@@ -160,10 +160,12 @@ func (s *Service) ReconcileSecurityGroups() error {
160
160
}
161
161
current := sg .IngressRules
162
162
163
- want , err := s .getSecurityGroupIngressRules (role )
163
+ specRules , err := s .getSecurityGroupIngressRules (role )
164
164
if err != nil {
165
165
return err
166
166
}
167
+ // Duplicate rules with multiple cidr blocks/source security groups so that we are comparing similar sets.
168
+ want := expandIngressRules (specRules )
167
169
168
170
toRevoke := current .Difference (want )
169
171
if len (toRevoke ) > 0 {
@@ -197,6 +199,47 @@ func (s *Service) ReconcileSecurityGroups() error {
197
199
return nil
198
200
}
199
201
202
+ // expandIngressRules expand the given ingress rules so that it's compatible with the list generated by
203
+ // ingressRulesFromSDKType.
204
+ // We assume that processIngressRulesSGs has been already called on the input, so the SourceSecurityGroupRoles have
205
+ // been translated into Security Group IDs.
206
+ func expandIngressRules (rules infrav1.IngressRules ) infrav1.IngressRules {
207
+ res := make (infrav1.IngressRules , 0 , len (rules ))
208
+ for _ , rule := range rules {
209
+ base := infrav1.IngressRule {
210
+ Description : rule .Description ,
211
+ Protocol : rule .Protocol ,
212
+ FromPort : rule .FromPort ,
213
+ ToPort : rule .ToPort ,
214
+ }
215
+
216
+ // Nothing to expand
217
+ if len (rule .CidrBlocks ) == 0 && len (rule .IPv6CidrBlocks ) == 0 && len (rule .SourceSecurityGroupIDs ) == 0 {
218
+ res = append (res , base )
219
+ continue
220
+ }
221
+
222
+ for _ , src := range rule .CidrBlocks {
223
+ rcopy := base
224
+ rcopy .CidrBlocks = []string {src }
225
+ res = append (res , rcopy )
226
+ }
227
+
228
+ for _ , src := range rule .IPv6CidrBlocks {
229
+ rcopy := base
230
+ rcopy .IPv6CidrBlocks = []string {src }
231
+ res = append (res , rcopy )
232
+ }
233
+
234
+ for _ , src := range rule .SourceSecurityGroupIDs {
235
+ rcopy := base
236
+ rcopy .SourceSecurityGroupIDs = []string {src }
237
+ res = append (res , rcopy )
238
+ }
239
+ }
240
+ return res
241
+ }
242
+
200
243
func (s * Service ) securityGroupIsAnOverride (securityGroupID string ) bool {
201
244
for _ , overrideID := range s .scope .SecurityGroupOverrides () {
202
245
if overrideID == securityGroupID {
0 commit comments