Skip to content

Commit 7ab0780

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #5005 from alexander-demicev/natgatwaysipsingress
✨ Add natgatewayips as source for ingress rules
2 parents 888c659 + ce23840 commit 7ab0780

9 files changed

+261
-23
lines changed

‎api/v1beta1/zz_generated.conversion.go

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_webhook.go

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -264,9 +264,7 @@ func (r *AWSCluster) validateNetwork() field.ErrorList {
264264
}
265265

266266
for _, rule := range r.Spec.NetworkSpec.AdditionalControlPlaneIngressRules {
267-
if (rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil) && (rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil) {
268-
allErrs = append(allErrs, field.Invalid(field.NewPath("additionalControlPlaneIngressRules"), r.Spec.NetworkSpec.AdditionalControlPlaneIngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
269-
}
267+
allErrs = append(allErrs, r.validateIngressRule(rule)...)
270268
}
271269

272270
if r.Spec.NetworkSpec.VPC.ElasticIPPool != nil {
@@ -323,9 +321,7 @@ func (r *AWSCluster) validateControlPlaneLBs() field.ErrorList {
323321
}
324322

325323
for _, rule := range cp.IngressRules {
326-
if (rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil) && (rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil) {
327-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "ingressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
328-
}
324+
allErrs = append(allErrs, r.validateIngressRule(rule)...)
329325
}
330326
}
331327

@@ -367,11 +363,19 @@ func (r *AWSCluster) validateControlPlaneLBs() field.ErrorList {
367363
}
368364
}
369365

370-
for _, rule := range r.Spec.ControlPlaneLoadBalancer.IngressRules {
366+
return allErrs
367+
}
368+
369+
func (r *AWSCluster) validateIngressRule(rule IngressRule) field.ErrorList {
370+
var allErrs field.ErrorList
371+
if rule.NatGatewaysIPsSource {
372+
if rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil || rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil {
373+
allErrs = append(allErrs, field.Invalid(field.NewPath("additionalControlPlaneIngressRules"), r.Spec.NetworkSpec.AdditionalControlPlaneIngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
374+
}
375+
} else {
371376
if (rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil) && (rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil) {
372377
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "ingressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
373378
}
374379
}
375-
376380
return allErrs
377381
}

‎api/v1beta2/awscluster_webhook_test.go

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -408,6 +408,59 @@ func TestAWSClusterValidateCreate(t *testing.T) {
408408
},
409409
wantErr: true,
410410
},
411+
{
412+
name: "rejects ingress rules with cidr block, source security group id, role and nat gateway IP source",
413+
cluster: &AWSCluster{
414+
Spec: AWSClusterSpec{
415+
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
416+
IngressRules: []IngressRule{
417+
{
418+
Protocol: SecurityGroupProtocolTCP,
419+
IPv6CidrBlocks: []string{"test"},
420+
SourceSecurityGroupIDs: []string{"test"},
421+
SourceSecurityGroupRoles: []SecurityGroupRole{SecurityGroupBastion},
422+
NatGatewaysIPsSource: true,
423+
},
424+
},
425+
},
426+
},
427+
},
428+
wantErr: true,
429+
},
430+
{
431+
name: "rejects ingress rules with source security role and nat gateway IP source",
432+
cluster: &AWSCluster{
433+
Spec: AWSClusterSpec{
434+
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
435+
IngressRules: []IngressRule{
436+
{
437+
Protocol: SecurityGroupProtocolTCP,
438+
SourceSecurityGroupRoles: []SecurityGroupRole{SecurityGroupBastion},
439+
NatGatewaysIPsSource: true,
440+
},
441+
},
442+
},
443+
},
444+
},
445+
wantErr: true,
446+
},
447+
{
448+
name: "rejects ingress rules with cidr block and nat gateway IP source",
449+
cluster: &AWSCluster{
450+
Spec: AWSClusterSpec{
451+
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
452+
IngressRules: []IngressRule{
453+
{
454+
Protocol: SecurityGroupProtocolTCP,
455+
IPv6CidrBlocks: []string{"test"},
456+
NatGatewaysIPsSource: true,
457+
},
458+
},
459+
},
460+
},
461+
},
462+
wantErr: true,
463+
},
411464
{
412465
name: "accepts ingress rules with cidr block",
413466
cluster: &AWSCluster{
@@ -424,6 +477,22 @@ func TestAWSClusterValidateCreate(t *testing.T) {
424477
},
425478
wantErr: false,
426479
},
480+
{
481+
name: "accepts ingress rules with nat gateway IPs source",
482+
cluster: &AWSCluster{
483+
Spec: AWSClusterSpec{
484+
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
485+
IngressRules: []IngressRule{
486+
{
487+
Protocol: SecurityGroupProtocolTCP,
488+
NatGatewaysIPsSource: true,
489+
},
490+
},
491+
},
492+
},
493+
},
494+
wantErr: false,
495+
},
427496
{
428497
name: "accepts ingress rules with source security group role",
429498
cluster: &AWSCluster{

‎api/v1beta2/network_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -930,6 +930,10 @@ type IngressRule struct {
930930
// The field will be combined with source security group IDs if specified.
931931
// +optional
932932
SourceSecurityGroupRoles []SecurityGroupRole `json:"sourceSecurityGroupRoles,omitempty"`
933+
934+
// NatGatewaysIPsSource use the NAT gateways IPs as the source for the ingress rule.
935+
// +optional
936+
NatGatewaysIPsSource bool `json:"natGatewaysIPsSource,omitempty"`
933937
}
934938

935939
// String returns a string representation of the ingress rule.

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -393,6 +393,10 @@ spec:
393393
items:
394394
type: string
395395
type: array
396+
natGatewaysIPsSource:
397+
description: NatGatewaysIPsSource use the NAT gateways IPs
398+
as the source for the ingress rule.
399+
type: boolean
396400
protocol:
397401
description: Protocol is the protocol for the ingress rule.
398402
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
@@ -1920,6 +1924,10 @@ spec:
19201924
items:
19211925
type: string
19221926
type: array
1927+
natGatewaysIPsSource:
1928+
description: NatGatewaysIPsSource use the NAT gateways
1929+
IPs as the source for the ingress rule.
1930+
type: boolean
19231931
protocol:
19241932
description: Protocol is the protocol for the ingress
19251933
rule. Accepted values are "-1" (all), "4" (IP in
@@ -2376,6 +2384,10 @@ spec:
23762384
items:
23772385
type: string
23782386
type: array
2387+
natGatewaysIPsSource:
2388+
description: NatGatewaysIPsSource use the NAT gateways IPs
2389+
as the source for the ingress rule.
2390+
type: boolean
23792391
protocol:
23802392
description: Protocol is the protocol for the ingress rule.
23812393
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
@@ -3916,6 +3928,10 @@ spec:
39163928
items:
39173929
type: string
39183930
type: array
3931+
natGatewaysIPsSource:
3932+
description: NatGatewaysIPsSource use the NAT gateways
3933+
IPs as the source for the ingress rule.
3934+
type: boolean
39193935
protocol:
39203936
description: Protocol is the protocol for the ingress
39213937
rule. Accepted values are "-1" (all), "4" (IP in

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1164,6 +1164,10 @@ spec:
11641164
items:
11651165
type: string
11661166
type: array
1167+
natGatewaysIPsSource:
1168+
description: NatGatewaysIPsSource use the NAT gateways IPs
1169+
as the source for the ingress rule.
1170+
type: boolean
11671171
protocol:
11681172
description: Protocol is the protocol for the ingress rule.
11691173
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
@@ -1329,6 +1333,10 @@ spec:
13291333
items:
13301334
type: string
13311335
type: array
1336+
natGatewaysIPsSource:
1337+
description: NatGatewaysIPsSource use the NAT gateways IPs
1338+
as the source for the ingress rule.
1339+
type: boolean
13321340
protocol:
13331341
description: Protocol is the protocol for the ingress rule.
13341342
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
@@ -1943,6 +1951,10 @@ spec:
19431951
items:
19441952
type: string
19451953
type: array
1954+
natGatewaysIPsSource:
1955+
description: NatGatewaysIPsSource use the NAT gateways IPs
1956+
as the source for the ingress rule.
1957+
type: boolean
19461958
protocol:
19471959
description: Protocol is the protocol for the ingress rule.
19481960
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
@@ -2866,6 +2878,10 @@ spec:
28662878
items:
28672879
type: string
28682880
type: array
2881+
natGatewaysIPsSource:
2882+
description: NatGatewaysIPsSource use the NAT gateways
2883+
IPs as the source for the ingress rule.
2884+
type: boolean
28692885
protocol:
28702886
description: Protocol is the protocol for the ingress
28712887
rule. Accepted values are "-1" (all), "4" (IP in

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -756,6 +756,10 @@ spec:
756756
items:
757757
type: string
758758
type: array
759+
natGatewaysIPsSource:
760+
description: NatGatewaysIPsSource use the NAT gateways
761+
IPs as the source for the ingress rule.
762+
type: boolean
759763
protocol:
760764
description: Protocol is the protocol for the ingress
761765
rule. Accepted values are "-1" (all), "4" (IP
@@ -925,6 +929,10 @@ spec:
925929
items:
926930
type: string
927931
type: array
932+
natGatewaysIPsSource:
933+
description: NatGatewaysIPsSource use the NAT gateways
934+
IPs as the source for the ingress rule.
935+
type: boolean
928936
protocol:
929937
description: Protocol is the protocol for the ingress
930938
rule. Accepted values are "-1" (all), "4" (IP
@@ -1544,6 +1552,10 @@ spec:
15441552
items:
15451553
type: string
15461554
type: array
1555+
natGatewaysIPsSource:
1556+
description: NatGatewaysIPsSource use the NAT gateways
1557+
IPs as the source for the ingress rule.
1558+
type: boolean
15471559
protocol:
15481560
description: Protocol is the protocol for the ingress
15491561
rule. Accepted values are "-1" (all), "4" (IP

‎pkg/cloud/services/securitygroup/securitygroups.go

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -592,7 +592,12 @@ func (s *Service) getSecurityGroupIngressRules(role infrav1.SecurityGroupRole) (
592592
rules = append(rules, s.defaultSSHIngressRule(s.scope.SecurityGroups()[infrav1.SecurityGroupBastion].ID))
593593
}
594594

595-
rules = append(rules, s.processIngressRulesSGs(s.scope.AdditionalControlPlaneIngressRules())...)
595+
additionalIngressRules, err := s.processIngressRulesSGs(s.scope.AdditionalControlPlaneIngressRules())
596+
if err != nil {
597+
return nil, err
598+
}
599+
600+
rules = append(rules, additionalIngressRules...)
596601

597602
return append(cniRules, rules...), nil
598603

@@ -639,7 +644,10 @@ func (s *Service) getSecurityGroupIngressRules(role infrav1.SecurityGroupRole) (
639644
return infrav1.IngressRules{}, nil
640645
case infrav1.SecurityGroupAPIServerLB:
641646
kubeletRules := s.getIngressRulesToAllowKubeletToAccessTheControlPlaneLB()
642-
customIngressRules := s.processIngressRulesSGs(s.getControlPlaneLBIngressRules())
647+
customIngressRules, err := s.processIngressRulesSGs(s.getControlPlaneLBIngressRules())
648+
if err != nil {
649+
return nil, err
650+
}
643651
rulesToApply := customIngressRules.Difference(kubeletRules)
644652
return append(kubeletRules, rulesToApply...), nil
645653
case infrav1.SecurityGroupLB:
@@ -964,10 +972,25 @@ func (s *Service) getIngressRuleToAllowVPCCidrInTheAPIServer() infrav1.IngressRu
964972
}
965973
}
966974

967-
func (s *Service) processIngressRulesSGs(ingressRules []infrav1.IngressRule) infrav1.IngressRules {
975+
func (s *Service) processIngressRulesSGs(ingressRules []infrav1.IngressRule) (infrav1.IngressRules, error) {
968976
output := []infrav1.IngressRule{}
969977

970978
for _, rule := range ingressRules {
979+
if rule.NatGatewaysIPsSource { // if the rule has NatGatewaysIPsSource set to true, use the NAT Gateway IPs as the source
980+
natGatewaysCidrs := []string{}
981+
natGatewaysIPs := s.scope.GetNatGatewaysIPs()
982+
for _, ip := range natGatewaysIPs {
983+
natGatewaysCidrs = append(natGatewaysCidrs, fmt.Sprintf("%s/32", ip))
984+
}
985+
if len(natGatewaysIPs) > 0 {
986+
rule.CidrBlocks = natGatewaysCidrs
987+
output = append(output, rule)
988+
continue
989+
}
990+
991+
return nil, errors.New("NAT Gateway IPs are not available yet")
992+
}
993+
971994
if len(rule.CidrBlocks) != 0 || len(rule.IPv6CidrBlocks) != 0 { // don't set source security group if cidr blocks are set
972995
output = append(output, rule)
973996
continue
@@ -988,5 +1011,5 @@ func (s *Service) processIngressRulesSGs(ingressRules []infrav1.IngressRule) inf
9881011
output = append(output, rule)
9891012
}
9901013

991-
return output
1014+
return output, nil
9921015
}

0 commit comments

Comments
 (0)