Skip to content

Commit 160c6b1

Browse files
tthvotthvo
committed
fixup! api: add spec field to configure target group ipType
1 parent 1c0dc3d commit 160c6b1

File tree

1 file changed

+65
-70
lines changed

1 file changed

+65
-70
lines changed

‎api/v1beta2/awscluster_webhook.go‎

Lines changed: 65 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -395,15 +395,71 @@ func (r *AWSCluster) validateControlPlaneLBs() (admission.Warnings, field.ErrorL
395395
var allErrs field.ErrorList
396396
var allWarnings admission.Warnings
397397

398-
if r.Spec.ControlPlaneLoadBalancer != nil && r.Spec.ControlPlaneLoadBalancer.LoadBalancerType == LoadBalancerTypeClassic {
399-
allWarnings = append(allWarnings, fmt.Sprintf(warningClassicELB, "primary control plane"))
398+
if r.Spec.ControlPlaneLoadBalancer != nil {
399+
if r.Spec.ControlPlaneLoadBalancer.LoadBalancerType == LoadBalancerTypeClassic {
400+
allWarnings = append(allWarnings, fmt.Sprintf(warningClassicELB, "primary control plane"))
401+
402+
if r.Spec.ControlPlaneLoadBalancer.HealthCheckProtocol == nil {
403+
allWarnings = append(allWarnings, warningHealthCheckProtocolNotSet)
404+
}
400405

401-
if r.Spec.ControlPlaneLoadBalancer.HealthCheckProtocol == nil {
402-
allWarnings = append(allWarnings, warningHealthCheckProtocolNotSet)
406+
if r.Spec.ControlPlaneLoadBalancer.HealthCheckProtocol != nil && *r.Spec.ControlPlaneLoadBalancer.HealthCheckProtocol == ELBProtocolSSL {
407+
allWarnings = append(allWarnings, "loadbalancer is using a classic elb with SSL health check, this causes issues with ciper suites with kubernetes v1.30+")
408+
}
403409
}
404410

405-
if r.Spec.ControlPlaneLoadBalancer.HealthCheckProtocol != nil && *r.Spec.ControlPlaneLoadBalancer.HealthCheckProtocol == ELBProtocolSSL {
406-
allWarnings = append(allWarnings, "loadbalancer is using a classic elb with SSL health check, this causes issues with ciper suites with kubernetes v1.30+")
411+
// Validate the control plane load balancers settings (e.g. SG ingress rules, target groups)
412+
basePath := field.NewPath("spec", "controlPlaneLoadBalancer")
413+
if r.Spec.ControlPlaneLoadBalancer.TargetGroupIPType != nil {
414+
allErrs = append(allErrs, r.validateTargetGroupIPType(basePath.Child("targetGroupIPType"), r.Spec.ControlPlaneLoadBalancer.TargetGroupIPType, r.Spec.ControlPlaneLoadBalancer)...)
415+
}
416+
for i, listener := range r.Spec.ControlPlaneLoadBalancer.AdditionalListeners {
417+
if listener.TargetGroupIPType != nil {
418+
allErrs = append(allErrs, r.validateTargetGroupIPType(basePath.Child("additionalListeners").Index(i).Child("targetGroupIPType"), listener.TargetGroupIPType, r.Spec.ControlPlaneLoadBalancer)...)
419+
}
420+
}
421+
allErrs = append(allErrs, r.validateIngressRules(basePath.Child("ingressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules)...)
422+
423+
if r.Spec.ControlPlaneLoadBalancer.LoadBalancerType == LoadBalancerTypeDisabled {
424+
if r.Spec.ControlPlaneLoadBalancer.Name != nil {
425+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "name"), r.Spec.ControlPlaneLoadBalancer.Name, "cannot configure a name if the LoadBalancer reconciliation is disabled"))
426+
}
427+
428+
if r.Spec.ControlPlaneLoadBalancer.CrossZoneLoadBalancing {
429+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "crossZoneLoadBalancing"), r.Spec.ControlPlaneLoadBalancer.CrossZoneLoadBalancing, "cross-zone load balancing cannot be set if the LoadBalancer reconciliation is disabled"))
430+
}
431+
432+
if len(r.Spec.ControlPlaneLoadBalancer.Subnets) > 0 {
433+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "subnets"), r.Spec.ControlPlaneLoadBalancer.Subnets, "subnets cannot be set if the LoadBalancer reconciliation is disabled"))
434+
}
435+
436+
if r.Spec.ControlPlaneLoadBalancer.HealthCheckProtocol != nil {
437+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "healthCheckProtocol"), r.Spec.ControlPlaneLoadBalancer.HealthCheckProtocol, "healthcheck protocol cannot be set if the LoadBalancer reconciliation is disabled"))
438+
}
439+
440+
if len(r.Spec.ControlPlaneLoadBalancer.AdditionalSecurityGroups) > 0 {
441+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "additionalSecurityGroups"), r.Spec.ControlPlaneLoadBalancer.AdditionalSecurityGroups, "additional Security Groups cannot be set if the LoadBalancer reconciliation is disabled"))
442+
}
443+
444+
if len(r.Spec.ControlPlaneLoadBalancer.AdditionalListeners) > 0 {
445+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "additionalListeners"), r.Spec.ControlPlaneLoadBalancer.AdditionalListeners, "cannot set additional listeners if the LoadBalancer reconciliation is disabled"))
446+
}
447+
448+
if len(r.Spec.ControlPlaneLoadBalancer.IngressRules) > 0 {
449+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "ingressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules, "ingress rules cannot be set if the LoadBalancer reconciliation is disabled"))
450+
}
451+
452+
if r.Spec.ControlPlaneLoadBalancer.PreserveClientIP {
453+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "preserveClientIP"), r.Spec.ControlPlaneLoadBalancer.PreserveClientIP, "cannot preserve client IP if the LoadBalancer reconciliation is disabled"))
454+
}
455+
456+
if r.Spec.ControlPlaneLoadBalancer.DisableHostsRewrite {
457+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "disableHostsRewrite"), r.Spec.ControlPlaneLoadBalancer.DisableHostsRewrite, "cannot disable hosts rewrite if the LoadBalancer reconciliation is disabled"))
458+
}
459+
460+
if r.Spec.ControlPlaneLoadBalancer.TargetGroupIPType != nil {
461+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "targetGroupIPType"), r.Spec.ControlPlaneLoadBalancer.TargetGroupIPType, "cannot set target group IP type if the LoadBalancer reconciliation is disabled"))
462+
}
407463
}
408464
}
409465

@@ -428,80 +484,19 @@ func (r *AWSCluster) validateControlPlaneLBs() (admission.Warnings, field.ErrorL
428484
if r.Spec.SecondaryControlPlaneLoadBalancer.LoadBalancerType == LoadBalancerTypeClassic {
429485
allWarnings = append(allWarnings, fmt.Sprintf(warningClassicELB, "secondary control plane"))
430486
}
431-
}
432-
433-
// Additional listeners are only supported for NLBs.
434-
// Validate the control plane load balancers.
435-
if r.Spec.ControlPlaneLoadBalancer != nil {
436-
allErrs = append(allErrs, r.validateIngressRules(field.NewPath("spec", "controlPlaneLoadBalancer", "ingressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules)...)
437-
}
438-
if r.Spec.SecondaryControlPlaneLoadBalancer != nil {
439-
allErrs = append(allErrs, r.validateIngressRules(field.NewPath("spec", "secondaryControlPlaneLoadBalancer", "ingressRules"), r.Spec.SecondaryControlPlaneLoadBalancer.IngressRules)...)
440-
}
441-
442-
if r.Spec.ControlPlaneLoadBalancer.LoadBalancerType == LoadBalancerTypeDisabled {
443-
if r.Spec.ControlPlaneLoadBalancer.Name != nil {
444-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "name"), r.Spec.ControlPlaneLoadBalancer.Name, "cannot configure a name if the LoadBalancer reconciliation is disabled"))
445-
}
446-
447-
if r.Spec.ControlPlaneLoadBalancer.CrossZoneLoadBalancing {
448-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "crossZoneLoadBalancing"), r.Spec.ControlPlaneLoadBalancer.CrossZoneLoadBalancing, "cross-zone load balancing cannot be set if the LoadBalancer reconciliation is disabled"))
449-
}
450-
451-
if len(r.Spec.ControlPlaneLoadBalancer.Subnets) > 0 {
452-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "subnets"), r.Spec.ControlPlaneLoadBalancer.Subnets, "subnets cannot be set if the LoadBalancer reconciliation is disabled"))
453-
}
454-
455-
if r.Spec.ControlPlaneLoadBalancer.HealthCheckProtocol != nil {
456-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "healthCheckProtocol"), r.Spec.ControlPlaneLoadBalancer.HealthCheckProtocol, "healthcheck protocol cannot be set if the LoadBalancer reconciliation is disabled"))
457-
}
458-
459-
if len(r.Spec.ControlPlaneLoadBalancer.AdditionalSecurityGroups) > 0 {
460-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "additionalSecurityGroups"), r.Spec.ControlPlaneLoadBalancer.AdditionalSecurityGroups, "additional Security Groups cannot be set if the LoadBalancer reconciliation is disabled"))
461-
}
462-
463-
if len(r.Spec.ControlPlaneLoadBalancer.AdditionalListeners) > 0 {
464-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "additionalListeners"), r.Spec.ControlPlaneLoadBalancer.AdditionalListeners, "cannot set additional listeners if the LoadBalancer reconciliation is disabled"))
465-
}
466-
467-
if len(r.Spec.ControlPlaneLoadBalancer.IngressRules) > 0 {
468-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "ingressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules, "ingress rules cannot be set if the LoadBalancer reconciliation is disabled"))
469-
}
470-
471-
if r.Spec.ControlPlaneLoadBalancer.PreserveClientIP {
472-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "preserveClientIP"), r.Spec.ControlPlaneLoadBalancer.PreserveClientIP, "cannot preserve client IP if the LoadBalancer reconciliation is disabled"))
473-
}
474-
475-
if r.Spec.ControlPlaneLoadBalancer.DisableHostsRewrite {
476-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "disableHostsRewrite"), r.Spec.ControlPlaneLoadBalancer.DisableHostsRewrite, "cannot disable hosts rewrite if the LoadBalancer reconciliation is disabled"))
477-
}
478-
479-
if r.Spec.ControlPlaneLoadBalancer.TargetGroupIPType != nil {
480-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "targetGroupIPType"), r.Spec.ControlPlaneLoadBalancer.TargetGroupIPType, "cannot set target group IP type if the LoadBalancer reconciliation is disabled"))
481-
}
482-
}
483487

484-
if r.Spec.ControlPlaneLoadBalancer != nil {
485-
basePath := field.NewPath("spec", "controlPlaneLoadBalancer")
486-
if r.Spec.ControlPlaneLoadBalancer.TargetGroupIPType != nil {
487-
allErrs = append(allErrs, r.validateTargetGroupIPType(basePath.Child("targetGroupIPType"), r.Spec.ControlPlaneLoadBalancer.TargetGroupIPType, r.Spec.ControlPlaneLoadBalancer)...)
488-
}
489-
for i, listener := range r.Spec.ControlPlaneLoadBalancer.AdditionalListeners {
490-
if listener.TargetGroupIPType != nil {
491-
allErrs = append(allErrs, r.validateTargetGroupIPType(basePath.Child("additionalListeners").Index(i).Child("targetGroupIPType"), listener.TargetGroupIPType, r.Spec.ControlPlaneLoadBalancer)...)
492-
}
493-
}
494-
}
495-
if r.Spec.SecondaryControlPlaneLoadBalancer != nil {
488+
// Validate the control plane load balancers settings (e.g. SG ingress rules, target groups)
496489
basePath := field.NewPath("spec", "secondaryControlPlaneLoadBalancer")
497490
if r.Spec.SecondaryControlPlaneLoadBalancer.TargetGroupIPType != nil {
498491
allErrs = append(allErrs, r.validateTargetGroupIPType(basePath.Child("targetGroupIPType"), r.Spec.SecondaryControlPlaneLoadBalancer.TargetGroupIPType, r.Spec.SecondaryControlPlaneLoadBalancer)...)
499492
}
493+
// Additional listeners are only supported for NLBs.
500494
for i, listener := range r.Spec.SecondaryControlPlaneLoadBalancer.AdditionalListeners {
501495
if listener.TargetGroupIPType != nil {
502496
allErrs = append(allErrs, r.validateTargetGroupIPType(basePath.Child("additionalListeners").Index(i).Child("targetGroupIPType"), listener.TargetGroupIPType, r.Spec.SecondaryControlPlaneLoadBalancer)...)
503497
}
504498
}
499+
allErrs = append(allErrs, r.validateIngressRules(basePath.Child("ingressRules"), r.Spec.SecondaryControlPlaneLoadBalancer.IngressRules)...)
505500
}
506501

507502
return allWarnings, allErrs

0 commit comments

Comments
 (0)