Skip to content

Commit 4ff53b9

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #5274 from nawazkh/make_private_lb_ip_configurable
make Private IP of the internal LB of the API Server configurable
2 parents 630e39c + 2a44ea8 commit 4ff53b9

File tree

6 files changed

+248
-79
lines changed

6 files changed

+248
-79
lines changed

‎api/v1beta1/azurecluster_default.go

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -232,17 +232,31 @@ func (c *AzureCluster) setAPIServerLBDefaults() {
232232
if lb.Name == "" {
233233
lb.Name = generateInternalLBName(c.ObjectMeta.Name)
234234
}
235-
if len(lb.FrontendIPs) == 0 {
236-
lb.FrontendIPs = []FrontendIP{
237-
{
238-
Name: generateFrontendIPConfigName(lb.Name),
239-
FrontendIPClass: FrontendIPClass{
240-
PrivateIPAddress: DefaultInternalLBIPAddress,
241-
},
242-
},
235+
}
236+
237+
// create default private IP if not set
238+
privateIPFound := false
239+
for i := range lb.FrontendIPs {
240+
if lb.FrontendIPs[i].FrontendIPClass.PrivateIPAddress != "" {
241+
if lb.FrontendIPs[i].Name == "" {
242+
lb.FrontendIPs[i].Name = generateFrontendIPConfigName(lb.Name) + "-internal-ip"
243243
}
244+
privateIPFound = true
245+
break
246+
}
247+
}
248+
249+
// if no private IP found, create a default one
250+
if !privateIPFound {
251+
privateIP := FrontendIP{
252+
Name: generateFrontendIPConfigName(lb.Name) + "-internal-ip",
253+
FrontendIPClass: FrontendIPClass{
254+
PrivateIPAddress: DefaultInternalLBIPAddress,
255+
},
244256
}
257+
lb.FrontendIPs = append(lb.FrontendIPs, privateIP)
245258
}
259+
246260
c.SetAPIServerLBBackendPoolNameDefault()
247261
}
248262

‎api/v1beta1/azurecluster_default_test.go

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,9 @@ func TestVnetDefaults(t *testing.T) {
106106
Subnets: Subnets{
107107
{
108108
SubnetClassSpec: SubnetClassSpec{
109-
Role: SubnetControlPlane,
110-
Name: "control-plane-subnet",
109+
Role: SubnetControlPlane,
110+
Name: "control-plane-subnet",
111+
CIDRBlocks: []string{DefaultControlPlaneSubnetCIDR},
111112
},
112113

113114
SecurityGroup: SecurityGroup{},
@@ -132,6 +133,12 @@ func TestVnetDefaults(t *testing.T) {
132133
DNSName: "myfqdn.azure.com",
133134
},
134135
},
136+
{
137+
Name: "ip-config-internal-ip",
138+
FrontendIPClass: FrontendIPClass{
139+
PrivateIPAddress: DefaultInternalLBIPAddress,
140+
},
141+
},
135142
},
136143
LoadBalancerClassSpec: LoadBalancerClassSpec{
137144
SKU: SKUStandard,
@@ -1237,6 +1244,12 @@ func TestAPIServerLBDefaults(t *testing.T) {
12371244
DNSName: "",
12381245
},
12391246
},
1247+
{
1248+
Name: "cluster-test-public-lb-frontEnd-internal-ip",
1249+
FrontendIPClass: FrontendIPClass{
1250+
PrivateIPAddress: DefaultInternalLBIPAddress,
1251+
},
1252+
},
12401253
},
12411254
BackendPool: BackendPool{
12421255
Name: "cluster-test-public-lb-backendPool",
@@ -1276,7 +1289,7 @@ func TestAPIServerLBDefaults(t *testing.T) {
12761289
APIServerLB: LoadBalancerSpec{
12771290
FrontendIPs: []FrontendIP{
12781291
{
1279-
Name: "cluster-test-internal-lb-frontEnd",
1292+
Name: "cluster-test-internal-lb-frontEnd-internal-ip",
12801293
FrontendIPClass: FrontendIPClass{
12811294
PrivateIPAddress: DefaultInternalLBIPAddress,
12821295
},
@@ -1324,7 +1337,7 @@ func TestAPIServerLBDefaults(t *testing.T) {
13241337
APIServerLB: LoadBalancerSpec{
13251338
FrontendIPs: []FrontendIP{
13261339
{
1327-
Name: "cluster-test-internal-lb-frontEnd",
1340+
Name: "cluster-test-internal-lb-frontEnd-internal-ip",
13281341
FrontendIPClass: FrontendIPClass{
13291342
PrivateIPAddress: DefaultInternalLBIPAddress,
13301343
},

‎api/v1beta1/azurecluster_validation.go

Lines changed: 44 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -400,33 +400,58 @@ func validateAPIServerLB(lb LoadBalancerSpec, old LoadBalancerSpec, cidrs []stri
400400
allErrs = append(allErrs, field.Forbidden(fldPath.Child("name"), "API Server load balancer name should not be modified after AzureCluster creation."))
401401
}
402402

403-
// There should only be one IP config.
404-
if len(lb.FrontendIPs) != 1 || ptr.Deref[int32](lb.FrontendIPsCount, 1) != 1 {
403+
publicIPCount := 0
404+
privateIPCount := 0
405+
newPrivateIP := ""
406+
for i := range lb.FrontendIPs {
407+
if lb.FrontendIPs[i].PublicIP != nil {
408+
publicIPCount++
409+
}
410+
if lb.FrontendIPs[i].PrivateIPAddress != "" {
411+
privateIPCount++
412+
newPrivateIP = lb.FrontendIPs[i].PrivateIPAddress
413+
}
414+
}
415+
416+
if lb.Type == Public {
417+
// public IP count should be 1 for public LB.
418+
if publicIPCount != 1 || ptr.Deref[int32](lb.FrontendIPsCount, 1) != 1 {
419+
allErrs = append(allErrs, field.Invalid(fldPath.Child("frontendIPConfigs"), lb.FrontendIPs,
420+
"API Server Load balancer should have 1 Frontend IP"))
421+
}
422+
}
423+
424+
// if Internal, IP config should not have a public IP.
425+
if lb.Type == Internal {
426+
if publicIPCount != 0 {
427+
allErrs = append(allErrs, field.Forbidden(fldPath.Child("frontendIPConfigs").Index(0).Child("publicIP"),
428+
"API Server's associated internal load balancer cannot have a Public IP"))
429+
}
430+
}
431+
432+
// private IP count should be 1 for public LB.
433+
if privateIPCount != 1 {
405434
allErrs = append(allErrs, field.Invalid(fldPath.Child("frontendIPConfigs"), lb.FrontendIPs,
406-
"API Server Load balancer should have 1 Frontend IP"))
435+
"API Server Load balancer should have 1 private IP"))
407436
} else {
408-
// if Internal, IP config should not have a public IP.
409-
if lb.Type == Internal {
410-
if lb.FrontendIPs[0].PublicIP != nil {
411-
allErrs = append(allErrs, field.Forbidden(fldPath.Child("frontendIPConfigs").Index(0).Child("publicIP"),
412-
"Internal Load Balancers cannot have a Public IP"))
413-
}
414-
if lb.FrontendIPs[0].PrivateIPAddress != "" {
415-
if err := validateInternalLBIPAddress(lb.FrontendIPs[0].PrivateIPAddress, cidrs,
437+
for i := range lb.FrontendIPs {
438+
if lb.FrontendIPs[i].PrivateIPAddress != "" {
439+
if err := validateInternalLBIPAddress(lb.FrontendIPs[i].PrivateIPAddress, cidrs,
416440
fldPath.Child("frontendIPConfigs").Index(0).Child("privateIP")); err != nil {
417441
allErrs = append(allErrs, err)
418442
}
419-
if len(old.FrontendIPs) != 0 && old.FrontendIPs[0].PrivateIPAddress != lb.FrontendIPs[0].PrivateIPAddress {
420-
allErrs = append(allErrs, field.Forbidden(fldPath.Child("name"), "API Server load balancer private IP should not be modified after AzureCluster creation."))
421-
}
422443
}
423444
}
424445

425-
// if Public, IP config should not have a private IP.
426-
if lb.Type == Public {
427-
if lb.FrontendIPs[0].PrivateIPAddress != "" {
428-
allErrs = append(allErrs, field.Forbidden(fldPath.Child("frontendIPConfigs").Index(0).Child("privateIP"),
429-
"Public Load Balancers cannot have a Private IP"))
446+
if len(old.FrontendIPs) != 0 {
447+
oldPrivateIP := ""
448+
for i := range old.FrontendIPs {
449+
if old.FrontendIPs[i].PrivateIPAddress != "" {
450+
oldPrivateIP = old.FrontendIPs[i].PrivateIPAddress
451+
}
452+
}
453+
if newPrivateIP != oldPrivateIP {
454+
allErrs = append(allErrs, field.Forbidden(fldPath.Child("name"), "API Server load balancer private IP should not be modified after AzureCluster creation."))
430455
}
431456
}
432457
}

‎api/v1beta1/azurecluster_validation_test.go

Lines changed: 89 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -891,6 +891,7 @@ func TestValidateAPIServerLB(t *testing.T) {
891891
{
892892
name: "too many IP configs",
893893
lb: LoadBalancerSpec{
894+
Name: "my-valid-lb",
894895
FrontendIPs: []FrontendIP{
895896
{
896897
Name: "ip-1",
@@ -899,6 +900,10 @@ func TestValidateAPIServerLB(t *testing.T) {
899900
Name: "ip-2",
900901
},
901902
},
903+
LoadBalancerClassSpec: LoadBalancerClassSpec{
904+
Type: Public,
905+
SKU: SKUStandard,
906+
},
902907
},
903908
wantErr: true,
904909
expectedErr: field.Error{
@@ -916,26 +921,80 @@ func TestValidateAPIServerLB(t *testing.T) {
916921
},
917922
},
918923
{
919-
name: "public LB with private IP",
924+
name: "too many private IP configs",
920925
lb: LoadBalancerSpec{
926+
Name: "my-valid-lb",
921927
FrontendIPs: []FrontendIP{
922928
{
923929
Name: "ip-1",
924930
FrontendIPClass: FrontendIPClass{
925-
PrivateIPAddress: "10.0.0.4",
931+
PrivateIPAddress: "10.0.0.100",
932+
},
933+
},
934+
{
935+
Name: "ip-2",
936+
FrontendIPClass: FrontendIPClass{
937+
PrivateIPAddress: "10.0.0.200",
926938
},
927939
},
940+
{
941+
Name: "ip-3",
942+
},
928943
},
929944
LoadBalancerClassSpec: LoadBalancerClassSpec{
930945
Type: Public,
946+
SKU: SKUStandard,
931947
},
932948
},
933949
wantErr: true,
934950
expectedErr: field.Error{
935-
Type: "FieldValueForbidden",
936-
Field: "apiServerLB.frontendIPConfigs[0].privateIP",
937-
Detail: "Public Load Balancers cannot have a Private IP",
951+
Type: "FieldValueInvalid",
952+
Field: "apiServerLB.frontendIPConfigs",
953+
BadValue: []FrontendIP{
954+
{
955+
Name: "ip-1",
956+
FrontendIPClass: FrontendIPClass{
957+
PrivateIPAddress: "10.0.0.100",
958+
},
959+
},
960+
{
961+
Name: "ip-2",
962+
FrontendIPClass: FrontendIPClass{
963+
PrivateIPAddress: "10.0.0.200",
964+
},
965+
},
966+
{
967+
Name: "ip-3",
968+
},
969+
},
970+
Detail: "API Server Load balancer should have 1 private IP",
971+
},
972+
},
973+
{
974+
name: "public LB with private IP",
975+
cpCIDRS: []string{"10.0.0.0/24"},
976+
lb: LoadBalancerSpec{
977+
Name: "my-valid-lb",
978+
FrontendIPs: []FrontendIP{
979+
{
980+
Name: "ip-1",
981+
PublicIP: &PublicIPSpec{
982+
Name: "my-valid-ip-name",
983+
},
984+
},
985+
{
986+
Name: "ip-1",
987+
FrontendIPClass: FrontendIPClass{
988+
PrivateIPAddress: "10.0.0.4",
989+
},
990+
},
991+
},
992+
LoadBalancerClassSpec: LoadBalancerClassSpec{
993+
Type: Public,
994+
SKU: SKUStandard,
995+
},
938996
},
997+
wantErr: false,
939998
},
940999
{
9411000
name: "internal LB with public IP",
@@ -956,7 +1015,7 @@ func TestValidateAPIServerLB(t *testing.T) {
9561015
expectedErr: field.Error{
9571016
Type: "FieldValueForbidden",
9581017
Field: "apiServerLB.frontendIPConfigs[0].publicIP",
959-
Detail: "Internal Load Balancers cannot have a Public IP",
1018+
Detail: "API Server's associated internal load balancer cannot have a Public IP",
9601019
},
9611020
},
9621021
{
@@ -1483,12 +1542,18 @@ func createClusterNetworkSpec() NetworkSpec {
14831542
Vnet: VnetSpec{
14841543
ResourceGroup: "custom-vnet",
14851544
Name: "my-vnet",
1545+
VnetClassSpec: VnetClassSpec{
1546+
CIDRBlocks: []string{DefaultVnetCIDR},
1547+
},
14861548
},
14871549
Subnets: Subnets{
14881550
{
14891551
SubnetClassSpec: SubnetClassSpec{
14901552
Role: "cluster",
14911553
Name: "cluster-subnet",
1554+
CIDRBlocks: []string{
1555+
DefaultClusterSubnetCIDR,
1556+
},
14921557
},
14931558
},
14941559
},
@@ -1502,12 +1567,18 @@ func createValidNetworkSpecWithClusterSubnet() NetworkSpec {
15021567
Vnet: VnetSpec{
15031568
ResourceGroup: "custom-vnet",
15041569
Name: "my-vnet",
1570+
VnetClassSpec: VnetClassSpec{
1571+
CIDRBlocks: []string{DefaultVnetCIDR},
1572+
},
15051573
},
15061574
Subnets: Subnets{
15071575
{
15081576
SubnetClassSpec: SubnetClassSpec{
15091577
Role: "cluster",
15101578
Name: "cluster-subnet",
1579+
CIDRBlocks: []string{
1580+
DefaultClusterSubnetCIDR,
1581+
},
15111582
},
15121583
},
15131584
},
@@ -1521,6 +1592,9 @@ func createValidNetworkSpec() NetworkSpec {
15211592
Vnet: VnetSpec{
15221593
ResourceGroup: "custom-vnet",
15231594
Name: "my-vnet",
1595+
VnetClassSpec: VnetClassSpec{
1596+
CIDRBlocks: []string{DefaultVnetCIDR},
1597+
},
15241598
},
15251599
Subnets: createValidSubnets(),
15261600
APIServerLB: createValidAPIServerLB(),
@@ -1534,6 +1608,9 @@ func createValidSubnets() Subnets {
15341608
SubnetClassSpec: SubnetClassSpec{
15351609
Role: "control-plane",
15361610
Name: "control-plane-subnet",
1611+
CIDRBlocks: []string{
1612+
DefaultControlPlaneSubnetCIDR,
1613+
},
15371614
},
15381615
},
15391616
{
@@ -1566,6 +1643,12 @@ func createValidAPIServerLB() LoadBalancerSpec {
15661643
DNSName: "myfqdn.azure.com",
15671644
},
15681645
},
1646+
{
1647+
Name: "ip-config-internal-ip",
1648+
FrontendIPClass: FrontendIPClass{
1649+
PrivateIPAddress: DefaultInternalLBIPAddress,
1650+
},
1651+
},
15691652
},
15701653
LoadBalancerClassSpec: LoadBalancerClassSpec{
15711654
SKU: SKUStandard,

0 commit comments

Comments
 (0)