Skip to content

Commit b90c18c

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4359 from alexander-demicev/cpingress
Additional ingress rules for control plane
2 parents 66400f9 + 80dbe3a commit b90c18c

17 files changed

+485
-45
lines changed

‎api/v1beta1/awscluster_conversion.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@ func (src *AWSCluster) ConvertTo(dstRaw conversion.Hub) error {
7171
restoreIPAMPool(restored.Spec.NetworkSpec.VPC.IPv6.IPAMPool, dst.Spec.NetworkSpec.VPC.IPv6.IPAMPool)
7272
}
7373

74+
dst.Spec.NetworkSpec.AdditionalControlPlaneIngressRules = restored.Spec.NetworkSpec.AdditionalControlPlaneIngressRules
75+
7476
return nil
7577
}
7678

‎api/v1beta1/conversion.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,3 +90,7 @@ func Convert_v1beta2_VPCSpec_To_v1beta1_VPCSpec(in *v1beta2.VPCSpec, out *VPCSpe
9090
func Convert_v1beta2_IPv6_To_v1beta1_IPv6(in *v1beta2.IPv6, out *IPv6, s conversion.Scope) error {
9191
return autoConvert_v1beta2_IPv6_To_v1beta1_IPv6(in, out, s)
9292
}
93+
94+
func Convert_v1beta2_NetworkSpec_To_v1beta1_NetworkSpec(in *v1beta2.NetworkSpec, out *NetworkSpec, s conversion.Scope) error {
95+
return autoConvert_v1beta2_NetworkSpec_To_v1beta1_NetworkSpec(in, out, s)
96+
}

‎api/v1beta1/zz_generated.conversion.go

Lines changed: 6 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_webhook.go

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ func (r *AWSCluster) ValidateCreate() error {
5757
allErrs = append(allErrs, r.Spec.AdditionalTags.Validate()...)
5858
allErrs = append(allErrs, r.Spec.S3Bucket.Validate()...)
5959
allErrs = append(allErrs, r.validateNetwork()...)
60-
allErrs = append(allErrs, r.validateAdditionalIngressRules()...)
60+
allErrs = append(allErrs, r.validateControlPlaneLBIngressRules()...)
6161

6262
return aggregateObjErrors(r.GroupVersionKind().GroupKind(), r.Name, allErrs)
6363
}
@@ -237,10 +237,15 @@ func (r *AWSCluster) validateNetwork() field.ErrorList {
237237
allErrs = append(allErrs, field.Invalid(field.NewPath("ipamPool"), r.Spec.NetworkSpec.VPC.IPAMPool, "ipamPool must have either id or name"))
238238
}
239239

240+
for _, rule := range r.Spec.NetworkSpec.AdditionalControlPlaneIngressRules {
241+
if (rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil) && (rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil) {
242+
allErrs = append(allErrs, field.Invalid(field.NewPath("additionalControlPlaneIngressRules"), r.Spec.NetworkSpec.AdditionalControlPlaneIngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
243+
}
244+
}
240245
return allErrs
241246
}
242247

243-
func (r *AWSCluster) validateAdditionalIngressRules() field.ErrorList {
248+
func (r *AWSCluster) validateControlPlaneLBIngressRules() field.ErrorList {
244249
var allErrs field.ErrorList
245250

246251
if r.Spec.ControlPlaneLoadBalancer == nil {
@@ -249,7 +254,7 @@ func (r *AWSCluster) validateAdditionalIngressRules() field.ErrorList {
249254

250255
for _, rule := range r.Spec.ControlPlaneLoadBalancer.IngressRules {
251256
if (rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil) && (rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil) {
252-
allErrs = append(allErrs, field.Invalid(field.NewPath("additionalIngressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
257+
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "ingressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
253258
}
254259
}
255260

‎api/v1beta2/awscluster_webhook_test.go

Lines changed: 88 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,19 @@ func TestAWSClusterValidateCreate(t *testing.T) {
335335
},
336336
wantErr: false,
337337
},
338+
{
339+
name: "rejects ipamPool if id or name not set",
340+
cluster: &AWSCluster{
341+
Spec: AWSClusterSpec{
342+
NetworkSpec: NetworkSpec{
343+
VPC: VPCSpec{
344+
IPAMPool: &IPAMPool{},
345+
},
346+
},
347+
},
348+
},
349+
wantErr: true,
350+
},
338351
{
339352
name: "rejects cidrBlock and ipamPool if set together",
340353
cluster: &AWSCluster{
@@ -350,18 +363,90 @@ func TestAWSClusterValidateCreate(t *testing.T) {
350363
wantErr: true,
351364
},
352365
{
353-
name: "rejects ipamPool if id or name not set",
366+
name: "accepts CP ingress rules with source security group id and role",
354367
cluster: &AWSCluster{
355368
Spec: AWSClusterSpec{
356369
NetworkSpec: NetworkSpec{
357-
VPC: VPCSpec{
358-
IPAMPool: &IPAMPool{},
370+
AdditionalControlPlaneIngressRules: []IngressRule{
371+
{
372+
Protocol: SecurityGroupProtocolTCP,
373+
SourceSecurityGroupIDs: []string{"test"},
374+
SourceSecurityGroupRoles: []SecurityGroupRole{SecurityGroupBastion},
375+
},
376+
},
377+
},
378+
},
379+
},
380+
wantErr: false,
381+
},
382+
{
383+
name: "rejects CP ingress rules with cidr block and source security group id",
384+
cluster: &AWSCluster{
385+
Spec: AWSClusterSpec{
386+
NetworkSpec: NetworkSpec{
387+
AdditionalControlPlaneIngressRules: []IngressRule{
388+
{
389+
Protocol: SecurityGroupProtocolTCP,
390+
CidrBlocks: []string{"test"},
391+
SourceSecurityGroupIDs: []string{"test"},
392+
},
359393
},
360394
},
361395
},
362396
},
363397
wantErr: true,
364398
},
399+
{
400+
name: "rejects CP ingress rules with cidr block and source security group id and role",
401+
cluster: &AWSCluster{
402+
Spec: AWSClusterSpec{
403+
NetworkSpec: NetworkSpec{
404+
AdditionalControlPlaneIngressRules: []IngressRule{
405+
{
406+
Protocol: SecurityGroupProtocolTCP,
407+
IPv6CidrBlocks: []string{"test"},
408+
SourceSecurityGroupIDs: []string{"test"},
409+
SourceSecurityGroupRoles: []SecurityGroupRole{SecurityGroupBastion},
410+
},
411+
},
412+
},
413+
},
414+
},
415+
wantErr: true,
416+
},
417+
{
418+
name: "accepts CP ingress rules with cidr block",
419+
cluster: &AWSCluster{
420+
Spec: AWSClusterSpec{
421+
NetworkSpec: NetworkSpec{
422+
AdditionalControlPlaneIngressRules: []IngressRule{
423+
{
424+
Protocol: SecurityGroupProtocolTCP,
425+
CidrBlocks: []string{"test"},
426+
},
427+
},
428+
},
429+
},
430+
},
431+
wantErr: false,
432+
},
433+
{
434+
name: "accepts CP ingress rules with source security group id and role",
435+
cluster: &AWSCluster{
436+
Spec: AWSClusterSpec{
437+
NetworkSpec: NetworkSpec{
438+
AdditionalControlPlaneIngressRules: []IngressRule{
439+
{
440+
Protocol: SecurityGroupProtocolTCP,
441+
SourceSecurityGroupIDs: []string{"test"},
442+
SourceSecurityGroupRoles: []SecurityGroupRole{SecurityGroupBastion},
443+
},
444+
},
445+
},
446+
},
447+
},
448+
wantErr: false,
449+
},
365450
}
366451
for _, tt := range tests {
367452
t.Run(tt.name, func(t *testing.T) {

‎api/v1beta2/network_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,10 @@ type NetworkSpec struct {
240240
// This is optional - if not provided new security groups will be created for the cluster
241241
// +optional
242242
SecurityGroupOverrides map[SecurityGroupRole]string `json:"securityGroupOverrides,omitempty"`
243+
244+
// AdditionalControlPlaneIngressRules is an optional set of ingress rules to add to the control plane
245+
// +optional
246+
AdditionalControlPlaneIngressRules []IngressRule `json:"additionalControlPlaneIngressRules,omitempty"`
243247
}
244248

245249
// IPv6 contains ipv6 specific settings for the network.

‎api/v1beta2/zz_generated.deepcopy.go

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,78 @@ spec:
357357
network:
358358
description: NetworkSpec encapsulates all things related to AWS network.
359359
properties:
360+
additionalControlPlaneIngressRules:
361+
description: AdditionalControlPlaneIngressRules is an optional
362+
set of ingress rules to add to the control plane
363+
items:
364+
description: IngressRule defines an AWS ingress rule for security
365+
groups.
366+
properties:
367+
cidrBlocks:
368+
description: List of CIDR blocks to allow access from. Cannot
369+
be specified with SourceSecurityGroupID.
370+
items:
371+
type: string
372+
type: array
373+
description:
374+
description: Description provides extended information about
375+
the ingress rule.
376+
type: string
377+
fromPort:
378+
description: FromPort is the start of port range.
379+
format: int64
380+
type: integer
381+
ipv6CidrBlocks:
382+
description: List of IPv6 CIDR blocks to allow access from.
383+
Cannot be specified with SourceSecurityGroupID.
384+
items:
385+
type: string
386+
type: array
387+
protocol:
388+
description: Protocol is the protocol for the ingress rule.
389+
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
390+
"udp", "icmp", and "58" (ICMPv6).
391+
enum:
392+
- "-1"
393+
- "4"
394+
- tcp
395+
- udp
396+
- icmp
397+
- "58"
398+
type: string
399+
sourceSecurityGroupIds:
400+
description: The security group id to allow access from.
401+
Cannot be specified with CidrBlocks.
402+
items:
403+
type: string
404+
type: array
405+
sourceSecurityGroupRoles:
406+
description: The security group role to allow access from.
407+
Cannot be specified with CidrBlocks. The field will be
408+
combined with source security group IDs if specified.
409+
items:
410+
description: SecurityGroupRole defines the unique role
411+
of a security group.
412+
enum:
413+
- bastion
414+
- node
415+
- controlplane
416+
- apiserver-lb
417+
- lb
418+
- node-eks-additional
419+
type: string
420+
type: array
421+
toPort:
422+
description: ToPort is the end of port range.
423+
format: int64
424+
type: integer
425+
required:
426+
- description
427+
- fromPort
428+
- protocol
429+
- toPort
430+
type: object
431+
type: array
360432
cni:
361433
description: CNI configuration
362434
properties:
@@ -1852,6 +1924,78 @@ spec:
18521924
network:
18531925
description: NetworkSpec encapsulates all things related to AWS network.
18541926
properties:
1927+
additionalControlPlaneIngressRules:
1928+
description: AdditionalControlPlaneIngressRules is an optional
1929+
set of ingress rules to add to the control plane
1930+
items:
1931+
description: IngressRule defines an AWS ingress rule for security
1932+
groups.
1933+
properties:
1934+
cidrBlocks:
1935+
description: List of CIDR blocks to allow access from. Cannot
1936+
be specified with SourceSecurityGroupID.
1937+
items:
1938+
type: string
1939+
type: array
1940+
description:
1941+
description: Description provides extended information about
1942+
the ingress rule.
1943+
type: string
1944+
fromPort:
1945+
description: FromPort is the start of port range.
1946+
format: int64
1947+
type: integer
1948+
ipv6CidrBlocks:
1949+
description: List of IPv6 CIDR blocks to allow access from.
1950+
Cannot be specified with SourceSecurityGroupID.
1951+
items:
1952+
type: string
1953+
type: array
1954+
protocol:
1955+
description: Protocol is the protocol for the ingress rule.
1956+
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
1957+
"udp", "icmp", and "58" (ICMPv6).
1958+
enum:
1959+
- "-1"
1960+
- "4"
1961+
- tcp
1962+
- udp
1963+
- icmp
1964+
- "58"
1965+
type: string
1966+
sourceSecurityGroupIds:
1967+
description: The security group id to allow access from.
1968+
Cannot be specified with CidrBlocks.
1969+
items:
1970+
type: string
1971+
type: array
1972+
sourceSecurityGroupRoles:
1973+
description: The security group role to allow access from.
1974+
Cannot be specified with CidrBlocks. The field will be
1975+
combined with source security group IDs if specified.
1976+
items:
1977+
description: SecurityGroupRole defines the unique role
1978+
of a security group.
1979+
enum:
1980+
- bastion
1981+
- node
1982+
- controlplane
1983+
- apiserver-lb
1984+
- lb
1985+
- node-eks-additional
1986+
type: string
1987+
type: array
1988+
toPort:
1989+
description: ToPort is the end of port range.
1990+
format: int64
1991+
type: integer
1992+
required:
1993+
- description
1994+
- fromPort
1995+
- protocol
1996+
- toPort
1997+
type: object
1998+
type: array
18551999
cni:
18562000
description: CNI configuration
18572001
properties:

0 commit comments

Comments
 (0)