977570 - Loaned AWS slaves should be accessible without VPN

Status: RESOLVED WONTFIX

(Infrastructure & Operations Graveyard :: CIDuty, task)

Description

[Chris AtLee [:catlee]]

Many requests for slave loaners don't actually require the machine to be on the build network.

We will make things easier for developers if we don't require them to set up VPN access to get to the loaned machines.

Can we make AWS slaves public-by-default for loaners? Off the top of my head, this will require a few changes to our process:

- The instance needs to be created outside of the VPC
- It needs a different security group to allow ssh access in

Comment 1

[Armen [:armenzg]]

+1

Comment 2

[Rail Aliiev [:rail]]

(In reply to Chris AtLee [:catlee] from comment #0)
> - The instance needs to be created outside of the VPC

Hmm, this means that it can't talk to puppet. As a workaround (until we switch to golden AMIs) we can run everything inside VPC, then make a snapshot and create another instance based on the snapshot... 

Back to the pool for now...

Comment 3

[Chris Cooper [:coop] (he/him)]

(In reply to Rail Aliiev [:rail] (PTO Jul 25 - Aug 11) from comment #2)
> Hmm, this means that it can't talk to puppet. As a workaround (until we
> switch to golden AMIs) we can run everything inside VPC, then make a
> snapshot and create another instance based on the snapshot... 

Since we don't talk to puppet any more, this should be doable now, correct?

Comment 4

[Rail Aliiev [:rail]]

(In reply to Chris Cooper [:coop] from comment #3)
> Since we don't talk to puppet any more, this should be doable now, correct?

This is valid for spot instances only for now (created in aws_watch_pending.py). On-demand and loaner instances are still handled by aws_create_instance.py and talk to puppet. Unifying the processes is TBD still.

Comment 5

[Chris Cooper [:coop] (he/him)]

(In reply to Rail Aliiev [:rail] from comment #4)
> This is valid for spot instances only for now (created in
> aws_watch_pending.py). On-demand and loaner instances are still handled by
> aws_create_instance.py and talk to puppet. Unifying the processes is TBD
> still.

I know I've done this once myself, i.e. created a loaner instance for a trusted community member, wiped the secrets, removed the machine from the VPC by hand, and then provided the public IP for the instance from the AWS console. 

Do we need a better, more involved (read: automated) process than that?

Comment 6

[Rail Aliiev [:rail]]

I think it'd be possible to create instances with 2 network interfaces (vpc and not-vpc) and kill one of them depending on the needs.