Skip to content

Commit 6151dd5

Browse files
tthvotthvo
committed
securitygroup: allow setting allowed IPv6 CIDR for node NodePort services
For IPv4, we have field NodePortIngressRuleCidrBlocks that specifies the allowed source IPv4 CIDR for node NodePort services on port 30000-32767. This extends that field to also accept IPv6 source CIDRs.
1 parent c46eeb7 commit 6151dd5

File tree

7 files changed

+168
-33
lines changed

7 files changed

+168
-33
lines changed

‎api/v1beta2/network_types.go

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323

2424
"github.com/aws/aws-sdk-go-v2/service/ec2/types"
2525
"github.com/aws/aws-sdk-go/aws"
26+
"k8s.io/utils/net"
2627
"k8s.io/utils/ptr"
2728
)
2829

@@ -367,7 +368,32 @@ type NetworkSpec struct {
367368
// NodePortIngressRuleCidrBlocks is an optional set of CIDR blocks to allow traffic to nodes' NodePort services.
368369
// If none are specified here, all IPs are allowed to connect.
369370
// +optional
370-
NodePortIngressRuleCidrBlocks []string `json:"nodePortIngressRuleCidrBlocks,omitempty"`
371+
NodePortIngressRuleCidrBlocks CidrBlocks `json:"nodePortIngressRuleCidrBlocks,omitempty"`
372+
}
373+
374+
// CidrBlocks defines a set of CIDR blocks.
375+
type CidrBlocks []string
376+
377+
// IPv4CidrBlocks returns only IPv4 CIDR blocks.
378+
func (c CidrBlocks) IPv4CidrBlocks() CidrBlocks {
379+
var cidrs CidrBlocks
380+
for _, cidr := range c {
381+
if net.IsIPv4CIDRString(cidr) {
382+
cidrs = append(cidrs, cidr)
383+
}
384+
}
385+
return cidrs
386+
}
387+
388+
// IPv6CidrBlocks returns only IPv6 CIDR blocks.
389+
func (c CidrBlocks) IPv6CidrBlocks() CidrBlocks {
390+
var cidrs CidrBlocks
391+
for _, cidr := range c {
392+
if net.IsIPv6CIDRString(cidr) {
393+
cidrs = append(cidrs, cidr)
394+
}
395+
}
396+
return cidrs
371397
}
372398

373399
// IPv6 contains ipv6 specific settings for the network.

‎api/v1beta2/zz_generated.deepcopy.go

Lines changed: 20 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/cloud/scope/cluster.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -450,6 +450,6 @@ func (s *ClusterScope) UnstructuredControlPlane() (*unstructured.Unstructured, e
450450
}
451451

452452
// NodePortIngressRuleCidrBlocks returns the CIDR blocks for the node NodePort ingress rules.
453-
func (s *ClusterScope) NodePortIngressRuleCidrBlocks() []string {
453+
func (s *ClusterScope) NodePortIngressRuleCidrBlocks() infrav1.CidrBlocks {
454454
return s.AWSCluster.Spec.NetworkSpec.DeepCopy().NodePortIngressRuleCidrBlocks
455455
}

‎pkg/cloud/scope/managedcontrolplane.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -510,7 +510,7 @@ func (s *ManagedControlPlaneScope) UnstructuredControlPlane() (*unstructured.Uns
510510
}
511511

512512
// NodePortIngressRuleCidrBlocks returns the CIDR blocks for the node NodePort ingress rules.
513-
func (s *ManagedControlPlaneScope) NodePortIngressRuleCidrBlocks() []string {
513+
func (s *ManagedControlPlaneScope) NodePortIngressRuleCidrBlocks() infrav1.CidrBlocks {
514514
return nil
515515
}
516516

‎pkg/cloud/scope/sg.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,5 +64,5 @@ type SGScope interface {
6464
ControlPlaneLoadBalancers() []*infrav1.AWSLoadBalancerSpec
6565

6666
// NodePortIngressRuleCidrBlocks returns the CIDR blocks for the node NodePort ingress rules.
67-
NodePortIngressRuleCidrBlocks() []string
67+
NodePortIngressRuleCidrBlocks() infrav1.CidrBlocks
6868
}

‎pkg/cloud/services/securitygroup/securitygroups.go

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -647,17 +647,27 @@ func (s *Service) getSecurityGroupIngressRules(role infrav1.SecurityGroupRole) (
647647
return append(cniRules, rules...), nil
648648

649649
case infrav1.SecurityGroupNode:
650-
cidrBlocks := []string{services.AnyIPv4CidrBlock}
651-
if scopeCidrBlocks := s.scope.NodePortIngressRuleCidrBlocks(); len(scopeCidrBlocks) > 0 {
652-
cidrBlocks = scopeCidrBlocks
650+
ipv4CidrBlocks := []string{services.AnyIPv4CidrBlock}
651+
if scopeCidrBlocks := s.scope.NodePortIngressRuleCidrBlocks().IPv4CidrBlocks(); len(scopeCidrBlocks) > 0 {
652+
ipv4CidrBlocks = scopeCidrBlocks
653653
}
654+
655+
var ipv6CidrBlocks []string
656+
if s.scope.VPC().IsIPv6Enabled() {
657+
ipv6CidrBlocks = []string{services.AnyIPv6CidrBlock}
658+
if scopeCidrBlocks := s.scope.NodePortIngressRuleCidrBlocks().IPv6CidrBlocks(); len(scopeCidrBlocks) > 0 {
659+
ipv6CidrBlocks = scopeCidrBlocks
660+
}
661+
}
662+
654663
rules := infrav1.IngressRules{
655664
{
656-
Description: "Node Port Services",
657-
Protocol: infrav1.SecurityGroupProtocolTCP,
658-
FromPort: 30000,
659-
ToPort: 32767,
660-
CidrBlocks: cidrBlocks,
665+
Description: "Node Port Services",
666+
Protocol: infrav1.SecurityGroupProtocolTCP,
667+
FromPort: 30000,
668+
ToPort: 32767,
669+
CidrBlocks: ipv4CidrBlocks,
670+
IPv6CidrBlocks: ipv6CidrBlocks,
661671
},
662672
{
663673
Description: "Kubelet API",
@@ -671,18 +681,10 @@ func (s *Service) getSecurityGroupIngressRules(role infrav1.SecurityGroupRole) (
671681
},
672682
},
673683
}
684+
674685
if s.scope.Bastion().Enabled {
675686
rules = append(rules, s.defaultSSHIngressRule(s.scope.SecurityGroups()[infrav1.SecurityGroupBastion].ID))
676687
}
677-
if s.scope.VPC().IsIPv6Enabled() {
678-
rules = append(rules, infrav1.IngressRule{
679-
Description: "Node Port Services IPv6",
680-
Protocol: infrav1.SecurityGroupProtocolTCP,
681-
FromPort: 30000,
682-
ToPort: 32767,
683-
IPv6CidrBlocks: []string{services.AnyIPv6CidrBlock},
684-
})
685-
}
686688

687689
additionalIngressRules, err := s.processIngressRulesSGs(s.scope.AdditionalNodeIngressRules())
688690
if err != nil {

‎pkg/cloud/services/securitygroup/securitygroups_test.go

Lines changed: 99 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2332,12 +2332,16 @@ func TestNodePortServicesIngressRules(t *testing.T) {
23322332

23332333
testCases := []struct {
23342334
name string
2335-
cidrBlocks []string
2335+
networkSpec infrav1.NetworkSpec
23362336
expectedIngresRules infrav1.IngressRules
23372337
}{
23382338
{
2339-
name: "default node ports services ingress rules, no node port cidr block provided",
2340-
cidrBlocks: nil,
2339+
name: "default node ports services ingress rules, no node port cidr block provided",
2340+
networkSpec: infrav1.NetworkSpec{
2341+
VPC: infrav1.VPCSpec{
2342+
CidrBlock: "10.0.0.0/16",
2343+
},
2344+
},
23412345
expectedIngresRules: infrav1.IngressRules{
23422346
{
23432347
Description: "Node Port Services",
@@ -2356,8 +2360,39 @@ func TestNodePortServicesIngressRules(t *testing.T) {
23562360
},
23572361
},
23582362
{
2359-
name: "node port cidr block provided, no default cidr block used for node port services ingress rule",
2360-
cidrBlocks: []string{"10.0.0.0/16"},
2363+
name: "default node ports services ingress rules for IPv6, no node port cidr block provided",
2364+
networkSpec: infrav1.NetworkSpec{
2365+
VPC: infrav1.VPCSpec{
2366+
CidrBlock: "10.0.0.0/16",
2367+
IPv6: &infrav1.IPv6{},
2368+
},
2369+
},
2370+
expectedIngresRules: infrav1.IngressRules{
2371+
{
2372+
Description: "Node Port Services",
2373+
Protocol: infrav1.SecurityGroupProtocolTCP,
2374+
FromPort: 30000,
2375+
ToPort: 32767,
2376+
CidrBlocks: []string{services.AnyIPv4CidrBlock},
2377+
IPv6CidrBlocks: []string{services.AnyIPv6CidrBlock},
2378+
},
2379+
{
2380+
Description: "Kubelet API",
2381+
Protocol: infrav1.SecurityGroupProtocolTCP,
2382+
FromPort: 10250,
2383+
ToPort: 10250,
2384+
SourceSecurityGroupIDs: []string{"Id1", "Id2"},
2385+
},
2386+
},
2387+
},
2388+
{
2389+
name: "node port cidr block provided, no default cidr block used for node port services ingress rule",
2390+
networkSpec: infrav1.NetworkSpec{
2391+
VPC: infrav1.VPCSpec{
2392+
CidrBlock: "10.0.0.0/16",
2393+
},
2394+
NodePortIngressRuleCidrBlocks: []string{"10.0.0.0/16"},
2395+
},
23612396
expectedIngresRules: infrav1.IngressRules{
23622397
{
23632398
Description: "Node Port Services",
@@ -2375,6 +2410,64 @@ func TestNodePortServicesIngressRules(t *testing.T) {
23752410
},
23762411
},
23772412
},
2413+
{
2414+
name: "node port cidr block provided for only IPv6, no default cidr block used for node port services ingress rule",
2415+
networkSpec: infrav1.NetworkSpec{
2416+
VPC: infrav1.VPCSpec{
2417+
CidrBlock: "10.0.0.0/16",
2418+
IPv6: &infrav1.IPv6{
2419+
CidrBlock: "2001:1234:5678:9a40::/56",
2420+
},
2421+
},
2422+
NodePortIngressRuleCidrBlocks: []string{"2001:1234:5678:9a40::/56"},
2423+
},
2424+
expectedIngresRules: infrav1.IngressRules{
2425+
{
2426+
Description: "Node Port Services",
2427+
Protocol: infrav1.SecurityGroupProtocolTCP,
2428+
FromPort: 30000,
2429+
ToPort: 32767,
2430+
CidrBlocks: []string{services.AnyIPv4CidrBlock},
2431+
IPv6CidrBlocks: []string{"2001:1234:5678:9a40::/56"},
2432+
},
2433+
{
2434+
Description: "Kubelet API",
2435+
Protocol: infrav1.SecurityGroupProtocolTCP,
2436+
FromPort: 10250,
2437+
ToPort: 10250,
2438+
SourceSecurityGroupIDs: []string{"Id1", "Id2"},
2439+
},
2440+
},
2441+
},
2442+
{
2443+
name: "node port cidr block provided for both IPv4 and IPv6, no default cidr block used for node port services ingress rule",
2444+
networkSpec: infrav1.NetworkSpec{
2445+
VPC: infrav1.VPCSpec{
2446+
CidrBlock: "10.0.0.0/16",
2447+
IPv6: &infrav1.IPv6{
2448+
CidrBlock: "2001:1234:5678:9a40::/56",
2449+
},
2450+
},
2451+
NodePortIngressRuleCidrBlocks: []string{"10.0.0.0/16", "2001:1234:5678:9a40::/56"},
2452+
},
2453+
expectedIngresRules: infrav1.IngressRules{
2454+
{
2455+
Description: "Node Port Services",
2456+
Protocol: infrav1.SecurityGroupProtocolTCP,
2457+
FromPort: 30000,
2458+
ToPort: 32767,
2459+
CidrBlocks: []string{"10.0.0.0/16"},
2460+
IPv6CidrBlocks: []string{"2001:1234:5678:9a40::/56"},
2461+
},
2462+
{
2463+
Description: "Kubelet API",
2464+
Protocol: infrav1.SecurityGroupProtocolTCP,
2465+
FromPort: 10250,
2466+
ToPort: 10250,
2467+
SourceSecurityGroupIDs: []string{"Id1", "Id2"},
2468+
},
2469+
},
2470+
},
23782471
}
23792472

23802473
for _, tc := range testCases {
@@ -2387,12 +2480,7 @@ func TestNodePortServicesIngressRules(t *testing.T) {
23872480
AWSCluster: &infrav1.AWSCluster{
23882481
Spec: infrav1.AWSClusterSpec{
23892482
ControlPlaneLoadBalancer: &infrav1.AWSLoadBalancerSpec{},
2390-
NetworkSpec: infrav1.NetworkSpec{
2391-
VPC: infrav1.VPCSpec{
2392-
CidrBlock: "10.0.0.0/16",
2393-
},
2394-
NodePortIngressRuleCidrBlocks: tc.cidrBlocks,
2395-
},
2483+
NetworkSpec: tc.networkSpec,
23962484
},
23972485
Status: infrav1.AWSClusterStatus{
23982486
Network: infrav1.NetworkStatus{

0 commit comments

Comments
 (0)