Fix AWS worker pool handling

[johananl]

General

Fixes #349.

This PR fixes the handling of worker pools on AWS. Following is a summary of the changes:

• There used to be an "invisible" worker pool of size 0 that was created with every cluster. This pool is now removed.
• NLB listeners are now created per worker pool and are correctly wired to the right target groups. Before this change there used to be one "global" set of listeners which were wired to the empty worker pool, practically blackholing all ingress traffic to the cluster.
• NLB listener ports for HTTP/HTTPS are now configurable with a default of 80/443, respectively. This is required in order to support an arbitrary number of worker pools with ingress using the same NLB.
• Target group names have been cleaned. These are limited to 32 characters by the AWS API so we want to keep them short. Related issue: Handle AWS ELB target group names > 32 characters #366

Testing

To test this PR, deploy a cluster with a config similar to the following

cluster "aws" {
  asset_dir        = "./assets"
  cluster_name     = "my-cluster"
  controller_count = 1
  dns_zone         = "example.com"
  dns_zone_id      = "xxxxxxxx"
  ssh_pubkeys      = ["ssh-rsa ..."]

  worker_pool "pool-1" {
    instance_type = "t3a.small"
    count         = 2
    ssh_pubkeys   = ["ssh-rsa ..."]
  }
}

component "contour" {
  service_type = "NodePort"
}
component "cert-manager" {
  email = "me@example.com"
}
component "httpbin" {
  ingress_host = "httpbin.example.com"
}

httpbin should be available at https://httpbin.example.com.

[johananl]

We're hitting the size limit of the ELB target group name (32 chars).

[johananl]

We're hitting the size limit of the ELB target group name (32 chars).

Fixed.

[invidian]

Just some small nits, otherwise LGTM. Nice work @johananl

[surajssd]

httpbin should be available at https://httpbin.example.com.

@johananl I was manually testing this PR, where should httpbin.example.com be pointing to in Route53? This is a manual step right?

[johananl]

httpbin should be available at https://httpbin.example.com.

@johananl I was manually testing this PR, where should httpbin.example.com be pointing to in Route53? This is a manual step right?

Lokomotive creates a wildcard record which routes *.example.com to the NLB. You shouldn't need to touch Route 53 manually. My testing instructions should work exactly as written.

[invidian]

Lokomotive creates a wildcard record which routes *.example.com to the NLB. You shouldn't need to touch Route 53 manually. My testing instructions should work exactly as written.

@johananl if this should work fully automatically, perhaps we should add e2e test for it? Which just does the HTTP request which should succeed?

[johananl]

Lokomotive creates a wildcard record which routes *.example.com to the NLB. You shouldn't need to touch Route 53 manually. My testing instructions should work exactly as written.

@johananl if this should work fully automatically, perhaps we should add e2e test for it? Which just does the HTTP request which should succeed?

I can look into that, although I wanted to keep the scope of this PR small and merge it ASAP as things are currently broken.

[surajssd]

I can look into that, although I wanted to keep the scope of this PR small and merge it ASAP as things are currently broken.

This works for me. Only one difference from deploying on packet is that on packet we need to create a manual entry in route53 and here user is free to choose whatever URL they want.

On AWS we need to make sure that your the URL is <app-name>.<cluster-name>.<dns-zone>.

[johananl]

Only one difference from deploying on packet is that on packet we need to create a manual entry in route53 and here user is free to choose whatever URL they want.

Opened #370 to track this.

On AWS we need to make sure that your the URL is <app-name>.<cluster-name>.<dns-zone>.

Opened #371 to track this.

[surajssd]

Works for me.

[rata]

@johananl This LGTM, as I said in the previous reviews, I don't think I need to review again, the changes that might receive this PR are very small.

Regarding the open comment, as I mentioned, mark it solved when you consider it solved (AFAICS you found problems to test your solution, I think whatever you consider is reasonable at this point, is fine). Regarding the other comments, they are nit-picking so whatever you decide (even leave it as it is), is fine by me :)

If you need, of course, just ping me for a LGTM :)

[johananl]

All feedback was handled. Please check again.

[rata]

LGTM. Thanks a lot @johananl, this improvement is really important! :)

[iaguis]

I've rebased and fixed conflicts.

[rata]

Sticky LGTM :-P