VPC validation issue

[timuthy]

How to categorize this issue?

/area quality
/kind bug regression
/platform aws

What happened:
The lately introduced VPC network subset check in #1662 causes validation errors for valid shoot configurations.
A VPC can have multiple CIDR blocks (ref), but the validation only considers the primary block (see here).

task "Waiting until shoot infrastructure has been reconciled" failed:
        Error while waiting for Infrastructure shoot--test--test/test to
        become ready: error during reconciliation: Error checking infrastructure
        config: [networking.nodes: Invalid value: "10.250.0.0/20": must be a
        subset of "networks.vpc.id" ("10.240.0.0/16"), networking.public:
        Invalid value: "10.250.96.0/21": must be a subset of "networks.vpc.id"
        ("10.238.140.128/27"), networking.internal: Invalid value:
        "10.250.64.0/21": must be a subset of "networks.vpc.id"
        ("10.238.140.128/27"), networking.nodes: Invalid value:
        "10.250.16.0/20": must be a subset of "networks.vpc.id"
        ("10.238.140.128/27"), networking.public: Invalid value:
        "10.250.104.0/21": must be a subset of "networks.vpc.id"
        ("10.238.140.128/27"), networking.internal: Invalid value:
        "10.250.72.0/21": must be a subset of "networks.vpc.id"
        ("10.238.140.128/27")]

What you expected to happen:
The infrastructure reconciliation to succeed.

How to reproduce it (as minimally and precisely as possible):

1. Create a VPC with at least two CIDR blocks attached.
2. Create a Shoot cluster and choose subnets from a non-primary CIDR block of the VPC.

Anything else we need to know?:

Environment:

• Gardener version (if relevant):
• Extension version: v1.68.0
• Kubernetes version (use kubectl version):
• Cloud provider or hardware configuration:
• Others:

[AndreasBurger]

With #1747 validation is re-enabled but checks all associated IPv4 blocks of the BYO VPC, validating as successful if there is at least one that satisfies the requirements.

Will take effect with the release of v1.69

[hebelsan]

@AndreasBurger since the fix is released, can we close this issue?

[gardener-ci-robot]

The Gardener project currently lacks enough active contributors to adequately respond to all issues.
This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 60d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 60d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as active with /lifecycle active
• Mark this issue as frozen with /lifecycle frozen
• Mark this issue as fresh with /remove-lifecycle stale
• Mark this issue as rotten with /lifecycle rotten
• Close this issue with /close

/lifecycle stale