From e5801aa6ba2da6f7ca5187f860e01bfc06305a55 Mon Sep 17 00:00:00 2001 From: Ben Duncan <5178243+benduncan@users.noreply.github.com> Date: Thu, 26 Mar 2026 16:23:38 +1000 Subject: [PATCH] fix: NAT Gateway E2E order + CA cert in reset-dev-env (mulga-763) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit E2E: associate subnet with route table BEFORE adding the NAT GW route. CreateRoute publishes SNAT events for associated subnets — if the association doesn't exist yet, no SNAT rule is created in OVN. Validated locally: bastion SSH hop works, ping 8.8.8.8 passes with NAT GW, fails without. All 5 steps confirmed. reset-dev-env.sh: trust Spinifex CA cert before starting services, fixing TLS cert verify failures on fresh resets. --- scripts/reset-dev-env.sh | 10 +++++++++- tests/e2e/run-e2e.sh | 8 +++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/scripts/reset-dev-env.sh b/scripts/reset-dev-env.sh index 5bece6c74..79a767b21 100755 --- a/scripts/reset-dev-env.sh +++ b/scripts/reset-dev-env.sh @@ -212,8 +212,16 @@ if [ ! -f ~/.ssh/spinifex-key.pub ]; then ssh-keygen -t ed25519 -f ~/.ssh/spinifex-key -N "" fi +# Trust the Spinifex CA certificate so TLS connections to predastore/awsgw work +if [ -f "$HOME/spinifex/config/ca.pem" ]; then + echo "Adding Spinifex CA certificate to system trust store..." + sudo cp "$HOME/spinifex/config/ca.pem" /usr/local/share/ca-certificates/spinifex-ca.crt + sudo update-ca-certificates +fi + # Enable pprof for development -PPROF_ENABLED=1 PPROF_OUTPUT=/tmp/spinifex-vm.prof ./scripts/start-dev.sh --build +#PPROF_ENABLED=1 PPROF_OUTPUT=/tmp/spinifex-vm.prof ./scripts/start-dev.sh --build +./scripts/start-dev.sh --build export AWS_PROFILE=spinifex diff --git a/tests/e2e/run-e2e.sh b/tests/e2e/run-e2e.sh index cce30786d..55fe16bcc 100755 --- a/tests/e2e/run-e2e.sh +++ b/tests/e2e/run-e2e.sh @@ -2996,13 +2996,15 @@ echo " PASS: Bastion → private instance SSH works (hostname: $PRIV_HOSTNAME)" NAT_GW_ID=$(echo "$NAT_GW_OUTPUT" | jq -r '.NatGateway.NatGatewayId') echo " NAT Gateway: $NAT_GW_ID" - # Create route table for private subnet with NAT GW route + # Create route table, associate with private subnet, THEN add NAT GW route. + # Order matters: CreateRoute publishes SNAT events for associated subnets, + # so the association must exist before the route is added. NAT_RTB=$(aws ec2 create-route-table --vpc-id "$DEFAULT_VPC" \ --query 'RouteTable.RouteTableId' --output text) - aws ec2 create-route --route-table-id "$NAT_RTB" \ - --destination-cidr-block 0.0.0.0/0 --nat-gateway-id "$NAT_GW_ID" > /dev/null NAT_RTB_ASSOC=$(aws ec2 associate-route-table --route-table-id "$NAT_RTB" \ --subnet-id "$PRIV_SUBNET_ID" --query 'AssociationId' --output text) + aws ec2 create-route --route-table-id "$NAT_RTB" \ + --destination-cidr-block 0.0.0.0/0 --nat-gateway-id "$NAT_GW_ID" > /dev/null echo " Route: 0.0.0.0/0 → $NAT_GW_ID (rtb: $NAT_RTB, assoc: $NAT_RTB_ASSOC)" # Verify OVN SNAT rule exists