Closed Bug 959991 Opened 12 years ago Closed 12 years ago

Allow AWS build slaves to access s3 buckets

Categories

(Release Engineering :: General, defect)

Product:
Release Engineering
Component:
General
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: glandium, Unassigned)

References

Details

We need a NAT instance to get out of the VPC and give access to the s3 public addresses.
There's a meeting happening today to discuss this and other options for allowing build machines to reach (selected parts of) the internet, related to bug 957502.
catlee and I have been setting this up.
Assignee: relops → nobody
Component: RelOps → General Automation
Product: Infrastructure & Operations → Release Engineering
QA Contact: arich → catlee
This is setup. Docs: us-west-2 us-east-1 Notes NAT instance i-1965cf2d i-0729172b AKA nat-gateway, m1.xlarge for 'High' network Public subnet 10.132.10.0/24 10.134.10.0/24 Could be shrunk Routing table rtb-f4213396 rtb-ee932c8f Shared with NAT for blobber in us-east-1 Security group nat natsg For slaves Routing table rtb-0f4d506d rtb-eeae4a8b Subnets using table 10.132.64.0/24 10.134.64.0/25 Try compile slaves only 10.132.65.0/24 10.134.64.128/25 10.132.66.0/24 10.134.65.0/25 10.132.67.0/24 10.134.65.128/25 IP blocks going via NAT 176.32.96.0/21 Same in both regions, targeting 72.21.192.0/19 build-cache-test.s3.amazonaws.com 207.171.160.0/19 205.251.192.0/18 54.239.0.0/17 Ping Times ~3ms ~90ms ~20ms in house It's possible Amazon will use some other IP blocks, which will continue to work but at higher latency (network path via tunnel to SCL3 then back to internet).
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
FYI, you'll need to reopen/have a new bug when the S3 cacher is going to be used for branches other than try.
(In reply to Nick Thomas [:nthomas] from comment #3) > Ping Times ~3ms ~90ms ~20ms in house Oops, pardon me. Should be 90ms in us-west-2, 3ms in us-east-1.
I added 54.240.0.0/12 to be routed via the NAT, to accommodate *.s3-us-west-2.amazonaws.com (aka a us-west-2 S3 bucket).
I changed us-east-1 to route over the IGW instead of the NAT now that we have public IPs for these instances.
I've changed us-west-2 as well.
Bug 965001 gave us public IPs on the slaves, so catlee and I tore down the NAT instance, and 10.x.10 subnets. In usw2 the security group and routing table too. Chris was going to follow up with Rail about the NAT for blobber in us-esat-1.
Component: General Automation → General
You need to log in before you can comment on or make changes to this bug.