[JIRA] (JENKINS-58578) Public IP can still be assigned when Associate Public IP is disabled, depending on subnet(s)

[email protected] (JIRA) Fri, 19 Jul 2019 20:27:10 -0700

Title: Message Title

Andrew Goldin created an issue

Issue Type:	Bug
Assignee:	FABRIZIO MANFREDI
Components:	ec2-plugin
Created:	2019-07-20 03:26
Environment:	Master: Docker jenkins:2.176.2 running in Kubernetes, Workers: CentOS EC2 w/ Docker 18.09.6 and OpenJDK 8, EC2 plugin version: 1.43
Priority:	Minor
Reporter:	Andrew Goldin

Issue

When configuring agent templates for the EC2 plugin, if you choose subnet(s) that have "Auto-assign public IPv4 address" enabled (on the AWS side), then agents will be launched with a public IPv4 address whether "Associate Public IP" is enabled in Jenkins or not. I am not sure if this is the intended behavior of the plugin, but for me it is not the expected behavior.

Observed/expected behavior

Given a subnet with "Auto-assign public IPv4 address" enabled in AWS but "Associate Public IP" disabled in Jenkins:

Observed: Agent launches with public IP
Expected: Agent launches without public IP

How to reproduce

In an agent template:

Use a subnet that has "Auto-assign public IPv4 address" enabled in AWS
Ensure "Associate Public IP" is unchecked
Launch an agent using the template
Check EC2 instance in the AWS console or other method
Instance will have a public IPv4 address and public DNS

Workaround

This issue unsurprisingly does not occur when using a subnet that has "Auto-assign public IPv4 address" disabled. We are doing this as a workaround for now. The subnets I eventually wish to use happen to have this flag enabled (for other purposes), but for Jenkins I'd like to be able to use these subnets while not assigning public IPs to agents.

Possible fix

Based on some digging through the code, I believe the possible culprits are here for on-demand instances and here for spot instances, namely:

 
                                                                if (getAssociatePublicIp()) {
    net.setAssociatePublicIpAddress(true);
    net.setDeviceIndex(0);
    riRequest.withNetworkInterfaces(net);
}
 
                                                            

Here, if associatePublicIp is true, then true will be passed to the network interface. However, if associatePublicIp is false, then it is likely instead defaulting to whatever is set on the subnet. Given this, I see two possible solutions:

If associatePublicIp is false, then explicitly pass false to the network interface.
Include an additional flag for whether or not to use the subnet's own auto-assign setting. Then if the choice is made to not use it, explicitly pass the value of associatePublicIp.

Add Comment

--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.200731.1563593184000.16833.1563593220208%40Atlassian.JIRA.