Skip to content

Commit d26358f

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4508 from giantswarm/fix-natgateway-status
Save Nat Gateways IPs to status on every reconciliation
2 parents 526cedf + c27e4fd commit d26358f

File tree

3 files changed

+95
-55
lines changed

3 files changed

+95
-55
lines changed

‎pkg/cloud/services/network/natgateways.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ func (s *Service) reconcileNatGateways() error {
6969
return err
7070
}
7171

72+
natGatewaysIPs := []string{}
7273
subnetIDs := []string{}
7374

7475
for _, sn := range s.scope.Subnets().FilterPublic() {
@@ -77,6 +78,9 @@ func (s *Service) reconcileNatGateways() error {
7778
}
7879

7980
if ngw, ok := existing[sn.ID]; ok {
81+
if len(ngw.NatGatewayAddresses) > 0 && ngw.NatGatewayAddresses[0].PublicIp != nil {
82+
natGatewaysIPs = append(natGatewaysIPs, *ngw.NatGatewayAddresses[0].PublicIp)
83+
}
8084
// Make sure tags are up to date.
8185
if err := wait.WaitForWithRetryable(wait.NewBackoff(), func() (bool, error) {
8286
buildParams := s.getNatGatewayTagParams(*ngw.NatGatewayId)
@@ -96,6 +100,8 @@ func (s *Service) reconcileNatGateways() error {
96100
subnetIDs = append(subnetIDs, sn.ID)
97101
}
98102

103+
s.scope.SetNatGatewaysIPs(natGatewaysIPs)
104+
99105
// Batch the creation of NAT gateways
100106
if len(subnetIDs) > 0 {
101107
// set NatGatewayCreationStarted if the condition has never been set before
@@ -106,18 +112,12 @@ func (s *Service) reconcileNatGateways() error {
106112
}
107113
}
108114
ngws, err := s.createNatGateways(subnetIDs)
109-
var natGatewaysIPs []string
110115

111116
for _, ng := range ngws {
112117
subnet := s.scope.Subnets().FindByID(*ng.SubnetId)
113118
subnet.NatGatewayID = ng.NatGatewayId
114-
if len(ng.NatGatewayAddresses) > 0 && ng.NatGatewayAddresses[0].PublicIp != nil {
115-
natGatewaysIPs = append(natGatewaysIPs, *ng.NatGatewayAddresses[0].PublicIp)
116-
}
117119
}
118120

119-
s.scope.SetNatGatewaysIPs(natGatewaysIPs)
120-
121121
if err != nil {
122122
return err
123123
}

‎pkg/cloud/services/securitygroup/securitygroups.go

Lines changed: 45 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -728,68 +728,63 @@ func ingressRuleToSDKType(scope scope.SGScope, i *infrav1.IngressRule) (res *ec2
728728
}
729729

730730
func ingressRulesFromSDKType(v *ec2.IpPermission) (res infrav1.IngressRules) {
731+
for _, ec2range := range v.IpRanges {
732+
rule := ingressRuleFromSDKProtocol(v)
733+
if ec2range.Description != nil && *ec2range.Description != "" {
734+
rule.Description = *ec2range.Description
735+
}
736+
737+
rule.CidrBlocks = []string{*ec2range.CidrIp}
738+
res = append(res, rule)
739+
}
740+
741+
for _, ec2range := range v.Ipv6Ranges {
742+
rule := ingressRuleFromSDKProtocol(v)
743+
if ec2range.Description != nil && *ec2range.Description != "" {
744+
rule.Description = *ec2range.Description
745+
}
746+
747+
rule.IPv6CidrBlocks = []string{*ec2range.CidrIpv6}
748+
res = append(res, rule)
749+
}
750+
751+
for _, pair := range v.UserIdGroupPairs {
752+
rule := ingressRuleFromSDKProtocol(v)
753+
if pair.GroupId == nil {
754+
continue
755+
}
756+
757+
if pair.Description != nil && *pair.Description != "" {
758+
rule.Description = *pair.Description
759+
}
760+
761+
rule.SourceSecurityGroupIDs = []string{*pair.GroupId}
762+
res = append(res, rule)
763+
}
764+
765+
return res
766+
}
767+
768+
func ingressRuleFromSDKProtocol(v *ec2.IpPermission) infrav1.IngressRule {
731769
// Ports are only well-defined for TCP and UDP protocols, but EC2 overloads the port range
732770
// in the case of ICMP(v6) traffic to indicate which codes are allowed. For all other protocols,
733771
// including the custom "-1" All Traffic protocol, FromPort and ToPort are omitted from the response.
734772
// See: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html
735-
var ir infrav1.IngressRule
736773
switch *v.IpProtocol {
737774
case IPProtocolTCP,
738775
IPProtocolUDP,
739776
IPProtocolICMP,
740777
IPProtocolICMPv6:
741-
ir = infrav1.IngressRule{
778+
return infrav1.IngressRule{
742779
Protocol: infrav1.SecurityGroupProtocol(*v.IpProtocol),
743780
FromPort: *v.FromPort,
744781
ToPort: *v.ToPort,
745782
}
746783
default:
747-
ir = infrav1.IngressRule{
784+
return infrav1.IngressRule{
748785
Protocol: infrav1.SecurityGroupProtocol(*v.IpProtocol),
749786
}
750787
}
751-
752-
if len(v.IpRanges) > 0 {
753-
r1 := ir
754-
for _, ec2range := range v.IpRanges {
755-
if ec2range.Description != nil && *ec2range.Description != "" {
756-
r1.Description = *ec2range.Description
757-
}
758-
759-
r1.CidrBlocks = append(r1.CidrBlocks, *ec2range.CidrIp)
760-
}
761-
res = append(res, r1)
762-
}
763-
764-
if len(v.Ipv6Ranges) > 0 {
765-
r1 := ir
766-
for _, ec2range := range v.Ipv6Ranges {
767-
if ec2range.Description != nil && *ec2range.Description != "" {
768-
r1.Description = *ec2range.Description
769-
}
770-
771-
r1.IPv6CidrBlocks = append(r1.IPv6CidrBlocks, *ec2range.CidrIpv6)
772-
}
773-
res = append(res, r1)
774-
}
775-
776-
if len(v.UserIdGroupPairs) > 0 {
777-
r2 := ir
778-
for _, pair := range v.UserIdGroupPairs {
779-
if pair.GroupId == nil {
780-
continue
781-
}
782-
783-
if pair.Description != nil && *pair.Description != "" {
784-
r2.Description = *pair.Description
785-
}
786-
787-
r2.SourceSecurityGroupIDs = append(r2.SourceSecurityGroupIDs, *pair.GroupId)
788-
}
789-
res = append(res, r2)
790-
}
791-
792-
return res
793788
}
794789

795790
// getIngressRulesToAllowKubeletToAccessTheControlPlaneLB returns ingress rules required in the control plane LB.
@@ -800,15 +795,19 @@ func (s *Service) getIngressRulesToAllowKubeletToAccessTheControlPlaneLB() infra
800795
return s.getIngressRuleToAllowVPCCidrInTheAPIServer()
801796
}
802797

798+
natGatewaysCidrs := []string{}
803799
natGatewaysIPs := s.scope.GetNatGatewaysIPs()
800+
for _, ip := range natGatewaysIPs {
801+
natGatewaysCidrs = append(natGatewaysCidrs, fmt.Sprintf("%s/32", ip))
802+
}
804803
if len(natGatewaysIPs) > 0 {
805804
return infrav1.IngressRules{
806805
{
807806
Description: "Kubernetes API",
808807
Protocol: infrav1.SecurityGroupProtocolTCP,
809808
FromPort: int64(s.scope.APIServerPort()),
810809
ToPort: int64(s.scope.APIServerPort()),
811-
CidrBlocks: natGatewaysIPs,
810+
CidrBlocks: natGatewaysCidrs,
812811
},
813812
}
814813
}

‎pkg/cloud/services/securitygroup/securitygroups_test.go

Lines changed: 44 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -871,7 +871,7 @@ func TestControlPlaneLoadBalancerIngressRules(t *testing.T) {
871871
Protocol: infrav1.SecurityGroupProtocolTCP,
872872
FromPort: 6443,
873873
ToPort: 6443,
874-
CidrBlocks: []string{"1.2.3.4"},
874+
CidrBlocks: []string{"1.2.3.4/32"},
875875
},
876876
infrav1.IngressRule{
877877
Description: "Kubernetes API",
@@ -915,7 +915,7 @@ func TestControlPlaneLoadBalancerIngressRules(t *testing.T) {
915915
Protocol: infrav1.SecurityGroupProtocolTCP,
916916
FromPort: 6443,
917917
ToPort: 6443,
918-
CidrBlocks: []string{"1.2.3.4"},
918+
CidrBlocks: []string{"1.2.3.4/32"},
919919
},
920920
infrav1.IngressRule{
921921
Description: "My custom ingress rule",
@@ -1250,6 +1250,40 @@ func TestIngressRulesFromSDKType(t *testing.T) {
12501250
input *ec2.IpPermission
12511251
expected infrav1.IngressRules
12521252
}{
1253+
{
1254+
name: "two ingress rules",
1255+
input: &ec2.IpPermission{
1256+
IpProtocol: aws.String("tcp"),
1257+
FromPort: aws.Int64(6443),
1258+
ToPort: aws.Int64(6443),
1259+
IpRanges: []*ec2.IpRange{
1260+
{
1261+
CidrIp: aws.String("0.0.0.0/0"),
1262+
Description: aws.String("Kubernetes API"),
1263+
},
1264+
{
1265+
CidrIp: aws.String("192.168.1.1/32"),
1266+
Description: aws.String("My VPN"),
1267+
},
1268+
},
1269+
},
1270+
expected: infrav1.IngressRules{
1271+
{
1272+
Description: "Kubernetes API",
1273+
Protocol: "tcp",
1274+
FromPort: 6443,
1275+
ToPort: 6443,
1276+
CidrBlocks: []string{"0.0.0.0/0"},
1277+
},
1278+
{
1279+
Description: "My VPN",
1280+
Protocol: "tcp",
1281+
FromPort: 6443,
1282+
ToPort: 6443,
1283+
CidrBlocks: []string{"192.168.1.1/32"},
1284+
},
1285+
},
1286+
},
12531287
{
12541288
name: "Two group pairs",
12551289
input: &ec2.IpPermission{
@@ -1275,7 +1309,14 @@ func TestIngressRulesFromSDKType(t *testing.T) {
12751309
Protocol: "tcp",
12761310
FromPort: 10250,
12771311
ToPort: 10250,
1278-
SourceSecurityGroupIDs: []string{"sg-source-1", "sg-source-2"},
1312+
SourceSecurityGroupIDs: []string{"sg-source-1"},
1313+
},
1314+
{
1315+
Description: "Kubelet API",
1316+
Protocol: "tcp",
1317+
FromPort: 10250,
1318+
ToPort: 10250,
1319+
SourceSecurityGroupIDs: []string{"sg-source-2"},
12791320
},
12801321
},
12811322
},

0 commit comments

Comments
 (0)