search

gardener / gardener-extension-provider-aws

Gardener extension controller for the AWS cloud provider (https://aws.amazon.com).
https://gardener.cloud
Apache License 2.0
19 stars 97 forks source link

Forbid replacing secret with new account for existing Shoots #40

Open ialidzhikov opened 4 years ago

ialidzhikov commented 4 years ago

What would you like to be added: Currently we don't have a validation that would prevent user to replace its cloudprovider secret with credentials for another account. Basically we do have only a warning in the dashboard - ref https://github.com/gardener/dashboard/pull/422.

Steps to reproduce:

  1. Get an existing Shoot.
  2. Update its secret with credentials for another account.
  3. Ensure that on new reconciliation, new infra resources will be created in the new account. The old infra resources and machines in the old account will leak. For me the reconciliation failed at 
    lastOperation:
  description: Waiting until the Kubernetes API server can connect to the Shoot
    workers
  lastUpdateTime: "2020-02-20T14:56:43Z"
  progress: 89
  state: Processing
  type: Reconcile

wtih reason

$ k describe svc -n kube-system vpn-shoot
Events:
  Type     Reason                   Age                  From                Message
  ----     ------                   ----                 ----                -------
  Normal   EnsuringLoadBalancer     7m38s (x6 over 10m)  service-controller  Ensuring load balancer
  Warning  SyncLoadBalancerFailed   7m37s (x6 over 10m)  service-controller  Error syncing load balancer: failed to ensure load balancer: could not find any suitable subnets for creating the ELB

Why is this needed: Prevent users to harm themselves.

rfranzke commented 4 years ago

g/g core cannot do it. Isn’t it rather an issue for the various extension providers?

ialidzhikov commented 4 years ago

Yes, right. I opened now issues to the provider specific repos.