feat: Add toggle to disable default route creation for public route tables#1188
feat: Add toggle to disable default route creation for public route tables#1188HasseJohansen wants to merge 15 commits into
Conversation
…route feat: Add toggle to disable public default route
…route Make default opposite to match existing vars
|
This PR has been automatically marked as stale because it has been open 30 days |
|
Please do not close. Can we have some action on this? or a decission if this is going to be merged or you would merge #1190 ? |
|
This PR has been automatically marked as stale because it has been open 30 days |
|
Please do not close |
|
this would solve #1187 |
|
I'll take a look at the Network Firewall integration options today |
|
@bryantbiggs I synchronised with master and somehow this pre-commit check now fails. I can't really figure out what the problem is? (also because when I run pre-commit locally I just get a lot of error that region is an unsupported variable like: |
|
Got it working. It seems between when I made the PR originally we now also need to add new options to the wrappers/main.tf Is there any chance I can get this merged? |
|
@bryantbiggs Is there any idea of if/when this would get merged? We are deploying an NGFW and without this, we're basically forcing the allowance of drift. Which isn't ideal for obvious reasons, but this is the big thing we need to allow for changing the 0/0 route. (yes I know I posted this same thing in both but it's not clear which may or may not be merged) |
|
I would also like that this gets some traction. I must say I am surprised that there is not more activity in what I believe is the goto module for vpc creation in the terraform community I have been using my fork since I opened this pull request - also in production and anyway it is a very small change which defaults to the “old behaviour” so I don’t see much risk in merging it (but maybe maintainers see something I haven’t though about) |
folks tend to look at changes in isolation, which we do not (nor could we, otherwise the modules wouldn't be as widely used) we also have to work at jobs that generate income since these modules provide zero income. so if you wish to gain more traction on changes, consider sponsoring us. I think people would s*&t their pants if they knew how much revenue is attributed to these modules, but we don't see a dime of it (revenue on the AWS side as well as the consumer/user side) |
@bryantbiggs You have the community here at your disposal willing to help - share that burden with us. I've been trying to get the companies I work at to sponsor this project, but the reality is its difficult to convince leadership especially when we're startups and they respond by saying to just fork the project, which unfortunately is what we end up doing. I can personally donate my time to help out, so what can I do specifically to help move this feature forward? If there's a bigger picture going on here, then how can I help move that forward? What do we need to do? |
|
thank you but it usually just ends up coming down to one of the maintainers doing the work when things get tricky/difficult - case in point
so while volunteering sounds great, we haven't seen much success with that. did you know there 16 folks in the org? more than just the few you see who respond and work on issues/PRs. same thing - folks who said they would do something and they never do. so while I appreciate the offer, the truth is that if anything is going to get done, its most likely going to come from myself or maybe 1 other person |

Description
This changes introduces a variable public_enable_default_route so a default route for public subnets is not created when set to false . This enables the user to create its own default route to other gateways than Internet Gateway (IGW)
Motivation and Context
It fixes the problem of not being able to use ex. Network Firewall and enables the use case where users will need to change default route to something else than the IGW
How Has This Been Tested?
I have tested my changes from a module using the VPC. Setting the public_enable_default_route flag to false -> default route is not created for public subnet route tables
removing the public_enable_default_route flag from the settings passed to the module -> The default route to IGW is created for each public subnet route table
pre-commit run -aon my pull requestcloses: #1187