This lets us safely make changes to otherwise immutable fields, in
particular for adding security groups to NLBs created without them.
We detect the older versions, and create deletion tasks to remove
them. These tasks can be deferred, and we expect them to be
deferred to a "prune" phase that runs after cluster apply.
Co-authored-by: Ciprian Hacman <ciprian@hakman.dev>
These are the remaining resources that support "tag on create" of which we werent taking advantage.
This allows more fine-grained IAM permissions for the kops cli.
The maximum IAM role name length is 64 characters, which we hit much
more often now that we are constructing complex names. Use our normal
strategy of adding a hash when we truncate.
This is not a breaking change, because these names were not valid
previously.
This updates DHCP Options, EBS Volumes, InternetGateways, SecurityGroups, Subnets, and VPCs to specify tags at creation-time rather than calling ec2.CreateTags after the resource was created.
I didn't update NATGateway because it adds additional legacy tags that should be evaluated for whether or not they're needed.
I also didn't update SSHKey because it currently isn't tagged at all but it would be good for us to tag down the road.
We don't call klog.InitFlags yet, because that will cause a flag
redefinition error until we get everyone to stop using glog. That
will happen when we update to k8s 1.13.
* Zones are now subnets
* Utility subnet is no longer part of Zone
* Bastion InstanceGroup type added instead
* Etcd clusters defined in terms of InstanceGroups, not zones
* AdminAccess split into SSHAccess & APIAccess
* Dropped unused Multizone flag
Beginnings of a mock for the AWSCloud, so that hopefully we aren't
calling out to AWS at all in the tests. We will likely start mocking
the actual EC2 APIs in future, but this seems a good starting point.
Fix#425
IAM instance profile creation is very async, and this causes dependent
resources to fail. That's fine - we have good retry logic - but we
should output a less frightening error message.
Issue #35
We allow --zones & --master-zones to be specified separately now, but we
validate for common errors (using a region where you meant a zone,
duplicating a zone, spanning regions, entering an invalid AZ etc)