[ansible-project] IP whitelisting challenge

[Gary Malouf]

We have used Ansible to automate all of our deployments to EC2 (via the EC2
packages included with Ansible) and custom roles for our own services. Our
production instances run in a vpc within public subnets.

In order to do an integration with a partner, we've been asked to provide a
range of ip addresses from which we will send them http requests. While
one approach is to use elastic ips, this is quite limiting if we need to
scale up our number of instances. Is there a cleaner way to do this in EC2
via Ansible - i.e. ensure the public ips of all instances in a subnet fall
within the same range?

[Brian Coca]

I don't think Ansible is your limiting factor, it is AWS.

[Jon Hadfield]

I had a similar issue, the difference being that I'm using only private
addresses within the VPC subnets.
As Brian said, your limiting factor is AWS, so apologies if the following
is a bit off-topic for this group...

The solution I used was to use ansible to automate a redundant pair of NAT
instances in separate subnets based on the following
guide: http://aws.amazon.com/articles/2781451301784570. By setting the
service's subnets to have a default gateway of the NAT instance in the
respective AZ, you ensure all instances in the subnet advertise on the
static NAT instance IP. It also allows for auto-scaling as the route is set
at the subnet level and inherited by all instances.

This is a functional solution but does suffer from a number of drawbacks,
e.g. not an instant failover if a NAT instance fails, your throughput is
limited by the instance types for the NAT instances, etc.

[Gary Malouf]

Thanks Jon, I appreciate hearing how you handled this. Apologies that my
issue was not limited by Ansible.

Post by Jon Hadfield
I had a similar issue, the difference being that I'm using only private
addresses within the VPC subnets.
As Brian said, your limiting factor is AWS, so apologies if the following
is a bit off-topic for this group...
The solution I used was to use ansible to automate a redundant pair of NAT
http://aws.amazon.com/articles/2781451301784570. By setting the service's
subnets to have a default gateway of the NAT instance in the respective AZ,
you ensure all instances in the subnet advertise on the static NAT instance
IP. It also allows for auto-scaling as the route is set at the subnet level
and inherited by all instances.
This is a functional solution but does suffer from a number of drawbacks,
e.g. not an instant failover if a NAT instance fails, your throughput is
limited by the instance types for the NAT instances, etc.