fetch resource group, vNet, subnet value from Infra status

[tedteng]

How to categorize this PR?

/area ops-productivity
/kind bug
/platform azure

What this PR does / why we need it:
fetch vNet, subnet value from Infra status, instead of joint name value
Which issue(s) this PR fixes:
Fixes #485

Special notes for your reviewer:
current solution logic depends on SingleSubnet

gardener-extension-provider-azure/pkg/controller/bastion/actuator_reconcile.go

Lines 82 to 84 in 2ac7abf

	if infrastructureStatus.Networks.Layout != "SingleSubnet" {
	return fmt.Errorf("unsupported network layout %s", infrastructureStatus.Networks.Layout)
	}

Release note:

fetch resource group, vNet, subnet value from Infra status, instead of joint name value

[tedteng]

/test

[testmachinery]

Testrun: e2e-csgc5
Workflow: e2e-csgc5-wf
Phase: Failed

+---------------------+---------------------+-----------+----------+
|        NAME         |        STEP         |   PHASE   | DURATION |
+---------------------+---------------------+-----------+----------+
| infrastructure-test | infrastructure-test | Succeeded | 34m39s   |
| bastion-test        | bastion-test        | Failed    | 6m9s     |
+---------------------+---------------------+-----------+----------+

[tedteng]

/test

[testmachinery]

Testrun: e2e-57z2d
Workflow: e2e-57z2d-wf
Phase: Succeeded

+---------------------+---------------------+-----------+----------+
|        NAME         |        STEP         |   PHASE   | DURATION |
+---------------------+---------------------+-----------+----------+
| infrastructure-test | infrastructure-test | Succeeded | 40m57s   |
| bastion-test        | bastion-test        | Succeeded | 11m7s    |
+---------------------+---------------------+-----------+----------+

[tedteng]

/test

[testmachinery]

Testrun: e2e-pl4xf
Workflow: e2e-pl4xf-wf
Phase: Succeeded

+---------------------+---------------------+-----------+----------+
|        NAME         |        STEP         |   PHASE   | DURATION |
+---------------------+---------------------+-----------+----------+
| infrastructure-test | infrastructure-test | Succeeded | 28m24s   |
| bastion-test        | bastion-test        | Succeeded | 12m56s   |
+---------------------+---------------------+-----------+----------+

[gardener-robot]

@tedteng You need rebase this pull request with latest master branch. Please check.

[tedteng]

/test

[testmachinery]

Testrun: e2e-hc56x
Workflow: e2e-hc56x-wf
Phase: Succeeded

+---------------------+---------------------+-----------+----------+
|        NAME         |        STEP         |   PHASE   | DURATION |
+---------------------+---------------------+-----------+----------+
| infrastructure-test | infrastructure-test | Succeeded | 29m48s   |
| bastion-test        | bastion-test        | Succeeded | 10m36s   |
+---------------------+---------------------+-----------+----------+

[tedteng]

rebased as request, Please reveiw and process the PR when available @gardener/gardener-extension-provider-azure-maintainers Thanks

[kon-angelo]

Does it really not work when there are multiple subnets? I would think that the bastion instance would be able to reach the other nodes, even if multiple subnets are used.

[tedteng]

I didn't test it, the main Azure bastion PR base on a single Subnet mode is completed before multiple subnets are achieved #331. but we have an internal ticket about Bastion Azure extension multi zones support in SRE backlog

[andrei-panov]

Hi @kon-angelo, there are Firewall rules created together with Bastion that limit connections to the certain subnet. Originally there was a plan to implement multi-AZ right after the main Bastion development but priorities were changed, unfortunately...

[andrei-panov]

Just in case I dismiss our internal ticket because it's not visible to anyone...

[tedteng]

after rethinking, I think this PR also covers multiple subnets supported by a bastion extension now. By default, Azure subnets communicate with each other under the same virtual network. https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#:~:text=Azure%20automatically%20routes%20traffic,of%20a%20virtual%20network

I am assuming infrastructureStatus.Networks.Subnets always keep subnets which used by the gardener only, by default bastion uses the first subnet to create a bastion

gardener-extension-provider-azure/pkg/controller/bastion/actuator_reconcile.go

Line 81 in 5297c61

nic, err := ensureNic(ctx, factory, opt, infrastructureStatus.Networks.VNet.Name, infrastructureStatus.Networks.Subnets[0].Name, publicIP)

will remove the SingleSubnet mode check logic

[tedteng]

done 042d16b @kon-angelo

[kon-angelo]

@tedteng I checked it and as it is just removing the SingleSubnet check is not enough.
Here is a solution in a draft PR i opened based on this one. You can do some testing yourself too to see that it works E2E.

[tedteng]

Thanks, It works. I will close the PR.
Please process the draft PR you opened