feat(aws): add --vpc-id flag to deploy into existing VPCs

When --vpc-id is set, mapt reuses an existing VPC instead of creating
a new one. The flag is available on all standard AWS hosts (rhel,
windows, fedora, rhel-ai) and exposed as a param in all Tekton tasks.

Key behaviours:
- Spot AZ search is restricted to AZs that have subnets in the given VPC
- On-demand AZ selection is restricted to the VPC's subnet AZs
- Airgap is rejected when --vpc-id is set (mutually exclusive)
- existingVPCNetwork() resolves a public subnet in the chosen AZ and
  reads the VPC/subnet as pulumi read-only resources (ec2.GetVpc /
  ec2.GetSubnet), so no new networking infrastructure is created

Also fix spot AZ resolution: GetSpotPlacementScores can return AZ IDs
for zones not visible to the account via the default DescribeAvailabilityZones
call. describeAvailabilityZonesByRegions now uses AllAvailabilityZones: true
so all AZ IDs can be resolved to names during spot search, preventing
spurious "skipping AZ: az id not found" drops that led to no spot
option being found in accounts with SCP-restricted regions.

Closes #849

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: adrianriobo

cmd/mapt/cmd/aws/hosts/fedora.go

@@ -68,7 +68,8 @@ func getFedoraCreate() *cobra.Command {
 					Spot:             params.SpotArgs(),
 					Timeout:          viper.GetString(params.Timeout),
 					Airgap:           viper.IsSet(airgap),
-					ServiceEndpoints: params.NetworkServiceEndpoints()})
+					ServiceEndpoints: params.NetworkServiceEndpoints(),
+					VpcID:            params.NetworkVpcID()})
 		},
 	}
 	flagSet := pflag.NewFlagSet(params.CreateCmdName, pflag.ExitOnError)

cmd/mapt/cmd/aws/hosts/rhel.go

@@ -68,6 +68,7 @@ func getRHELCreate() *cobra.Command {
 					Timeout:          viper.GetString(params.Timeout),
 					Airgap:           viper.IsSet(airgap),
 					ServiceEndpoints: params.NetworkServiceEndpoints(),
+					VpcID:            params.NetworkVpcID(),
 				})
 		},
 	}

cmd/mapt/cmd/aws/hosts/rhelai.go

@@ -74,6 +74,7 @@ func getRHELAICreate() *cobra.Command {
 					AutoStart:        viper.IsSet(params.RhelAIAutoStart),
 					VLLMExtraArgs:    viper.GetString(params.RhelAIVLLMExtraArgs),
 					ExposePorts:      viper.GetIntSlice(params.RhelAIExposePorts),
+					VpcID:            params.NetworkVpcID(),
 				})
 		},
 	}

cmd/mapt/cmd/aws/hosts/windows.go

@@ -81,6 +81,7 @@ func getWindowsCreate() *cobra.Command {
 					Airgap:           viper.IsSet(airgap),
 					Timeout:          viper.GetString(params.Timeout),
 					ServiceEndpoints: params.NetworkServiceEndpoints(),
+					VpcID:            params.NetworkVpcID(),
 				})
 		},
 	}

cmd/mapt/cmd/params/params.go

@@ -205,7 +205,9 @@ const (
 	KindExtraPortMappingsDesc = "Additional port mappings for the Kind cluster. Value should be a JSON array of objects with containerPort, hostPort, and protocol properties. Example: '[{\"containerPort\": 8080, \"hostPort\": 8080, \"protocol\": \"TCP\"}]'"
 
 	// Network
-	ServiceEndpoints = "service-endpoints"
+	ServiceEndpoints    = "service-endpoints"
+	VpcID               = "vpc-id"
+	VpcIDDesc           = "ID of an existing VPC to deploy the instance into. When set, airgap is not supported and spot search is restricted to AZs with subnets in that VPC."
 
 	// Spot
 	spot                         = "spot"
@@ -222,12 +224,21 @@ const (
 
 func AddNetworkFlags(fs *pflag.FlagSet, desc string) {
 	fs.StringSliceP(ServiceEndpoints, "", []string{}, desc)
+	fs.StringP(VpcID, "", "", VpcIDDesc)
 }
 
 func NetworkServiceEndpoints() []string {
 	return viper.GetStringSlice(ServiceEndpoints)
 }
 
+func NetworkVpcID() *string {
+	if viper.IsSet(VpcID) {
+		v := viper.GetString(VpcID)
+		return &v
+	}
+	return nil
+}
+
 func AddSpotFlags(fs *pflag.FlagSet) {
 	fs.Bool(spot, false, spotDesc)
 	fs.StringP(spotTolerance, "", spotToleranceDefault, spotToleranceDesc)

pkg/provider/aws/action/fedora/fedora.go

@@ -33,28 +33,30 @@ import (
 )
 
 type FedoraArgs struct {
-	Prefix         string
-	Version        string
-	Arch           string
-	ComputeRequest *cr.ComputeRequestArgs
-	Spot           *spotTypes.SpotArgs
-	Airgap         bool
+	Prefix           string
+	Version          string
+	Arch             string
+	ComputeRequest   *cr.ComputeRequestArgs
+	Spot             *spotTypes.SpotArgs
+	Airgap           bool
 	ServiceEndpoints []string
+	VpcID            *string
 	// If timeout is set a severless scheduled task will be created to self destroy the resources
 	Timeout string
 }
 
 type fedoraRequest struct {
-	mCtx           *mc.Context
-	prefix         *string
-	version        *string
-	arch           *string
-	spot           bool
-	timeout        *string
+	mCtx             *mc.Context
+	prefix           *string
+	version          *string
+	arch             *string
+	spot             bool
+	timeout          *string
 	serviceEndpoints []string
-	allocationData *allocation.AllocationResult
-	airgap         *bool
-	diskSize       *int
+	vpcID            *string
+	allocationData   *allocation.AllocationResult
+	airgap           *bool
+	diskSize         *int
 	// internal management
 	// For airgap scenario there is an orchestation of
 	// a phase with connectivity on the machine (allowing bootstraping)
@@ -81,6 +83,9 @@ func Create(mCtxArgs *mc.ContextArgs, args *FedoraArgs) (err error) {
 		return err
 	}
 	// Compose request
+	if args.VpcID != nil && args.Airgap {
+		return fmt.Errorf("--vpc-id and --airgap are mutually exclusive")
+	}
 	prefix := util.If(len(args.Prefix) > 0, args.Prefix, "main")
 	r := fedoraRequest{
 		mCtx:             mCtx,
@@ -89,6 +94,7 @@ func Create(mCtxArgs *mc.ContextArgs, args *FedoraArgs) (err error) {
 		arch:             &args.Arch,
 		timeout:          &args.Timeout,
 		serviceEndpoints: args.ServiceEndpoints,
+		vpcID:            args.VpcID,
 		airgap:           &args.Airgap,
 		diskSize:         args.ComputeRequest.DiskSize}
 	if args.Spot != nil {
@@ -100,6 +106,7 @@ func Create(mCtxArgs *mc.ContextArgs, args *FedoraArgs) (err error) {
 			ComputeRequest:        args.ComputeRequest,
 			AMIProductDescription: &amiProduct,
 			Spot:                  args.Spot,
+			VpcID:                 args.VpcID,
 		})
 	if err != nil {
 		return err
@@ -201,7 +208,8 @@ func (r *fedoraRequest) deploy(ctx *pulumi.Context) error {
 		CreateLoadBalancer:      r.spot,
 		Airgap:                  *r.airgap,
 		AirgapPhaseConnectivity: r.airgapPhaseConnectivity,
-		ServiceEndpoints:               r.serviceEndpoints,
+		ServiceEndpoints:        r.serviceEndpoints,
+		VpcID:                   r.vpcID,
 	})
 	if err != nil {
 		return err

pkg/provider/aws/action/rhel-ai/rhelai.go

@@ -40,6 +40,7 @@ type rhelAIRequest struct {
 	spot             bool
 	timeout          *string
 	serviceEndpoints []string
+	vpcID            *string
 	allocationData   *allocation.AllocationResult
 	diskSize         *int
 	model            *string
@@ -81,6 +82,7 @@ func Create(mCtxArgs *mc.ContextArgs, args *apiRHELAI.RHELAIArgs) (err error) {
 		arch:             &args.Arch,
 		timeout:          &args.Timeout,
 		serviceEndpoints: args.ServiceEndpoints,
+		vpcID:            args.VpcID,
 		diskSize:         args.ComputeRequest.DiskSize,
 		model:            &args.Model,
 		hfToken:          &args.HFToken,
@@ -97,6 +99,7 @@ func Create(mCtxArgs *mc.ContextArgs, args *apiRHELAI.RHELAIArgs) (err error) {
 			ComputeRequest:        args.ComputeRequest,
 			AMIProductDescription: &amiProduct,
 			Spot:                  args.Spot,
+			VpcID:                 args.VpcID,
 		})
 	if err != nil {
 		return err
@@ -228,6 +231,7 @@ func (r *rhelAIRequest) deploy(ctx *pulumi.Context) error {
 			AZ:                 *r.allocationData.AZ,
 			CreateLoadBalancer: r.allocationData.SpotPrice != nil,
 			ServiceEndpoints:   r.serviceEndpoints,
+			VpcID:              r.vpcID,
 		})
 	if err != nil {
 		return err

pkg/provider/aws/action/rhel/rhel.go

@@ -42,6 +42,7 @@ type RHELArgs struct {
 	Spot           *spotTypes.SpotArgs
 	Airgap         bool
 	ServiceEndpoints []string
+	VpcID *string
 	// If timeout is set a severless scheduled task will be created to self destroy the resources
 	Timeout string
 }
@@ -57,6 +58,7 @@ type rhelRequest struct {
 	profileSNC     *bool
 	timeout        *string
 	serviceEndpoints []string
+	vpcID          *string
 	allocationData *allocation.AllocationResult
 	airgap         *bool
 	diskSize       *int
@@ -86,6 +88,9 @@ func Create(mCtxArgs *mc.ContextArgs, args *RHELArgs) (err error) {
 		return err
 	}
 	// Compose request
+	if args.VpcID != nil && args.Airgap {
+		return fmt.Errorf("--vpc-id and --airgap are mutually exclusive")
+	}
 	prefix := util.If(len(args.Prefix) > 0, args.Prefix, "main")
 	r := rhelRequest{
 		mCtx:             mCtx,
@@ -97,6 +102,7 @@ func Create(mCtxArgs *mc.ContextArgs, args *RHELArgs) (err error) {
 		subsUserpass:     &args.SubsUserpass,
 		profileSNC:       &args.ProfileSNC,
 		serviceEndpoints: args.ServiceEndpoints,
+		vpcID:            args.VpcID,
 		airgap:           &args.Airgap,
 		diskSize:         args.ComputeRequest.DiskSize}
 	if args.Spot != nil {
@@ -108,6 +114,7 @@ func Create(mCtxArgs *mc.ContextArgs, args *RHELArgs) (err error) {
 			ComputeRequest:        args.ComputeRequest,
 			AMIProductDescription: &amiProduct,
 			Spot:                  args.Spot,
+			VpcID:                 args.VpcID,
 		})
 	if err != nil {
 		return err
@@ -206,7 +213,8 @@ func (r *rhelRequest) deploy(ctx *pulumi.Context) error {
 			CreateLoadBalancer:      r.allocationData.SpotPrice != nil,
 			Airgap:                  *r.airgap,
 			AirgapPhaseConnectivity: r.airgapPhaseConnectivity,
-			ServiceEndpoints:               r.serviceEndpoints,
+			ServiceEndpoints:        r.serviceEndpoints,
+			VpcID:                   r.vpcID,
 		})
 	if err != nil {
 		return err

pkg/provider/aws/action/windows/windows.go

@@ -46,10 +46,11 @@ type WindowsServerArgs struct {
 	AMILang     string
 	AMIKeepCopy bool
 	// Machine params
-	ComputeRequest *cr.ComputeRequestArgs
-	Spot           *spotTypes.SpotArgs
-	Airgap         bool
+	ComputeRequest   *cr.ComputeRequestArgs
+	Spot             *spotTypes.SpotArgs
+	Airgap           bool
 	ServiceEndpoints []string
+	VpcID            *string
 	// If timeout is set a severless scheduled task will be created to self destroy the resources
 	Timeout string
 }
@@ -64,12 +65,13 @@ type windowsServerRequest struct {
 	amiLang     *string
 	amiKeepCopy *bool
 
-	spot           bool
-	timeout        *string
+	spot             bool
+	timeout          *string
 	serviceEndpoints []string
-	allocationData *allocation.AllocationResult
-	airgap         *bool
-	diskSize       *int
+	vpcID            *string
+	allocationData   *allocation.AllocationResult
+	airgap           *bool
+	diskSize         *int
 	// internal management
 	// For airgap scenario there is an orchestation of
 	// a phase with connectivity on the machine (allowing bootstraping)
@@ -104,6 +106,9 @@ func Create(mCtxArgs *mc.ContextArgs, args *WindowsServerArgs) (err error) {
 		args.AMIName = amiNonEngNameDefault
 	}
 	// Compose request
+	if args.VpcID != nil && args.Airgap {
+		return fmt.Errorf("--vpc-id and --airgap are mutually exclusive")
+	}
 	prefix := util.If(len(args.Prefix) > 0, args.Prefix, "main")
 	r := windowsServerRequest{
 		mCtx:             mCtx,
@@ -115,6 +120,7 @@ func Create(mCtxArgs *mc.ContextArgs, args *WindowsServerArgs) (err error) {
 		amiLang:          &args.AMILang,
 		timeout:          &args.Timeout,
 		serviceEndpoints: args.ServiceEndpoints,
+		vpcID:            args.VpcID,
 		airgap:           &args.Airgap,
 	}
 	if args.ComputeRequest != nil {
@@ -129,6 +135,7 @@ func Create(mCtxArgs *mc.ContextArgs, args *WindowsServerArgs) (err error) {
 			ComputeRequest:        args.ComputeRequest,
 			AMIProductDescription: &amiProduct,
 			Spot:                  args.Spot,
+			VpcID:                 args.VpcID,
 		})
 	if err != nil {
 		return err
@@ -259,7 +266,8 @@ func (r *windowsServerRequest) deploy(ctx *pulumi.Context) error {
 			CreateLoadBalancer:      r.spot,
 			Airgap:                  *r.airgap,
 			AirgapPhaseConnectivity: r.airgapPhaseConnectivity,
-			ServiceEndpoints:               r.serviceEndpoints,
+			ServiceEndpoints:        r.serviceEndpoints,
+			VpcID:                   r.vpcID,
 		})
 	if err != nil {
 		return err

pkg/provider/aws/data/azs.go

@@ -42,19 +42,28 @@ type AvailabilityZonesResult struct {
 	Err               error
 }
 
-func describeAvailabilityZonesAsync(ctx context.Context, regionName string, c chan AvailabilityZonesResult) {
-	data, err := DescribeAvailabilityZones(ctx, regionName)
-	c <- AvailabilityZonesResult{
-		AvailabilityZones: data,
-		Err:               err}
-
+func describeAvailabilityZonesAllAsync(ctx context.Context, regionName string, c chan AvailabilityZonesResult) {
+	data, err := describeAvailabilityZonesAll(ctx, regionName)
+	c <- AvailabilityZonesResult{AvailabilityZones: data, Err: err}
 }
 
 func DescribeAvailabilityZones(ctx context.Context, regionName string) ([]ec2Types.AvailabilityZone, error) {
 	return describeAvailabilityZones(ctx, regionName, nil)
 }
 
 func describeAvailabilityZones(ctx context.Context, regionName string, excludedZoneIDs []string) ([]ec2Types.AvailabilityZone, error) {
+	return describeAvailabilityZonesOpts(ctx, regionName, excludedZoneIDs, false)
+}
+
+// describeAvailabilityZonesAll is like describeAvailabilityZones but includes AZs not
+// normally visible to the account (AllAvailabilityZones: true). Used only for AZ ID→name
+// resolution during spot placement score lookups, where the scores API can return AZ IDs
+// for zones not yet opted-in to by the account.
+func describeAvailabilityZonesAll(ctx context.Context, regionName string) ([]ec2Types.AvailabilityZone, error) {
+	return describeAvailabilityZonesOpts(ctx, regionName, nil, true)
+}
+
+func describeAvailabilityZonesOpts(ctx context.Context, regionName string, excludedZoneIDs []string, allZones bool) ([]ec2Types.AvailabilityZone, error) {
 	var cfgOpts config.LoadOptionsFunc
 	if len(regionName) > 0 {
 		cfgOpts = config.WithRegion(regionName)
@@ -64,9 +73,8 @@ func describeAvailabilityZones(ctx context.Context, regionName string, excludedZ
 		return nil, err
 	}
 	client := ec2.NewFromConfig(cfg)
-	// TODO check what happen when true and region name
 	input := ec2.DescribeAvailabilityZonesInput{
-		// AllAvailabilityZones: aws.Bool(true),
+		AllAvailabilityZones: aws.Bool(allZones),
 	}
 	input.Filters = []ec2Types.Filter{
 		{
@@ -112,12 +120,14 @@ func getZoneName(azID string, azDescriptions []ec2Types.AvailabilityZone) (strin
 // user 1 Name: us-west-1a ID: us-west-11, Name: us-west-1b ID: us-west-12
 // user 2 Name: us-west-1a ID: us-west-12, Name: us-west-1b ID: us-west-11
 // This allowsa a better distribution among users
+// describeAvailabilityZonesByRegions fetches all AZs (including non-opted-in ones) so
+// that AZ IDs returned by GetSpotPlacementScores can always be resolved to names.
 func describeAvailabilityZonesByRegions(ctx context.Context, regions []string) map[string][]ec2Types.AvailabilityZone {
 	result := make(map[string][]ec2Types.AvailabilityZone)
 	c := make(chan AvailabilityZonesResult)
 	for _, region := range regions {
 		lRegion := region
-		go describeAvailabilityZonesAsync(ctx, lRegion, c)
+		go describeAvailabilityZonesAllAsync(ctx, lRegion, c)
 	}
 	for i := 0; i < len(regions); i++ {
 		availabilityZonesResult := <-c