Skip to content

Commit 6705ad8

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4304 from fiunchinho/additional-ingress-rules-cp-lb
Allow customization of ingress rules in control plane LB security group
2 parents 15e766e + b4928b2 commit 6705ad8

11 files changed

+241
-132
lines changed

‎api/v1beta1/awscluster_conversion.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ func restoreControlPlaneLoadBalancer(restored, dst *infrav2.AWSLoadBalancerSpec)
7474
dst.LoadBalancerType = restored.LoadBalancerType
7575
dst.DisableHostsRewrite = restored.DisableHostsRewrite
7676
dst.PreserveClientIP = restored.PreserveClientIP
77-
dst.AdditionalIngressRules = restored.AdditionalIngressRules
77+
dst.IngressRules = restored.IngressRules
7878
}
7979

8080
// ConvertFrom converts the v1beta1 AWSCluster receiver to a v1beta1 AWSCluster.

‎api/v1beta1/zz_generated.conversion.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_types.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -208,10 +208,9 @@ type AWSLoadBalancerSpec struct {
208208
// +optional
209209
AdditionalSecurityGroups []string `json:"additionalSecurityGroups,omitempty"`
210210

211-
// AdditionalIngressRules sets the additional ingress rules for the control plane load balancer. If no source security group ids are specified, the
212-
// default control plane security group will be used.
211+
// IngressRules sets the ingress rules for the control plane load balancer.
213212
// +optional
214-
AdditionalIngressRules []IngressRule `json:"additionalIngressRules,omitempty"`
213+
IngressRules []IngressRule `json:"ingressRules,omitempty"`
215214

216215
// LoadBalancerType sets the type for a load balancer. The default type is classic.
217216
// +kubebuilder:default=classic

‎api/v1beta2/awscluster_webhook.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -199,9 +199,9 @@ func (r *AWSCluster) validateAdditionalIngressRules() field.ErrorList {
199199
return allErrs
200200
}
201201

202-
for _, rule := range r.Spec.ControlPlaneLoadBalancer.AdditionalIngressRules {
202+
for _, rule := range r.Spec.ControlPlaneLoadBalancer.IngressRules {
203203
if (rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil) && (rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil) {
204-
allErrs = append(allErrs, field.Invalid(field.NewPath("additionalIngressRules"), r.Spec.ControlPlaneLoadBalancer.AdditionalIngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
204+
allErrs = append(allErrs, field.Invalid(field.NewPath("additionalIngressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
205205
}
206206
}
207207

‎api/v1beta2/awscluster_webhook_test.go

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -252,11 +252,11 @@ func TestAWSClusterValidateCreate(t *testing.T) {
252252
wantErr: true,
253253
},
254254
{
255-
name: "rejects additional ingress rules with cidr block and source security group id",
255+
name: "rejects ingress rules with cidr block and source security group id",
256256
cluster: &AWSCluster{
257257
Spec: AWSClusterSpec{
258258
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
259-
AdditionalIngressRules: []IngressRule{
259+
IngressRules: []IngressRule{
260260
{
261261
Protocol: SecurityGroupProtocolTCP,
262262
CidrBlocks: []string{"test"},
@@ -269,11 +269,11 @@ func TestAWSClusterValidateCreate(t *testing.T) {
269269
wantErr: true,
270270
},
271271
{
272-
name: "rejects additional ingress rules with cidr block and source security group id and role",
272+
name: "rejects ingress rules with cidr block and source security group id and role",
273273
cluster: &AWSCluster{
274274
Spec: AWSClusterSpec{
275275
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
276-
AdditionalIngressRules: []IngressRule{
276+
IngressRules: []IngressRule{
277277
{
278278
Protocol: SecurityGroupProtocolTCP,
279279
IPv6CidrBlocks: []string{"test"},
@@ -287,11 +287,11 @@ func TestAWSClusterValidateCreate(t *testing.T) {
287287
wantErr: true,
288288
},
289289
{
290-
name: "accepts additional ingress rules with cidr block",
290+
name: "accepts ingress rules with cidr block",
291291
cluster: &AWSCluster{
292292
Spec: AWSClusterSpec{
293293
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
294-
AdditionalIngressRules: []IngressRule{
294+
IngressRules: []IngressRule{
295295
{
296296
Protocol: SecurityGroupProtocolTCP,
297297
CidrBlocks: []string{"test"},
@@ -303,11 +303,11 @@ func TestAWSClusterValidateCreate(t *testing.T) {
303303
wantErr: false,
304304
},
305305
{
306-
name: "accepts additional ingress rules with source security group role",
306+
name: "accepts ingress rules with source security group role",
307307
cluster: &AWSCluster{
308308
Spec: AWSClusterSpec{
309309
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
310-
AdditionalIngressRules: []IngressRule{
310+
IngressRules: []IngressRule{
311311
{
312312
Protocol: SecurityGroupProtocolTCP,
313313
SourceSecurityGroupRoles: []SecurityGroupRole{SecurityGroupBastion},
@@ -319,11 +319,11 @@ func TestAWSClusterValidateCreate(t *testing.T) {
319319
wantErr: false,
320320
},
321321
{
322-
name: "accepts additional ingress rules with source security group id and role",
322+
name: "accepts ingress rules with source security group id and role",
323323
cluster: &AWSCluster{
324324
Spec: AWSClusterSpec{
325325
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
326-
AdditionalIngressRules: []IngressRule{
326+
IngressRules: []IngressRule{
327327
{
328328
Protocol: SecurityGroupProtocolTCP,
329329
SourceSecurityGroupIDs: []string{"test"},

‎api/v1beta2/zz_generated.deepcopy.go

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml

Lines changed: 37 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -966,11 +966,43 @@ spec:
966966
description: ControlPlaneLoadBalancer is optional configuration for
967967
customizing control plane behavior.
968968
properties:
969-
additionalIngressRules:
970-
description: AdditionalIngressRules sets the additional ingress
971-
rules for the control plane load balancer. If no source security
972-
group ids are specified, the default control plane security
973-
group will be used.
969+
additionalSecurityGroups:
970+
description: AdditionalSecurityGroups sets the security groups
971+
used by the load balancer. Expected to be security group IDs
972+
This is optional - if not provided new security groups will
973+
be created for the load balancer
974+
items:
975+
type: string
976+
type: array
977+
crossZoneLoadBalancing:
978+
description: "CrossZoneLoadBalancing enables the classic ELB cross
979+
availability zone balancing. \n With cross-zone load balancing,
980+
each load balancer node for your Classic Load Balancer distributes
981+
requests evenly across the registered instances in all enabled
982+
Availability Zones. If cross-zone load balancing is disabled,
983+
each load balancer node distributes requests evenly across the
984+
registered instances in its Availability Zone only. \n Defaults
985+
to false."
986+
type: boolean
987+
disableHostsRewrite:
988+
description: DisableHostsRewrite disabled the hair pinning issue
989+
solution that adds the NLB's address as 127.0.0.1 to the hosts
990+
file of each instance. This is by default, false.
991+
type: boolean
992+
healthCheckProtocol:
993+
description: HealthCheckProtocol sets the protocol type for ELB
994+
health check target default value is ELBProtocolSSL
995+
enum:
996+
- TCP
997+
- SSL
998+
- HTTP
999+
- HTTPS
1000+
- TLS
1001+
- UDP
1002+
type: string
1003+
ingressRules:
1004+
description: IngressRules sets the ingress rules for the control
1005+
plane load balancer.
9741006
items:
9751007
description: IngressRule defines an AWS ingress rule for security
9761008
groups.
@@ -1040,40 +1072,6 @@ spec:
10401072
- toPort
10411073
type: object
10421074
type: array
1043-
additionalSecurityGroups:
1044-
description: AdditionalSecurityGroups sets the security groups
1045-
used by the load balancer. Expected to be security group IDs
1046-
This is optional - if not provided new security groups will
1047-
be created for the load balancer
1048-
items:
1049-
type: string
1050-
type: array
1051-
crossZoneLoadBalancing:
1052-
description: "CrossZoneLoadBalancing enables the classic ELB cross
1053-
availability zone balancing. \n With cross-zone load balancing,
1054-
each load balancer node for your Classic Load Balancer distributes
1055-
requests evenly across the registered instances in all enabled
1056-
Availability Zones. If cross-zone load balancing is disabled,
1057-
each load balancer node distributes requests evenly across the
1058-
registered instances in its Availability Zone only. \n Defaults
1059-
to false."
1060-
type: boolean
1061-
disableHostsRewrite:
1062-
description: DisableHostsRewrite disabled the hair pinning issue
1063-
solution that adds the NLB's address as 127.0.0.1 to the hosts
1064-
file of each instance. This is by default, false.
1065-
type: boolean
1066-
healthCheckProtocol:
1067-
description: HealthCheckProtocol sets the protocol type for ELB
1068-
health check target default value is ELBProtocolSSL
1069-
enum:
1070-
- TCP
1071-
- SSL
1072-
- HTTP
1073-
- HTTPS
1074-
- TLS
1075-
- UDP
1076-
type: string
10771075
loadBalancerType:
10781076
default: classic
10791077
description: LoadBalancerType sets the type for a load balancer.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml

Lines changed: 39 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -559,11 +559,45 @@ spec:
559559
description: ControlPlaneLoadBalancer is optional configuration
560560
for customizing control plane behavior.
561561
properties:
562-
additionalIngressRules:
563-
description: AdditionalIngressRules sets the additional
564-
ingress rules for the control plane load balancer. If
565-
no source security group ids are specified, the default
566-
control plane security group will be used.
562+
additionalSecurityGroups:
563+
description: AdditionalSecurityGroups sets the security
564+
groups used by the load balancer. Expected to be security
565+
group IDs This is optional - if not provided new security
566+
groups will be created for the load balancer
567+
items:
568+
type: string
569+
type: array
570+
crossZoneLoadBalancing:
571+
description: "CrossZoneLoadBalancing enables the classic
572+
ELB cross availability zone balancing. \n With cross-zone
573+
load balancing, each load balancer node for your Classic
574+
Load Balancer distributes requests evenly across the
575+
registered instances in all enabled Availability Zones.
576+
If cross-zone load balancing is disabled, each load
577+
balancer node distributes requests evenly across the
578+
registered instances in its Availability Zone only.
579+
\n Defaults to false."
580+
type: boolean
581+
disableHostsRewrite:
582+
description: DisableHostsRewrite disabled the hair pinning
583+
issue solution that adds the NLB's address as 127.0.0.1
584+
to the hosts file of each instance. This is by default,
585+
false.
586+
type: boolean
587+
healthCheckProtocol:
588+
description: HealthCheckProtocol sets the protocol type
589+
for ELB health check target default value is ELBProtocolSSL
590+
enum:
591+
- TCP
592+
- SSL
593+
- HTTP
594+
- HTTPS
595+
- TLS
596+
- UDP
597+
type: string
598+
ingressRules:
599+
description: IngressRules sets the ingress rules for the
600+
control plane load balancer.
567601
items:
568602
description: IngressRule defines an AWS ingress rule
569603
for security groups.
@@ -634,42 +668,6 @@ spec:
634668
- toPort
635669
type: object
636670
type: array
637-
additionalSecurityGroups:
638-
description: AdditionalSecurityGroups sets the security
639-
groups used by the load balancer. Expected to be security
640-
group IDs This is optional - if not provided new security
641-
groups will be created for the load balancer
642-
items:
643-
type: string
644-
type: array
645-
crossZoneLoadBalancing:
646-
description: "CrossZoneLoadBalancing enables the classic
647-
ELB cross availability zone balancing. \n With cross-zone
648-
load balancing, each load balancer node for your Classic
649-
Load Balancer distributes requests evenly across the
650-
registered instances in all enabled Availability Zones.
651-
If cross-zone load balancing is disabled, each load
652-
balancer node distributes requests evenly across the
653-
registered instances in its Availability Zone only.
654-
\n Defaults to false."
655-
type: boolean
656-
disableHostsRewrite:
657-
description: DisableHostsRewrite disabled the hair pinning
658-
issue solution that adds the NLB's address as 127.0.0.1
659-
to the hosts file of each instance. This is by default,
660-
false.
661-
type: boolean
662-
healthCheckProtocol:
663-
description: HealthCheckProtocol sets the protocol type
664-
for ELB health check target default value is ELBProtocolSSL
665-
enum:
666-
- TCP
667-
- SSL
668-
- HTTP
669-
- HTTPS
670-
- TLS
671-
- UDP
672-
type: string
673671
loadBalancerType:
674672
default: classic
675673
description: LoadBalancerType sets the type for a load

‎docs/book/src/topics/bring-your-own-aws-infrastructure.md

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -163,11 +163,12 @@ It's also possible to specify custom ingress rules for the control plane load ba
163163

164164
```yaml
165165
spec:
166-
additionalIngressRules:
167-
- description: "example ingress rule"
168-
protocol: "-1" # all
169-
fromPort: 7777
170-
toPort: 7777
166+
controlPlaneLoadBalancer:
167+
ingressRules:
168+
- description: "example ingress rule"
169+
protocol: "-1" # all
170+
fromPort: 7777
171+
toPort: 7777
171172
```
172173

173174
> **WARNING:** Using an existing Classic ELB is an advanced feature. **If you use an existing Classic ELB, you must correctly configure it, and attach subnets to it.**

0 commit comments

Comments
 (0)