[core] Do not emit duplicate messages (warnings/errors/...) #9565

eladb · 2020-08-10T13:56:04Z

When synthesizing the EKS integration test I am getting the following output:

[Warning at /aws-cdk-eks-cluster-test/Cluster/ControlPlaneSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/ControlPlaneSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/ControlPlaneSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/ControlPlaneSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/ControlPlaneSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/ControlPlaneSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/ControlPlaneSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/ControlPlaneSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/KubectlProviderSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/Nodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/Nodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/Nodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/Nodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/Nodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/BottlerocketNodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/BottlerocketNodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/BottlerocketNodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/BottlerocketNodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/BottlerocketNodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/spot/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/spot/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/spot/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/spot/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/spot/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/InferenceInstances/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/InferenceInstances/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/InferenceInstances/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/InferenceInstances/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/InferenceInstances/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup

Reproduction Steps

In the CDK repo:

$ cd packages/@aws-cdk/aws-eks
$ cdk synth -a test/integ.eks-cluster.ts

What did you expect to happen?

Don't display the same warning twice:

[Warning at /aws-cdk-eks-cluster-test/Cluster/ControlPlaneSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/KubectlProviderSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/Nodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/BottlerocketNodes/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/spot/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
[Warning at /aws-cdk-eks-cluster-test/Cluster/InferenceInstances/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup

What actually happened?

Environment

CLI Version : 1.57.0
Framework Version: 1.57.0
Node.js Version: 14.5.0
OS : Mac OSX
Language (Version): all

This is 🐛 Bug Report

The text was updated successfully, but these errors were encountered:

rix0rrr · 2020-08-10T13:57:30Z

The same annotation should probably just not be emitted twice.

rix0rrr · 2020-08-10T13:58:40Z

Also that warning should probably not be emitted at all.

eladb · 2020-08-10T14:00:35Z

The same annotation should probably just not be emitted twice.

That's probably a good idea - we can do that based on scope path and message text.

NetaNir · 2020-08-15T16:53:43Z

The reason I added the warning was due to multiple issues reported by users when trying to add an egress rule to allow all IPv6 traffic, and the rule being ignored since by default allowAllOutBound is set to true.
The default condition today creates a weird situation in which not all traffic is allowed by default (only IPv4) and in order to add all IPv6 one needs to set "allowAllOutBound" to false and then add two rules which allows all traffic, to IPv4 and IPv6.

See more discussion in #7827 (comment)

@rix0rrr

joerx · 2020-09-19T18:10:36Z

Assuming I'm creating an SG for an ECS service, like this:

    const serviceSg = new ec2.SecurityGroup(this, "MySg", {
      vpc: props.vpc,
    });

    const service = new ecs.FargateService(this, "Service", {
      securityGroups: [serviceSg],
    });

Then allow ingress from, let's say a database:

db.connections.allowFrom(serviceSg, ec2.Port.tcp(1234));

At this point I'll get the warning, in a (to my knowledge) perfectly valid setup. Trying to "fix" it by setting allowAllOutbound=false will break the ECS service since it now can't pull docker images anymore.

IMHO a warning shouldn't be shown here. It can be irritating and in this case counterproductive.

NetaNir · 2020-09-22T05:43:44Z

Yeah, the allowFrom is trying to add an ingress rule to the connection and an egress rule to security group. Since the security group already allows all outbound traffic the warning will be added. I agree that in this case it is not helpful. We will remove the warning once we add Ipv6 to the allowAllOutBound implementation.

itajaja · 2021-01-08T16:50:01Z

so is it safe if in EKS' addAutoScalingGroupCapacity i set allowAllOutbound to false? seems like the default security group does allow outbounds.

heiba · 2021-04-11T22:04:48Z

@NetaNir Please see the picture below. This is a horrible amount of needless warnings that are emitted every time I build a project In CDK all related to the exact same ALB security group, albeit from different ALB listeners.

Please apply a fix to not emit this warning, or at least only emit it once.

This issue has been raised since 10th August 2020, i.e. 10 months ago.

Appreciate your kind action.

ThomasSteinbach · 2021-05-07T14:24:29Z

@NetaNir "We will remove the warning once we add Ipv6 to the allowAllOutBound implementation."

Is there an issue we can track the status from? We have commented out --strict in our CDK deployment with a "TODO - WORKAROUND issue..." comment above. It would be nice having a reference to the progress of the solution, as we regularly try to solve all workarounds.

heiba · 2021-05-29T07:49:35Z

@NetaNir any news on this please ?

metametadata · 2021-10-12T21:20:05Z

It would be great to have some way to get rid of Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup warnings. Setting allowAllOutbound=false is not applicable in my cases.

heiba · 2021-11-26T16:29:00Z

@NetaNir any news on this please ?

automartin5000 · 2022-01-10T02:54:06Z

Assuming I'm creating an SG for an ECS service, like this:
    const serviceSg = new ec2.SecurityGroup(this, "MySg", {
      vpc: props.vpc,
    });

    const service = new ecs.FargateService(this, "Service", {
      securityGroups: [serviceSg],
    });
Then allow ingress from, let's say a database:
db.connections.allowFrom(serviceSg, ec2.Port.tcp(1234));
At this point I'll get the warning, in a (to my knowledge) perfectly valid setup. Trying to "fix" it by setting allowAllOutbound=false will break the ECS service since it now can't pull docker images anymore.

IMHO a warning shouldn't be shown here. It can be irritating and in this case counterproductive.

@rix0rrr @eladb @NetaNir Could we get a comment on fixing this? As previously mentioned, this is a bug when using the CDK as designed.

manoj0700 · 2022-05-03T06:15:19Z

Any update or fix on this? Observing multiple warnings.

rtrap-rsi · 2022-10-10T13:54:32Z

Still no updates on this?

bora-7 · 2022-10-12T16:26:16Z

working on it

…te error message for issue aws#9565

bora-7 · 2022-10-18T07:22:19Z

working on a permanent fix

Annotations added many times clog terminal space and make debugging difficult. Deduplicate annotations based on the message. Closes #9565. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

github-actions · 2023-02-09T17:54:50Z

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

metametadata · 2023-02-10T11:34:16Z

@NetaNir @Styerp @TheRealAmazonKendra

The fix will try to deduplicate the messages. But another important question was not addressed. Users expect no warnings at all as was explained in, say, #9565 (comment). Is there an issue to track that problem?

Styerp · 2023-02-10T17:38:21Z

In my opinion, using of this issue to track unwanted messages from the ec2 module subverts the original bug report: duplicate messages in the core module.

In the interest of not losing the "bad warnings" report, I opened #24109

eladb added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Aug 10, 2020

github-actions bot added the @aws-cdk/aws-ec2 Related to Amazon Elastic Compute Cloud label Aug 10, 2020

github-actions bot assigned rix0rrr Aug 10, 2020

eladb mentioned this issue Aug 10, 2020

[aws-eks] "Ignore egress rule" warnings #9566

Closed

rix0rrr changed the title ~~[ec2] Duplicate "Ignoring Egress rule" warnings~~ [core] Do not emit duplicate messages (warnings/errors/...) Aug 10, 2020

rix0rrr added @aws-cdk/core Related to core CDK functionality effort/small Small work item – less than a day of effort good first issue Related to contributions. See CONTRIBUTING.md and removed @aws-cdk/aws-ec2 Related to Amazon Elastic Compute Cloud labels Aug 10, 2020

github-actions bot assigned eladb Aug 10, 2020

rix0rrr added the p2 label Aug 10, 2020

SomayaB removed the needs-triage This issue or PR still needs to be triaged. label Aug 10, 2020

manospasj mentioned this issue Aug 15, 2020

[core] Do not ignore Egress rules when 'allowAllOutbound' is set to true #9740

Closed

2 tasks

eladb removed their assignment Aug 17, 2020

rix0rrr removed their assignment Jun 3, 2021

bora-7 added a commit to bora-7/aws-cdk that referenced this issue Oct 12, 2022

fix: comment out the allowOutBound error condition to fix the duplica…

ce94768

…te error message for issue aws#9565

bora-7 added a commit to bora-7/aws-cdk that referenced this issue Oct 12, 2022

fix: comment out the allowOutBound error condition to fix the duplica…

aeeb124

…te error message for issue aws#9565

bora-7 mentioned this issue Oct 12, 2022

chore(aws-ec2): removing duplicate warning messages about 'ignoring egress rule' #22475

Closed

4 tasks

comcalvi added the @aws-cdk/aws-ec2 Related to Amazon Elastic Compute Cloud label Jan 25, 2023

Styerp mentioned this issue Feb 5, 2023

fix(core): messages are displayed multiple times per construct #24019

Merged

mergify bot closed this as completed in #24019 Feb 9, 2023

Styerp mentioned this issue Feb 10, 2023

(ec2): Warnings emitted for valid configurations #24109

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[core] Do not emit duplicate messages (warnings/errors/...) #9565

[core] Do not emit duplicate messages (warnings/errors/...) #9565

eladb commented Aug 10, 2020

rix0rrr commented Aug 10, 2020

rix0rrr commented Aug 10, 2020

eladb commented Aug 10, 2020

NetaNir commented Aug 15, 2020 •

edited

Loading

joerx commented Sep 19, 2020 •

edited

Loading

NetaNir commented Sep 22, 2020

itajaja commented Jan 8, 2021

heiba commented Apr 11, 2021 •

edited

Loading

ThomasSteinbach commented May 7, 2021

heiba commented May 29, 2021

metametadata commented Oct 12, 2021

heiba commented Nov 26, 2021

automartin5000 commented Jan 10, 2022

manoj0700 commented May 3, 2022

rtrap-rsi commented Oct 10, 2022

bora-7 commented Oct 12, 2022

bora-7 commented Oct 18, 2022

github-actions bot commented Feb 9, 2023

metametadata commented Feb 10, 2023 •

edited

Loading

Styerp commented Feb 10, 2023

[core] Do not emit duplicate messages (warnings/errors/...) #9565

[core] Do not emit duplicate messages (warnings/errors/...) #9565

Comments

eladb commented Aug 10, 2020

Reproduction Steps

What did you expect to happen?

What actually happened?

Environment

rix0rrr commented Aug 10, 2020

rix0rrr commented Aug 10, 2020

eladb commented Aug 10, 2020

NetaNir commented Aug 15, 2020 • edited Loading

joerx commented Sep 19, 2020 • edited Loading

NetaNir commented Sep 22, 2020

itajaja commented Jan 8, 2021

heiba commented Apr 11, 2021 • edited Loading

ThomasSteinbach commented May 7, 2021

heiba commented May 29, 2021

metametadata commented Oct 12, 2021

heiba commented Nov 26, 2021

automartin5000 commented Jan 10, 2022

manoj0700 commented May 3, 2022

rtrap-rsi commented Oct 10, 2022

bora-7 commented Oct 12, 2022

bora-7 commented Oct 18, 2022

github-actions bot commented Feb 9, 2023

⚠️COMMENT VISIBILITY WARNING⚠️

metametadata commented Feb 10, 2023 • edited Loading

Styerp commented Feb 10, 2023

NetaNir commented Aug 15, 2020 •

edited

Loading

joerx commented Sep 19, 2020 •

edited

Loading

heiba commented Apr 11, 2021 •

edited

Loading

metametadata commented Feb 10, 2023 •

edited

Loading