1263742 - Route traffic to public-artifacts.taskcluster.net via the IGW

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Nick Thomas [:nthomas] (UTC+12)]

Spun out from bug 1262652.

Test jobs get their installers/packages/test zips from taskcluster, which redirects to public-artifacts.taskcluster.net. That's Cloudfront serving S3, and currently has an address which is not routed via IGW. So the traffic flows 
   S3 -> Cloudfront -> SCL3 -> VPC -> AWS instance

(Side note: we resolve back in SCL3, so we get a suboptimal result for usw2 and use1 anyway!).

dcurado reported on IRC that the releng firewall in SCL3 is very busy, so lets at least route via IGW to get
   S3 -> Cloudfront near SCL3 -> AWS instance

Comment 1

[Nick Thomas [:nthomas] (UTC+12)]

Attachment: Add current Cloudfront IP block for testers

Comment 2

[Nick Thomas [:nthomas] (UTC+12)]

Landed, with additional fix https://github.com/mozilla/build-cloud-tools/commit/8d1275fbdfb84fe22047126a18c14dfa368495d1

Deployed ~1520 Pacific, straight forward except for
2016-04-11 15:15:25,883 - rtb-b3d03cd6 - deleting route to 54.68.216.133/32 via igw-09b7cc67 None
delete? (y/N) y