Skip to content

Commit a2e7360

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4552 from vincepri/allow-esp-port
🌱 Allow ESP protocol to be set in IngressRules
2 parents 5d1cb0f + 9528f42 commit a2e7360

File tree

6 files changed

+46
-13
lines changed

6 files changed

+46
-13
lines changed

‎api/v1beta2/network_types.go

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -590,14 +590,17 @@ var (
590590

591591
// SecurityGroupProtocolICMPv6 represents the ICMPv6 protocol in ingress rules.
592592
SecurityGroupProtocolICMPv6 = SecurityGroupProtocol("58")
593+
594+
// SecurityGroupProtocolESP represents the ESP protocol in ingress rules.
595+
SecurityGroupProtocolESP = SecurityGroupProtocol("50")
593596
)
594597

595598
// IngressRule defines an AWS ingress rule for security groups.
596599
type IngressRule struct {
597600
// Description provides extended information about the ingress rule.
598601
Description string `json:"description"`
599-
// Protocol is the protocol for the ingress rule. Accepted values are "-1" (all), "4" (IP in IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
600-
// +kubebuilder:validation:Enum="-1";"4";tcp;udp;icmp;"58"
602+
// Protocol is the protocol for the ingress rule. Accepted values are "-1" (all), "4" (IP in IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
603+
// +kubebuilder:validation:Enum="-1";"4";tcp;udp;icmp;"58";"50"
601604
Protocol SecurityGroupProtocol `json:"protocol"`
602605
// FromPort is the start of port range.
603606
FromPort int64 `json:"fromPort"`
@@ -706,7 +709,7 @@ func (i *IngressRule) Equals(o *IngressRule) bool {
706709
SecurityGroupProtocolICMP,
707710
SecurityGroupProtocolICMPv6:
708711
return i.FromPort == o.FromPort && i.ToPort == o.ToPort
709-
case SecurityGroupProtocolAll, SecurityGroupProtocolIPinIP:
712+
case SecurityGroupProtocolAll, SecurityGroupProtocolIPinIP, SecurityGroupProtocolESP:
710713
// FromPort / ToPort are not applicable
711714
}
712715

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -386,14 +386,15 @@ spec:
386386
protocol:
387387
description: Protocol is the protocol for the ingress rule.
388388
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
389-
"udp", "icmp", and "58" (ICMPv6).
389+
"udp", "icmp", and "58" (ICMPv6), "50" (ESP).
390390
enum:
391391
- "-1"
392392
- "4"
393393
- tcp
394394
- udp
395395
- icmp
396396
- "58"
397+
- "50"
397398
type: string
398399
sourceSecurityGroupIds:
399400
description: The security group id to allow access from.
@@ -1525,14 +1526,16 @@ spec:
15251526
protocol:
15261527
description: Protocol is the protocol for the ingress
15271528
rule. Accepted values are "-1" (all), "4" (IP in
1528-
IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
1529+
IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50"
1530+
(ESP).
15291531
enum:
15301532
- "-1"
15311533
- "4"
15321534
- tcp
15331535
- udp
15341536
- icmp
15351537
- "58"
1538+
- "50"
15361539
type: string
15371540
sourceSecurityGroupIds:
15381541
description: The security group id to allow access
@@ -1969,14 +1972,15 @@ spec:
19691972
protocol:
19701973
description: Protocol is the protocol for the ingress rule.
19711974
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
1972-
"udp", "icmp", and "58" (ICMPv6).
1975+
"udp", "icmp", and "58" (ICMPv6), "50" (ESP).
19731976
enum:
19741977
- "-1"
19751978
- "4"
19761979
- tcp
19771980
- udp
19781981
- icmp
19791982
- "58"
1983+
- "50"
19801984
type: string
19811985
sourceSecurityGroupIds:
19821986
description: The security group id to allow access from.
@@ -3121,14 +3125,16 @@ spec:
31213125
protocol:
31223126
description: Protocol is the protocol for the ingress
31233127
rule. Accepted values are "-1" (all), "4" (IP in
3124-
IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
3128+
IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50"
3129+
(ESP).
31253130
enum:
31263131
- "-1"
31273132
- "4"
31283133
- tcp
31293134
- udp
31303135
- icmp
31313136
- "58"
3137+
- "50"
31323138
type: string
31333139
sourceSecurityGroupIds:
31343140
description: The security group id to allow access

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1057,14 +1057,15 @@ spec:
10571057
protocol:
10581058
description: Protocol is the protocol for the ingress rule.
10591059
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
1060-
"udp", "icmp", and "58" (ICMPv6).
1060+
"udp", "icmp", and "58" (ICMPv6), "50" (ESP).
10611061
enum:
10621062
- "-1"
10631063
- "4"
10641064
- tcp
10651065
- udp
10661066
- icmp
10671067
- "58"
1068+
- "50"
10681069
type: string
10691070
sourceSecurityGroupIds:
10701071
description: The security group id to allow access from.
@@ -1217,14 +1218,15 @@ spec:
12171218
protocol:
12181219
description: Protocol is the protocol for the ingress rule.
12191220
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
1220-
"udp", "icmp", and "58" (ICMPv6).
1221+
"udp", "icmp", and "58" (ICMPv6), "50" (ESP).
12211222
enum:
12221223
- "-1"
12231224
- "4"
12241225
- tcp
12251226
- udp
12261227
- icmp
12271228
- "58"
1229+
- "50"
12281230
type: string
12291231
sourceSecurityGroupIds:
12301232
description: The security group id to allow access from.
@@ -2087,14 +2089,16 @@ spec:
20872089
protocol:
20882090
description: Protocol is the protocol for the ingress
20892091
rule. Accepted values are "-1" (all), "4" (IP in
2090-
IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
2092+
IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50"
2093+
(ESP).
20912094
enum:
20922095
- "-1"
20932096
- "4"
20942097
- tcp
20952098
- udp
20962099
- icmp
20972100
- "58"
2101+
- "50"
20982102
type: string
20992103
sourceSecurityGroupIds:
21002104
description: The security group id to allow access

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -653,14 +653,16 @@ spec:
653653
protocol:
654654
description: Protocol is the protocol for the ingress
655655
rule. Accepted values are "-1" (all), "4" (IP
656-
in IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
656+
in IP),"tcp", "udp", "icmp", and "58" (ICMPv6),
657+
"50" (ESP).
657658
enum:
658659
- "-1"
659660
- "4"
660661
- tcp
661662
- udp
662663
- icmp
663664
- "58"
665+
- "50"
664666
type: string
665667
sourceSecurityGroupIds:
666668
description: The security group id to allow access
@@ -820,14 +822,16 @@ spec:
820822
protocol:
821823
description: Protocol is the protocol for the ingress
822824
rule. Accepted values are "-1" (all), "4" (IP
823-
in IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
825+
in IP),"tcp", "udp", "icmp", and "58" (ICMPv6),
826+
"50" (ESP).
824827
enum:
825828
- "-1"
826829
- "4"
827830
- tcp
828831
- udp
829832
- icmp
830833
- "58"
834+
- "50"
831835
type: string
832836
sourceSecurityGroupIds:
833837
description: The security group id to allow access

‎pkg/cloud/services/securitygroup/securitygroups.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -703,7 +703,9 @@ func ingressRuleToSDKType(scope scope.SGScope, i *infrav1.IngressRule) (res *ec2
703703
FromPort: aws.Int64(i.FromPort),
704704
ToPort: aws.Int64(i.ToPort),
705705
}
706-
case infrav1.SecurityGroupProtocolAll, infrav1.SecurityGroupProtocolIPinIP:
706+
case infrav1.SecurityGroupProtocolIPinIP,
707+
infrav1.SecurityGroupProtocolESP,
708+
infrav1.SecurityGroupProtocolAll:
707709
res = &ec2.IpPermission{
708710
IpProtocol: aws.String(string(i.Protocol)),
709711
}

‎test/e2e/data/infrastructure-aws/withoutclusterclass/e2e_test_templates/cluster-template-internal-elb.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,20 @@ spec:
2828
controlPlaneLoadBalancer:
2929
scheme: internal
3030
network:
31+
cni:
32+
cniIngressRules:
33+
- description: Allow ESP traffic from all nodes in the cluster
34+
protocol: "50"
35+
fromPort: -1
36+
toPort: -1
37+
- description: bgp (calico)
38+
protocol: tcp
39+
fromPort: 179
40+
toPort: 179
41+
- description: IP-in-IP (calico)
42+
protocol: "4"
43+
fromPort: -1
44+
toPort: 65535
3145
subnets:
3246
- id: ${WL_PRIVATE_SUBNET_ID}
3347
vpc:

0 commit comments

Comments
 (0)