Skip to content

Commit f99a356

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4898 from AndiDog/secondary-vpc-cidr
✨ Support adding custom secondary VPC CIDR blocks in `AWSCluster`
2 parents f97d237 + 05d6299 commit f99a356

36 files changed

+516
-94
lines changed

‎api/v1beta1/awscluster_conversion.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ func (src *AWSCluster) ConvertTo(dstRaw conversion.Hub) error {
106106
dst.Spec.NetworkSpec.VPC.PrivateDNSHostnameTypeOnLaunch = restored.Spec.NetworkSpec.VPC.PrivateDNSHostnameTypeOnLaunch
107107
dst.Spec.NetworkSpec.VPC.CarrierGatewayID = restored.Spec.NetworkSpec.VPC.CarrierGatewayID
108108
dst.Spec.NetworkSpec.VPC.SubnetSchema = restored.Spec.NetworkSpec.VPC.SubnetSchema
109+
dst.Spec.NetworkSpec.VPC.SecondaryCidrBlocks = restored.Spec.NetworkSpec.VPC.SecondaryCidrBlocks
109110

110111
if restored.Spec.NetworkSpec.VPC.ElasticIPPool != nil {
111112
if dst.Spec.NetworkSpec.VPC.ElasticIPPool == nil {

‎api/v1beta1/zz_generated.conversion.go

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_webhook.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,14 @@ func (r *AWSCluster) validateNetwork() field.ErrorList {
283283
}
284284
}
285285

286+
secondaryCidrBlocks := r.Spec.NetworkSpec.VPC.SecondaryCidrBlocks
287+
secondaryCidrBlocksField := field.NewPath("spec", "network", "vpc", "secondaryCidrBlocks")
288+
for _, cidrBlock := range secondaryCidrBlocks {
289+
if r.Spec.NetworkSpec.VPC.CidrBlock != "" && r.Spec.NetworkSpec.VPC.CidrBlock == cidrBlock.IPv4CidrBlock {
290+
allErrs = append(allErrs, field.Invalid(secondaryCidrBlocksField, secondaryCidrBlocks, fmt.Sprintf("AWSCluster.spec.network.vpc.secondaryCidrBlocks must not contain the primary AWSCluster.spec.network.vpc.cidrBlock %v", r.Spec.NetworkSpec.VPC.CidrBlock)))
291+
}
292+
}
293+
286294
return allErrs
287295
}
288296

‎api/v1beta2/network_types.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,13 @@ type IPAMPool struct {
388388
NetmaskLength int64 `json:"netmaskLength,omitempty"`
389389
}
390390

391+
// VpcCidrBlock defines the CIDR block and settings to associate with the managed VPC. Currently, only IPv4 is supported.
392+
type VpcCidrBlock struct {
393+
// IPv4CidrBlock is the IPv4 CIDR block to associate with the managed VPC.
394+
// +kubebuilder:validation:MinLength=1
395+
IPv4CidrBlock string `json:"ipv4CidrBlock"`
396+
}
397+
391398
// VPCSpec configures an AWS VPC.
392399
type VPCSpec struct {
393400
// ID is the vpc-id of the VPC this provider should use to create resources.
@@ -398,6 +405,12 @@ type VPCSpec struct {
398405
// Mutually exclusive with IPAMPool.
399406
CidrBlock string `json:"cidrBlock,omitempty"`
400407

408+
// SecondaryCidrBlocks are additional CIDR blocks to be associated when the provider creates a managed VPC.
409+
// Defaults to none. Mutually exclusive with IPAMPool. This makes sense to use if, for example, you want to use
410+
// a separate IP range for pods (e.g. Cilium ENI mode).
411+
// +optional
412+
SecondaryCidrBlocks []VpcCidrBlock `json:"secondaryCidrBlocks,omitempty"`
413+
401414
// IPAMPool defines the IPAMv4 pool to be used for VPC.
402415
// Mutually exclusive with CidrBlock.
403416
IPAMPool *IPAMPool `json:"ipamPool,omitempty"`

‎api/v1beta2/zz_generated.deepcopy.go

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/clusterawsadm/cloudformation/bootstrap/cluster_api_controller.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ func (t Template) ControllersPolicy() *iamv1.PolicyDocument {
9090
"ec2:AssignPrivateIpAddresses",
9191
"ec2:UnassignPrivateIpAddresses",
9292
"ec2:AssociateRouteTable",
93+
"ec2:AssociateVpcCidrBlock",
9394
"ec2:AttachInternetGateway",
9495
"ec2:AuthorizeSecurityGroupIngress",
9596
"ec2:CreateCarrierGateway",
@@ -104,6 +105,7 @@ func (t Template) ControllersPolicy() *iamv1.PolicyDocument {
104105
"ec2:CreateTags",
105106
"ec2:CreateVpc",
106107
"ec2:CreateVpcEndpoint",
108+
"ec2:DisassociateVpcCidrBlock",
107109
"ec2:ModifyVpcAttribute",
108110
"ec2:ModifyVpcEndpoint",
109111
"ec2:DeleteCarrierGateway",

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/customsuffix.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/default.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_all_secret_backends.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ Resources:
155155
- ec2:AssignPrivateIpAddresses
156156
- ec2:UnassignPrivateIpAddresses
157157
- ec2:AssociateRouteTable
158+
- ec2:AssociateVpcCidrBlock
158159
- ec2:AttachInternetGateway
159160
- ec2:AuthorizeSecurityGroupIngress
160161
- ec2:CreateCarrierGateway
@@ -169,6 +170,7 @@ Resources:
169170
- ec2:CreateTags
170171
- ec2:CreateVpc
171172
- ec2:CreateVpcEndpoint
173+
- ec2:DisassociateVpcCidrBlock
172174
- ec2:ModifyVpcAttribute
173175
- ec2:ModifyVpcEndpoint
174176
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_allow_assume_role.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

0 commit comments

Comments
 (0)