gsadmin/spinifex
1
0
Fork 0
mirror of https://github.com/mulgadc/spinifex.git synced 2026-10-15 09:01:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: NAT Gateway E2E order + CA cert in reset-dev-env (mulga-763)

Browse Source 
E2E: associate subnet with route table BEFORE adding the NAT GW route.
CreateRoute publishes SNAT events for associated subnets — if the
association doesn't exist yet, no SNAT rule is created in OVN.

Validated locally: bastion SSH hop works, ping 8.8.8.8 passes with
NAT GW, fails without. All 5 steps confirmed.

reset-dev-env.sh: trust Spinifex CA cert before starting services,
fixing TLS cert verify failures on fresh resets.
This commit is contained in:
Ben Duncan
2026-03-26 16:23:38 +10:00
parent 77a4a40ca6
commit e5801aa6ba
2 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/reset-dev-env.sh
+9 -1
View File
@@ -212,8 +212,16 @@ if [ ! -f ~/.ssh/spinifex-key.pub ]; then
ssh-keygen -t ed25519 -f ~/.ssh/spinifex-key -N ""
fi
# Trust the Spinifex CA certificate so TLS connections to predastore/awsgw work
if [ -f "$HOME/spinifex/config/ca.pem" ]; then
echo "Adding Spinifex CA certificate to system trust store..."
sudo cp "$HOME/spinifex/config/ca.pem" /usr/local/share/ca-certificates/spinifex-ca.crt
sudo update-ca-certificates
fi
# Enable pprof for development
PPROF_ENABLED=1 PPROF_OUTPUT=/tmp/spinifex-vm.prof ./scripts/start-dev.sh --build
#PPROF_ENABLED=1 PPROF_OUTPUT=/tmp/spinifex-vm.prof ./scripts/start-dev.sh --build
./scripts/start-dev.sh --build
export AWS_PROFILE=spinifex
tests/e2e/run-e2e.sh
+5 -3
View File
@@ -2996,13 +2996,15 @@ echo " PASS: Bastion → private instance SSH works (hostname: $PRIV_HOSTNAME)"
NAT_GW_ID=$(echo "$NAT_GW_OUTPUT" | jq -r '.NatGateway.NatGatewayId')
echo " NAT Gateway: $NAT_GW_ID"
# Create route table for private subnet with NAT GW route
# Create route table, associate with private subnet, THEN add NAT GW route.
# Order matters: CreateRoute publishes SNAT events for associated subnets,
# so the association must exist before the route is added.
NAT_RTB=$(aws ec2 create-route-table --vpc-id "$DEFAULT_VPC" \
--query 'RouteTable.RouteTableId' --output text)
aws ec2 create-route --route-table-id "$NAT_RTB" \
--destination-cidr-block 0.0.0.0/0 --nat-gateway-id "$NAT_GW_ID" > /dev/null
NAT_RTB_ASSOC=$(aws ec2 associate-route-table --route-table-id "$NAT_RTB" \
--subnet-id "$PRIV_SUBNET_ID" --query 'AssociationId' --output text)
aws ec2 create-route --route-table-id "$NAT_RTB" \
--destination-cidr-block 0.0.0.0/0 --nat-gateway-id "$NAT_GW_ID" > /dev/null
echo " Route: 0.0.0.0/0 → $NAT_GW_ID (rtb: $NAT_RTB, assoc: $NAT_RTB_ASSOC)"
# Verify OVN SNAT rule exists