Skip to content

Commit fdc8bf8

Browse files
tthvotthvo
committed
securitygroup: allow configuring IPv6 source CIDRs for bastion SSH
We need an option to configure IPv6 source CIDRs for SSH ingress rule of the bastion host. This extends the field allowedCIDRBlocks to also accepts IPv6 CIDR blocks.
1 parent 390d216 commit fdc8bf8

10 files changed

+28
-13
lines changed

‎api/v1beta1/zz_generated.conversion.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_types.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,8 +152,9 @@ type Bastion struct {
152152

153153
// AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
154154
// They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
155+
// If the cluster has IPv6 enabled, defaults to ::/0 and 0.0.0.0/0.
155156
// +optional
156-
AllowedCIDRBlocks []string `json:"allowedCIDRBlocks,omitempty"`
157+
AllowedCIDRBlocks CidrBlocks `json:"allowedCIDRBlocks,omitempty"`
157158

158159
// InstanceType will use the specified instance type for the bastion. If not specified,
159160
// Cluster API Provider AWS will use t3.micro for all regions except us-east-1, where t2.micro

‎api/v1beta2/awscluster_webhook_test.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1353,6 +1353,7 @@ func TestAWSClusterValidateAllowedCIDRBlocks(t *testing.T) {
13531353
AllowedCIDRBlocks: []string{
13541354
"192.168.0.0/16",
13551355
"192.168.0.1/32",
1356+
"2001:1234:5678:9a40::/56",
13561357
},
13571358
},
13581359
},
@@ -1379,6 +1380,7 @@ func TestAWSClusterValidateAllowedCIDRBlocks(t *testing.T) {
13791380
AllowedCIDRBlocks: []string{
13801381
"192.168.0.0/16",
13811382
"192.168.0.1/32",
1383+
"2001:1234:5678:9a40::/56",
13821384
},
13831385
DisableIngressRules: true,
13841386
},
@@ -1393,6 +1395,7 @@ func TestAWSClusterValidateAllowedCIDRBlocks(t *testing.T) {
13931395
Bastion: Bastion{
13941396
AllowedCIDRBlocks: []string{
13951397
"100.200.300.400/99",
1398+
"2001:1234:5678:9a40::/129",
13961399
},
13971400
},
13981401
},
@@ -1445,6 +1448,7 @@ func TestAWSClusterDefaultAllowedCIDRBlocks(t *testing.T) {
14451448
Bastion: Bastion{
14461449
AllowedCIDRBlocks: []string{
14471450
"0.0.0.0/0",
1451+
"::/0",
14481452
},
14491453
},
14501454
},
@@ -1455,7 +1459,7 @@ func TestAWSClusterDefaultAllowedCIDRBlocks(t *testing.T) {
14551459
beforeCluster: &AWSCluster{
14561460
Spec: AWSClusterSpec{
14571461
Bastion: Bastion{
1458-
AllowedCIDRBlocks: []string{"0.0.0.0/0"},
1462+
AllowedCIDRBlocks: []string{"0.0.0.0/0", "::/0"},
14591463
DisableIngressRules: true,
14601464
Enabled: true,
14611465
},

‎api/v1beta2/defaults.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ import (
2626
func SetDefaults_Bastion(obj *Bastion) { //nolint:golint,stylecheck
2727
// Default to allow open access to the bastion host if no CIDR Blocks have been set
2828
if len(obj.AllowedCIDRBlocks) == 0 && !obj.DisableIngressRules {
29-
obj.AllowedCIDRBlocks = []string{"0.0.0.0/0"}
29+
obj.AllowedCIDRBlocks = []string{"0.0.0.0/0", "::/0"}
3030
}
3131
}
3232

‎api/v1beta2/zz_generated.deepcopy.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ spec:
121121
description: |-
122122
AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
123123
They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
124+
If the cluster has IPv6 enabled, defaults to ::/0 and 0.0.0.0/0.
124125
items:
125126
type: string
126127
type: array
@@ -2271,6 +2272,7 @@ spec:
22712272
description: |-
22722273
AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
22732274
They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
2275+
If the cluster has IPv6 enabled, defaults to ::/0 and 0.0.0.0/0.
22742276
items:
22752277
type: string
22762278
type: array

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -946,6 +946,7 @@ spec:
946946
description: |-
947947
AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
948948
They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
949+
If the cluster has IPv6 enabled, defaults to ::/0 and 0.0.0.0/0.
949950
items:
950951
type: string
951952
type: array

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -524,6 +524,7 @@ spec:
524524
description: |-
525525
AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
526526
They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
527+
If the cluster has IPv6 enabled, defaults to ::/0 and 0.0.0.0/0.
527528
items:
528529
type: string
529530
type: array

‎controlplane/eks/api/v1beta2/awsmanagedcontrolplane_webhook_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ var (
3939

4040
func TestDefaultingWebhook(t *testing.T) {
4141
defaultTestBastion := infrav1.Bastion{
42-
AllowedCIDRBlocks: []string{"0.0.0.0/0"},
42+
AllowedCIDRBlocks: []string{"0.0.0.0/0", "::/0"},
4343
}
4444
AZUsageLimit := 3
4545
defaultVPCSpec := infrav1.VPCSpec{
@@ -147,14 +147,14 @@ func TestDefaultingWebhook(t *testing.T) {
147147
expectHash: false,
148148
spec: AWSManagedControlPlaneSpec{
149149
Bastion: infrav1.Bastion{
150-
AllowedCIDRBlocks: []string{"100.100.100.100/0"},
150+
AllowedCIDRBlocks: []string{"100.100.100.100/0", "2001:1234:5678:9a40::/56"},
151151
},
152152
},
153153
expectSpec: AWSManagedControlPlaneSpec{
154154
EKSClusterName: "default_cluster1",
155155
IdentityRef: defaultIdentityRef,
156156
Bastion: infrav1.Bastion{
157-
AllowedCIDRBlocks: []string{"100.100.100.100/0"},
157+
AllowedCIDRBlocks: []string{"100.100.100.100/0", "2001:1234:5678:9a40::/56"},
158158
},
159159
NetworkSpec: defaultNetworkSpec,
160160
TokenMethod: &EKSTokenMethodIAMAuthenticator,

‎pkg/cloud/services/securitygroup/securitygroups.go

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -596,13 +596,19 @@ func (s *Service) getSecurityGroupIngressRules(role infrav1.SecurityGroupRole) (
596596
}
597597
switch role {
598598
case infrav1.SecurityGroupBastion:
599+
ipv4CidrBlocks := s.scope.Bastion().AllowedCIDRBlocks.IPv4CidrBlocks()
600+
var ipv6CidrBlocks []string
601+
if s.scope.VPC().IsIPv6Enabled() {
602+
ipv6CidrBlocks = s.scope.Bastion().AllowedCIDRBlocks.IPv6CidrBlocks()
603+
}
599604
return infrav1.IngressRules{
600605
{
601-
Description: "SSH",
602-
Protocol: infrav1.SecurityGroupProtocolTCP,
603-
FromPort: 22,
604-
ToPort: 22,
605-
CidrBlocks: s.scope.Bastion().AllowedCIDRBlocks,
606+
Description: "SSH",
607+
Protocol: infrav1.SecurityGroupProtocolTCP,
608+
FromPort: 22,
609+
ToPort: 22,
610+
CidrBlocks: ipv4CidrBlocks,
611+
IPv6CidrBlocks: ipv6CidrBlocks,
606612
},
607613
}, nil
608614
case infrav1.SecurityGroupControlPlane:

0 commit comments

Comments
 (0)