{"action":"created","issue":{"url":"https://api.github.com/repos/awslabs/cfncluster/issues/531","repository_url":"https://api.github.com/repos/awslabs/cfncluster","labels_url":"https://api.github.com/repos/awslabs/cfncluster/issues/531/labels{/name}","comments_url":"https://api.github.com/repos/awslabs/cfncluster/issues/531/comments","events_url":"https://api.github.com/repos/awslabs/cfncluster/issues/531/events","html_url":"https://github.com/awslabs/cfncluster/issues/531","id":356410635,"node_id":"MDU6SXNzdWUzNTY0MTA2MzU=","number":531,"title":"CfnCluster fails to start a cluster with COMPUTE nodes in a PRIVATE subnet","user":{"login":"vbosquier","id":36445211,"node_id":"MDQ6VXNlcjM2NDQ1MjEx","avatar_url":"https://avatars1.githubusercontent.com/u/36445211?v=4","gravatar_id":"","url":"https://api.github.com/users/vbosquier","html_url":"https://github.com/vbosquier","followers_url":"https://api.github.com/users/vbosquier/followers","following_url":"https://api.github.com/users/vbosquier/following{/other_user}","gists_url":"https://api.github.com/users/vbosquier/gists{/gist_id}","starred_url":"https://api.github.com/users/vbosquier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vbosquier/subscriptions","organizations_url":"https://api.github.com/users/vbosquier/orgs","repos_url":"https://api.github.com/users/vbosquier/repos","events_url":"https://api.github.com/users/vbosquier/events{/privacy}","received_events_url":"https://api.github.com/users/vbosquier/received_events","type":"User","site_admin":false},"labels":[{"id":99080508,"node_id":"MDU6TGFiZWw5OTA4MDUwOA==","url":"https://api.github.com/repos/awslabs/cfncluster/labels/help%20wanted","name":"help wanted","color":"159818","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-09-03T08:45:27Z","updated_at":"2018-09-06T15:30:04Z","closed_at":"2018-09-05T07:20:21Z","author_association":"NONE","body":"Hi,\r\n\r\nI want to start a cfncluster with the MASTER node in a public Subnet and the COMPUTE nodes in a private Subnet. I don't want my compute nodes to be exposed, and even if you can close all possible ways to connect to the nodes through the Security Group, I'm convinced that having a Public IP on the compute nodes is an unnecessary weakness in terms of security.\r\nMy question is:\r\nHOW CAN I START A CLUSTER HAVING THE COMPUTE NODES IN A STRICTLY PRIVATE NETWORK (with no Internet access at all)?\r\n\r\nComplementary info:\r\nWhen trying to start such cluster, the ComputeFleet fails to initialize, and the cluster fails to start with the following error:\r\n\r\n```\r\nStatus: cfncluster-Test - CREATE_FAILED                             \r\nCluster creation failed.  Failed events:\r\n  - AWS::CloudFormation::Stack cfncluster-Test The following resource(s) failed to create: [ComputeFleet]. \r\n  - AWS::AutoScaling::AutoScalingGroup ComputeFleet Received 2 FAILURE signal(s) out of 2.  Unable to satisfy 100% MinSuccessfulInstancesPercent requirement\r\n```\r\n\r\nIn cloud-init.log, I could see that the script named /var/lib/cloud/instance/scripts/part-002 fails to execute properly on the COMPUTE nodes (no error on the MASTER, and no error if the COMPUTE nodes are configured to start in a public Subnet) :\r\n\r\n> 2018-08-28 15:36:38,160 - util.py[DEBUG]: Running command ['/var/lib/cloud/instance/scripts/part-002'] with allowed return codes [0] (shell=False, capture=False)\r\n> 2018-08-28 15:47:11,727 - util.py[WARNING]: Failed running /var/lib/cloud/instance/scripts/part-002 [1]\r\n> 2018-08-28 15:47:11,728 - util.py[DEBUG]: Failed running /var/lib/cloud/instance/scripts/part-002 [1]\r\n> Traceback (most recent call last):\r\n>   File \"/usr/lib/python2.7/site-packages/cloudinit/util.py\", line 802, in runparts\r\n>     subp(prefix + [exe_path], capture=False)\r\n>   File \"/usr/lib/python2.7/site-packages/cloudinit/util.py\", line 1858, in subp\r\n>     cmd=args)\r\n> ProcessExecutionError: Unexpected error while running command.\r\n> Command: ['/var/lib/cloud/instance/scripts/part-002']\r\n> Exit code: 1\r\n> Reason: -\r\n> Stdout: -\r\n> Stderr: -\r\n\r\n\r\nPlease, find below the configuration that I use:\r\n\r\n```\r\n[aws]\r\naws_region_name = eu-west-1\r\naws_access_key_id = xxx\r\naws_secret_access_key = xxx\r\n\r\n[global]\r\nupdate_check = true\r\nsanity_check = true\r\ncluster_template = TorqueCluster\r\n\r\n[cluster TorqueCluster]\r\nvpc_settings = VPC-test\r\nkey_name = mykey\r\nscheduler = torque\r\nbase_os = centos7\r\ninitial_queue_size = 2\r\nmax_queue_size = 2\r\nmaintain_initial_size = true\r\nmaster_instance_type = m4.xlarge\r\ncompute_instance_type = t2.micro\r\n\r\n[vpc VPC-test]\r\nvpc_id = vpc-xxx\r\nmaster_subnet_id = subnet-<public>\r\ncompute_subnet_id = subnet-<private>\r\nvpc_security_group_id = sg-xxx\r\n```\r\n\r\nThanks in advance for your help."},"comment":{"url":"https://api.github.com/repos/awslabs/cfncluster/issues/comments/419138291","html_url":"https://github.com/awslabs/cfncluster/issues/531#issuecomment-419138291","issue_url":"https://api.github.com/repos/awslabs/cfncluster/issues/531","id":419138291,"node_id":"MDEyOklzc3VlQ29tbWVudDQxOTEzODI5MQ==","user":{"login":"enrico-usai","id":10634438,"node_id":"MDQ6VXNlcjEwNjM0NDM4","avatar_url":"https://avatars3.githubusercontent.com/u/10634438?v=4","gravatar_id":"","url":"https://api.github.com/users/enrico-usai","html_url":"https://github.com/enrico-usai","followers_url":"https://api.github.com/users/enrico-usai/followers","following_url":"https://api.github.com/users/enrico-usai/following{/other_user}","gists_url":"https://api.github.com/users/enrico-usai/gists{/gist_id}","starred_url":"https://api.github.com/users/enrico-usai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/enrico-usai/subscriptions","organizations_url":"https://api.github.com/users/enrico-usai/orgs","repos_url":"https://api.github.com/users/enrico-usai/repos","events_url":"https://api.github.com/users/enrico-usai/events{/privacy}","received_events_url":"https://api.github.com/users/enrico-usai/received_events","type":"User","site_admin":false},"created_at":"2018-09-06T15:30:04Z","updated_at":"2018-09-06T15:30:04Z","author_association":"CONTRIBUTOR","body":"For completness I would add that VPC Endpoints can't replace the NAT Gateway because Compute Nodes require web access (e.g. to download [cookbooks](https://github.com/awslabs/cfncluster/blob/develop/cloudformation/cfncluster.cfn.json#L2744)).\r\n\r\nCurrently it is required to use a NAT Gateway or an internal PROXY as already mentioned [here](https://github.com/awslabs/cfncluster/issues/302#issuecomment-359103583)."}}
{"actor":{"display_login":"enrico-usai"}}