conditions:
36-
AZ3Explicit: !Equals [Fn::Length: !Ref AvailabilityZones, 3]
37-
AZ2Explicit: !Or [!Equals [Fn::Length: !Ref AvailabilityZones, 2], !Condition AZ3Explicit]
38-
AZ1Explicit: !Or [!Equals [Fn::Length: !Ref AvailabilityZones, 1], !Condition AZ2Explicit]
43+
AZ1Explicit: !Not [!Equals [!Ref AZ1, ""]]
44+
AZ2Explicit: !Not [!Equals [!Ref AZ2, ""]]
45+
AZ3Explicit: !Not [!Equals [!Ref AZ3, ""]]
3946
40-
HasAZ1: !Or [!Equals [!Ref AvailabilityZoneCount, 1], !Condition AZ1Explicit]
41-
HasAZ2: !Or [!Equals [!Ref AvailabilityZoneCount, 2], !Condition AZ2Explicit]
42-
HasAZ3: !Or [!Equals [!Ref AvailabilityZoneCount, 3], !Condition AZ3Explicit]
47+
ExplicitAZs: !Or [!Condition AZ1Explicit, !Condition AZ2Explicit, !Condition AZ3Explicit]
48+
NoExplicitAZs: !Not [!Condition ExplicitAZs]
4349
44-
One:
45-
Fn::Or:
46-
- Condition: HasAZ1
47-
- Condition: HasAZ2
48-
- Condition: HasAZ3
50+
AZ3Implicit: !Equals [!Ref AvailabilityZoneCount, 3]
51+
AZ2Implicit: !Or [!Equals [!Ref AvailabilityZoneCount, 2], !Condition AZ3Implicit]
52+
AZ1Implicit: !Or [!Equals [!Ref AvailabilityZoneCount, 1], !Condition AZ2Implicit]
4953
50-
Two:
51-
Fn::Or:
52-
- Condition: HasAZ3
53-
- Condition: HasAZ2
54+
One: !Or [!And [!Condition ExplicitAZs, !Condition AZ1Explicit], !And [!Condition NoExplicitAZs, !Condition AZ1Implicit]]
55+
Two: !Or [!And [!Condition ExplicitAZs, !Condition AZ2Explicit], !And [!Condition NoExplicitAZs, !Condition AZ2Implicit]]
56+
Three: !Or [!And [!Condition ExplicitAZs, !Condition AZ3Explicit], !And [!Condition NoExplicitAZs, !Condition AZ3Implicit]]
5457
5558
Resources:
5659
VPC:
@@ -80,12 +83,12 @@ Resources:
8083
- !Ref PrivateRouteTable
8184
8285
SubnetPublic1:
83-
Condition: One
8486
Type: AWS::EC2::Subnet
87+
Condition: One
8588
Properties:
8689
VpcId: !Ref VPC
8790
CidrBlock: !Select [0, !Cidr [!Ref VpcCidr, 6, 8]]
88-
AvailabilityZone: !If [AZ1Explicit, !Select [0, !Ref AvailabilityZones], !Select [0, !GetAZs '']]
91+
AvailabilityZone: !If [ExplicitAZs, !Ref AZ1, !Select [0, !GetAZs '']]
8992
MapPublicIpOnLaunch: true
9093
Tags:
9194
- Key: Name
@@ -95,17 +98,17 @@ Resources:
9598
- Key: 'rosa_hcp_policies'
9699
Value: 'true'
97100
- Key: 'service'
98-
Value: 'ROSA'
101+
Value: 'ROSA'
99102
- Key: 'kubernetes.io/role/elb'
100103
Value: '1'
101104
102105
SubnetPrivate1:
103-
Condition: One
104106
Type: AWS::EC2::Subnet
107+
Condition: One
105108
Properties:
106109
VpcId: !Ref VPC
107110
CidrBlock: !Select [1, !Cidr [!Ref VpcCidr, 6, 8]]
108-
AvailabilityZone: !If [AZ1Explicit, !Select [0, !Ref AvailabilityZones], !Select [0, !GetAZs '']]
111+
AvailabilityZone: !If [ExplicitAZs, !Ref AZ1, !Select [0, !GetAZs '']]
109112
MapPublicIpOnLaunch: false
110113
Tags:
111114
- Key: Name
@@ -115,17 +118,17 @@ Resources:
115118
- Key: 'rosa_hcp_policies'
116119
Value: 'true'
117120
- Key: 'service'
118-
Value: 'ROSA'
121+
Value: 'ROSA'
119122
- Key: 'kubernetes.io/role/internal-elb'
120123
Value: '1'
121124
122125
SubnetPublic2:
123-
Condition: Two
124126
Type: AWS::EC2::Subnet
127+
Condition: Two
125128
Properties:
126129
VpcId: !Ref VPC
127130
CidrBlock: !Select [2, !Cidr [!Ref VpcCidr, 6, 8]]
128-
AvailabilityZone: !If [AZ2Explicit, !Select [1, !Ref AvailabilityZones], !Select [1, !GetAZs '']]
131+
AvailabilityZone: !If [ExplicitAZs, !Ref AZ2, !Select [1, !GetAZs '']]
129132
MapPublicIpOnLaunch: true
130133
Tags:
131134
- Key: Name
@@ -140,12 +143,12 @@ Resources:
140143
Value: '1'
141144
142145
SubnetPrivate2:
143-
Condition: Two
144146
Type: AWS::EC2::Subnet
147+
Condition: Two
145148
Properties:
146149
VpcId: !Ref VPC
147150
CidrBlock: !Select [3, !Cidr [!Ref VpcCidr, 6, 8]]
148-
AvailabilityZone: !If [AZ2Explicit, !Select [1, !Ref AvailabilityZones], !Select [1, !GetAZs '']]
151+
AvailabilityZone: !If [ExplicitAZs, !Ref AZ2, !Select [1, !GetAZs '']]
149152
MapPublicIpOnLaunch: false
150153
Tags:
151154
- Key: Name
@@ -160,12 +163,12 @@ Resources:
160163
Value: '1'
161164
162165
SubnetPublic3:
163-
Condition: HasAZ3
164166
Type: AWS::EC2::Subnet
167+
Condition: Three
165168
Properties:
166169
VpcId: !Ref VPC
167170
CidrBlock: !Select [4, !Cidr [!Ref VpcCidr, 6, 8]]
168-
AvailabilityZone: !If [AZ3Explicit, !Select [2, !Ref AvailabilityZones], !Select [2, !GetAZs '']]
171+
AvailabilityZone: !If [ExplicitAZs, !Ref AZ3, !Select [2, !GetAZs '']]
169172
MapPublicIpOnLaunch: true
170173
Tags:
171174
- Key: Name
@@ -180,12 +183,12 @@ Resources:
180183
Value: '1'
181184
182185
SubnetPrivate3:
183-
Condition: HasAZ3
184186
Type: AWS::EC2::Subnet
187+
Condition: Three
185188
Properties:
186189
VpcId: !Ref VPC
187190
CidrBlock: !Select [5, !Cidr [!Ref VpcCidr, 6, 8]]
188-
AvailabilityZone: !If [AZ3Explicit, !Select [2, !Ref AvailabilityZones], !Select [2, !GetAZs '']]
191+
AvailabilityZone: !If [ExplicitAZs, !Ref AZ3, !Select [2, !GetAZs '']]
189192
MapPublicIpOnLaunch: false
190193
Tags:
191194
- Key: Name
@@ -219,6 +222,7 @@ Resources:
219222
InternetGatewayId: !Ref InternetGateway
220223
221224
ElasticIP1:
225+
Condition: One
222226
Type: AWS::EC2::EIP
223227
Properties:
224228
Domain: vpc
@@ -233,6 +237,7 @@ Resources:
233237
Value: 'ROSA'
234238
235239
ElasticIP2:
240+
Condition: Two
236241
Type: AWS::EC2::EIP
237242
Properties:
238243
Domain: vpc
@@ -247,7 +252,7 @@ Resources:
247252
Value: 'ROSA'
248253
249254
ElasticIP3:
250-
Condition: HasAZ3
255+
Condition: Three
251256
Type: AWS::EC2::EIP
252257
Properties:
253258
Domain: vpc
@@ -294,7 +299,7 @@ Resources:
294299
Value: 'ROSA'
295300
296301
NATGateway3:
297-
Condition: HasAZ3
302+
Condition: Three
298303
Type: 'AWS::EC2::NatGateway'
299304
Properties:
300305
AllocationId: !GetAtt ElasticIP3.AllocationId
@@ -357,7 +362,7 @@ Resources:
357362
- Two
358363
- !Ref NATGateway2
359364
- !If
360-
- HasAZ3
365+
- Three
361366
- !Ref NATGateway3
362367
- !Ref "AWS::NoValue"
363368
@@ -376,7 +381,7 @@ Resources:
376381
RouteTableId: !Ref PublicRouteTable
377382
378383
PublicSubnetRouteTableAssociation3:
379-
Condition: HasAZ3
384+
Condition: Three
380385
Type: AWS::EC2::SubnetRouteTableAssociation
381386
Properties:
382387
SubnetId: !Ref SubnetPublic3
@@ -397,7 +402,7 @@ Resources:
397402
RouteTableId: !Ref PrivateRouteTable
398403
399404
PrivateSubnetRouteTableAssociation3:
400-
Condition: HasAZ3
405+
Condition: Three
401406
Type: AWS::EC2::SubnetRouteTableAssociation
402407
Properties:
403408
SubnetId: !Ref SubnetPrivate3
@@ -435,11 +440,11 @@ Resources:
435440
ServiceName: !Sub "com.amazonaws.${Region}.ec2"
436441
PrivateDnsEnabled: true
437442
VpcEndpointType: Interface
438-
SubnetIds:
443+
SubnetIds:
439444
- !If [One, !Ref SubnetPrivate1, !Ref "AWS::NoValue"]
440445
- !If [Two, !Ref SubnetPrivate2, !Ref "AWS::NoValue"]
441-
- !If [HasAZ3, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]
442-
SecurityGroupIds:
446+
- !If [Three, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]
447+
SecurityGroupIds:
443448
- !Ref SecurityGroup
444449
445450
KMSVPCEndpoint:
@@ -449,11 +454,11 @@ Resources:
449454
ServiceName: !Sub "com.amazonaws.${Region}.kms"
450455
PrivateDnsEnabled: true
451456
VpcEndpointType: Interface
452-
SubnetIds:
457+
SubnetIds:
453458
- !If [One, !Ref SubnetPrivate1, !Ref "AWS::NoValue"]
454459
- !If [Two, !Ref SubnetPrivate2, !Ref "AWS::NoValue"]
455-
- !If [HasAZ3, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]
456-
SecurityGroupIds:
460+
- !If [Three, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]
461+
SecurityGroupIds:
457462
- !Ref SecurityGroup
458463
459464
STSVPCEndpoint:
@@ -463,11 +468,11 @@ Resources:
463468
ServiceName: !Sub "com.amazonaws.${Region}.sts"
464469
PrivateDnsEnabled: true
465470
VpcEndpointType: Interface
466-
SubnetIds:
471+
SubnetIds:
467472
- !If [One, !Ref SubnetPrivate1, !Ref "AWS::NoValue"]
468473
- !If [Two, !Ref SubnetPrivate2, !Ref "AWS::NoValue"]
469-
- !If [HasAZ3, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]
470-
SecurityGroupIds:
474+
- !If [Three, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]
475+
SecurityGroupIds:
471476
- !Ref SecurityGroup
472477
473478
EcrApiVPCEndpoint:
@@ -477,11 +482,11 @@ Resources:
477482
ServiceName: !Sub "com.amazonaws.${Region}.ecr.api"
478483
PrivateDnsEnabled: true
479484
VpcEndpointType: Interface
480-
SubnetIds:
485+
SubnetIds:
481486
- !If [One, !Ref SubnetPrivate1, !Ref "AWS::NoValue"]
482487
- !If [Two, !Ref SubnetPrivate2, !Ref "AWS::NoValue"]
483-
- !If [HasAZ3, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]
484-
SecurityGroupIds:
488+
- !If [Three, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]
489+
SecurityGroupIds:
485490
- !Ref SecurityGroup
486491
487492
EcrDkrVPCEndpoint:
@@ -491,11 +496,11 @@ Resources:
491496
ServiceName: !Sub "com.amazonaws.${Region}.ecr.dkr"
492497
PrivateDnsEnabled: true
493498
VpcEndpointType: Interface
494-
SubnetIds:
499+
SubnetIds:
495500
- !If [One, !Ref SubnetPrivate1, !Ref "AWS::NoValue"]
496501
- !If [Two, !Ref SubnetPrivate2, !Ref "AWS::NoValue"]
497-
- !If [HasAZ3, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]
498-
SecurityGroupIds:
502+
- !If [Three, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]
503+
SecurityGroupIds:
499504
- !Ref SecurityGroup
500505
501506
Outputs:
@@ -513,13 +518,13 @@ Outputs:
513518
514519
PublicSubnets:
515520
Description: "Public Subnet Ids"
516-
Value: !Join [",", [!If [One, !Ref SubnetPublic1, !Ref "AWS::NoValue"], !If [Two, !Ref SubnetPublic2, !Ref "AWS::NoValue"], !If [HasAZ3, !Ref SubnetPublic3, !Ref "AWS::NoValue"]]]
521+
Value: !Join [",", [!If [One, !Ref SubnetPublic1, !Ref "AWS::NoValue"], !If [Two, !Ref SubnetPublic2, !Ref "AWS::NoValue"], !If [Three, !Ref SubnetPublic3, !Ref "AWS::NoValue"]]]
517522
Export:
518523
Name: !Sub "${Name}-PublicSubnets"
519524
520525
PrivateSubnets:
521526
Description: "Private Subnet Ids"
522-
Value: !Join [",", [!If [One, !Ref SubnetPrivate1, !Ref "AWS::NoValue"], !If [Two, !Ref SubnetPrivate2, !Ref "AWS::NoValue"], !If [HasAZ3, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]]]
527+
Value: !Join [",", [!If [One, !Ref SubnetPrivate1, !Ref "AWS::NoValue"], !If [Two, !Ref SubnetPrivate2, !Ref "AWS::NoValue"], !If [Three, !Ref SubnetPrivate3, !Ref "AWS::NoValue"]]]
523528
Export:
524529
Name: !Sub "${Name}-PrivateSubnets"
525530
@@ -530,21 +535,22 @@ Outputs:
530535
Name: !Sub "${Name}-EIP1-AllocationId"
531536
532537
EIP2AllocationId:
538+
Condition: Two
533539
Description: Allocation ID for ElasticIP2
534540
Value: !GetAtt ElasticIP2.AllocationId
535541
Export:
536542
Name: !Sub "${Name}-EIP2-AllocationId"
537543
538544
EIP3AllocationId:
539-
Condition: HasAZ3
545+
Condition: Three
540546
Description: Allocation ID for ElasticIP3
541547
Value: !GetAtt ElasticIP3.AllocationId
542548
Export:
543549
Name: !Sub "${Name}-EIP3-AllocationId"
544550
545551
NatGatewayId:
546552
Description: The NAT Gateway IDs
547-
Value: !Join [",", [!If [One, !Ref NATGateway1, !Ref "AWS::NoValue"], !If [Two, !Ref NATGateway2, !Ref "AWS::NoValue"], !If [HasAZ3, !Ref NATGateway3, !Ref "AWS::NoValue"]]]
553+
Value: !Join [",", [!If [One, !Ref NATGateway1, !Ref "AWS::NoValue"], !If [Two, !Ref NATGateway2, !Ref "AWS::NoValue"], !If [Three, !Ref NATGateway3, !Ref "AWS::NoValue"]]]
548554
Export:
549555
Name: !Sub "${Name}-NatGatewayId"
550556

0 commit comments

Comments
 (0)