fixup! securitygroup: allow setting allowed IPv6 CIDR for node NodePort services

Author: tthvo

pkg/cloud/services/securitygroup/securitygroups_test.go

@@ -2332,27 +2332,14 @@ func TestNodePortServicesIngressRules(t *testing.T) {
 
 	testCases := []struct {
 		name                string
-		awsCluster          *infrav1.AWSCluster
+		networkSpecOverride infrav1.NetworkSpec
 		expectedIngresRules infrav1.IngressRules
 	}{
 		{
 			name: "default node ports services ingress rules, no node port cidr block provided",
-			awsCluster: &infrav1.AWSCluster{
-				Spec: infrav1.AWSClusterSpec{
-					ControlPlaneLoadBalancer: &infrav1.AWSLoadBalancerSpec{},
-					NetworkSpec: infrav1.NetworkSpec{
-						VPC: infrav1.VPCSpec{
-							CidrBlock: "10.0.0.0/16",
-						},
-					},
-				},
-				Status: infrav1.AWSClusterStatus{
-					Network: infrav1.NetworkStatus{
-						SecurityGroups: map[infrav1.SecurityGroupRole]infrav1.SecurityGroup{
-							infrav1.SecurityGroupControlPlane: {ID: "Id1"},
-							infrav1.SecurityGroupNode:         {ID: "Id2"},
-						},
-					},
+			networkSpecOverride: infrav1.NetworkSpec{
+				VPC: infrav1.VPCSpec{
+					CidrBlock: "10.0.0.0/16",
 				},
 			},
 			expectedIngresRules: infrav1.IngressRules{
@@ -2374,23 +2361,10 @@ func TestNodePortServicesIngressRules(t *testing.T) {
 		},
 		{
 			name: "default node ports services ingress rules for IPv6, no node port cidr block provided",
-			awsCluster: &infrav1.AWSCluster{
-				Spec: infrav1.AWSClusterSpec{
-					ControlPlaneLoadBalancer: &infrav1.AWSLoadBalancerSpec{},
-					NetworkSpec: infrav1.NetworkSpec{
-						VPC: infrav1.VPCSpec{
-							CidrBlock: "10.0.0.0/16",
-							IPv6:      &infrav1.IPv6{},
-						},
-					},
-				},
-				Status: infrav1.AWSClusterStatus{
-					Network: infrav1.NetworkStatus{
-						SecurityGroups: map[infrav1.SecurityGroupRole]infrav1.SecurityGroup{
-							infrav1.SecurityGroupControlPlane: {ID: "Id1"},
-							infrav1.SecurityGroupNode:         {ID: "Id2"},
-						},
-					},
+			networkSpecOverride: infrav1.NetworkSpec{
+				VPC: infrav1.VPCSpec{
+					CidrBlock: "10.0.0.0/16",
+					IPv6:      &infrav1.IPv6{},
 				},
 			},
 			expectedIngresRules: infrav1.IngressRules{
@@ -2413,24 +2387,11 @@ func TestNodePortServicesIngressRules(t *testing.T) {
 		},
 		{
 			name: "node port cidr block provided, no default cidr block used for node port services ingress rule",
-			awsCluster: &infrav1.AWSCluster{
-				Spec: infrav1.AWSClusterSpec{
-					ControlPlaneLoadBalancer: &infrav1.AWSLoadBalancerSpec{},
-					NetworkSpec: infrav1.NetworkSpec{
-						VPC: infrav1.VPCSpec{
-							CidrBlock: "10.0.0.0/16",
-						},
-						NodePortIngressRuleCidrBlocks: []string{"10.0.0.0/16"},
-					},
-				},
-				Status: infrav1.AWSClusterStatus{
-					Network: infrav1.NetworkStatus{
-						SecurityGroups: map[infrav1.SecurityGroupRole]infrav1.SecurityGroup{
-							infrav1.SecurityGroupControlPlane: {ID: "Id1"},
-							infrav1.SecurityGroupNode:         {ID: "Id2"},
-						},
-					},
+			networkSpecOverride: infrav1.NetworkSpec{
+				VPC: infrav1.VPCSpec{
+					CidrBlock: "10.0.0.0/16",
 				},
+				NodePortIngressRuleCidrBlocks: []string{"10.0.0.0/16"},
 			},
 			expectedIngresRules: infrav1.IngressRules{
 				{
@@ -2451,27 +2412,14 @@ func TestNodePortServicesIngressRules(t *testing.T) {
 		},
 		{
 			name: "node port cidr block provided for only IPv6, no default cidr block used for node port services ingress rule",
-			awsCluster: &infrav1.AWSCluster{
-				Spec: infrav1.AWSClusterSpec{
-					ControlPlaneLoadBalancer: &infrav1.AWSLoadBalancerSpec{},
-					NetworkSpec: infrav1.NetworkSpec{
-						VPC: infrav1.VPCSpec{
-							CidrBlock: "10.0.0.0/16",
-							IPv6: &infrav1.IPv6{
-								CidrBlock: "2001:1234:5678:9a40::/56",
-							},
-						},
-						NodePortIngressRuleCidrBlocks: []string{"2001:1234:5678:9a40::/56"},
-					},
-				},
-				Status: infrav1.AWSClusterStatus{
-					Network: infrav1.NetworkStatus{
-						SecurityGroups: map[infrav1.SecurityGroupRole]infrav1.SecurityGroup{
-							infrav1.SecurityGroupControlPlane: {ID: "Id1"},
-							infrav1.SecurityGroupNode:         {ID: "Id2"},
-						},
+			networkSpecOverride: infrav1.NetworkSpec{
+				VPC: infrav1.VPCSpec{
+					CidrBlock: "10.0.0.0/16",
+					IPv6: &infrav1.IPv6{
+						CidrBlock: "2001:1234:5678:9a40::/56",
 					},
 				},
+				NodePortIngressRuleCidrBlocks: []string{"2001:1234:5678:9a40::/56"},
 			},
 			expectedIngresRules: infrav1.IngressRules{
 				{
@@ -2493,27 +2441,14 @@ func TestNodePortServicesIngressRules(t *testing.T) {
 		},
 		{
 			name: "node port cidr block provided for both IPv4 and IPv6, no default cidr block used for node port services ingress rule",
-			awsCluster: &infrav1.AWSCluster{
-				Spec: infrav1.AWSClusterSpec{
-					ControlPlaneLoadBalancer: &infrav1.AWSLoadBalancerSpec{},
-					NetworkSpec: infrav1.NetworkSpec{
-						VPC: infrav1.VPCSpec{
-							CidrBlock: "10.0.0.0/16",
-							IPv6: &infrav1.IPv6{
-								CidrBlock: "2001:1234:5678:9a40::/56",
-							},
-						},
-						NodePortIngressRuleCidrBlocks: []string{"10.0.0.0/16", "2001:1234:5678:9a40::/56"},
-					},
-				},
-				Status: infrav1.AWSClusterStatus{
-					Network: infrav1.NetworkStatus{
-						SecurityGroups: map[infrav1.SecurityGroupRole]infrav1.SecurityGroup{
-							infrav1.SecurityGroupControlPlane: {ID: "Id1"},
-							infrav1.SecurityGroupNode:         {ID: "Id2"},
-						},
+			networkSpecOverride: infrav1.NetworkSpec{
+				VPC: infrav1.VPCSpec{
+					CidrBlock: "10.0.0.0/16",
+					IPv6: &infrav1.IPv6{
+						CidrBlock: "2001:1234:5678:9a40::/56",
 					},
 				},
+				NodePortIngressRuleCidrBlocks: []string{"10.0.0.0/16", "2001:1234:5678:9a40::/56"},
 			},
 			expectedIngresRules: infrav1.IngressRules{
 				{
@@ -2542,7 +2477,20 @@ func TestNodePortServicesIngressRules(t *testing.T) {
 				Cluster: &clusterv1.Cluster{
 					ObjectMeta: metav1.ObjectMeta{Name: "test-cluster"},
 				},
-				AWSCluster: tc.awsCluster,
+				AWSCluster: &infrav1.AWSCluster{
+					Spec: infrav1.AWSClusterSpec{
+						ControlPlaneLoadBalancer: &infrav1.AWSLoadBalancerSpec{},
+						NetworkSpec:              tc.networkSpecOverride,
+					},
+					Status: infrav1.AWSClusterStatus{
+						Network: infrav1.NetworkStatus{
+							SecurityGroups: map[infrav1.SecurityGroupRole]infrav1.SecurityGroup{
+								infrav1.SecurityGroupControlPlane: {ID: "Id1"},
+								infrav1.SecurityGroupNode:         {ID: "Id2"},
+							},
+						},
+					},
+				},
 			})
 			if err != nil {
 				t.Fatalf("Failed to create test context: %v", err)