Skip to content

Commit a91155d

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #3057 from willie-yao/bastion-sku
Add support for bastion tiers
2 parents 4975d24 + fd83359 commit a91155d

File tree

10 files changed

+88
-24
lines changed

10 files changed

+88
-24
lines changed

‎api/v1alpha4/azurecluster_conversion.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ func (src *AzureCluster) ConvertTo(dstRaw conversion.Hub) error {
8181
}
8282
}
8383

84-
// Restore Azure Bastion IP tags, ServiceEndpoints and PrivateEndpoints.
84+
// Restore Azure Bastion IP tags, ServiceEndpoints, PrivateEndpoints, SKU, and EnableTunneling.
8585
if restored.Spec.BastionSpec.AzureBastion != nil && dst.Spec.BastionSpec.AzureBastion != nil {
8686
if restored.Spec.BastionSpec.AzureBastion.PublicIP.Name == dst.Spec.BastionSpec.AzureBastion.PublicIP.Name {
8787
dst.Spec.BastionSpec.AzureBastion.PublicIP.IPTags = restored.Spec.BastionSpec.AzureBastion.PublicIP.IPTags
@@ -91,6 +91,8 @@ func (src *AzureCluster) ConvertTo(dstRaw conversion.Hub) error {
9191
}
9292
dst.Spec.BastionSpec.AzureBastion.Subnet.ServiceEndpoints = restored.Spec.BastionSpec.AzureBastion.Subnet.ServiceEndpoints
9393
dst.Spec.BastionSpec.AzureBastion.Subnet.PrivateEndpoints = restored.Spec.BastionSpec.AzureBastion.Subnet.PrivateEndpoints
94+
dst.Spec.BastionSpec.AzureBastion.Sku = restored.Spec.BastionSpec.AzureBastion.Sku
95+
dst.Spec.BastionSpec.AzureBastion.EnableTunneling = restored.Spec.BastionSpec.AzureBastion.EnableTunneling
9496
}
9597

9698
// Restore load balancers' backend pool name
@@ -372,3 +374,8 @@ func Convert_v1beta1_NatGateway_To_v1alpha4_NatGateway(in *infrav1.NatGateway, o
372374
func Convert_v1beta1_PublicIPSpec_To_v1alpha4_PublicIPSpec(in *infrav1.PublicIPSpec, out *PublicIPSpec, s apiconversion.Scope) error {
373375
return autoConvert_v1beta1_PublicIPSpec_To_v1alpha4_PublicIPSpec(in, out, s)
374376
}
377+
378+
// Convert_v1beta1_AzureBastion_To_v1alpha4_AzureBastion is an autogenerated conversion function.
379+
func Convert_v1beta1_AzureBastion_To_v1alpha4_AzureBastion(in *infrav1.AzureBastion, out *AzureBastion, s apiconversion.Scope) error {
380+
return autoConvert_v1beta1_AzureBastion_To_v1alpha4_AzureBastion(in, out, s)
381+
}

‎api/v1alpha4/zz_generated.conversion.go‎

Lines changed: 7 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta1/azurecluster_validation.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,10 @@ func (c *AzureCluster) validateClusterSpec(old *AzureCluster) field.ErrorList {
9696
allErrs = append(allErrs, validateCloudProviderConfigOverrides(c.Spec.CloudProviderConfigOverrides, oldCloudProviderConfigOverrides,
9797
field.NewPath("spec").Child("cloudProviderConfigOverrides"))...)
9898

99+
if err := validateBastionSpec(c.Spec.BastionSpec, field.NewPath("spec").Child("azureBastion").Child("bastionSpec")); err != nil {
100+
allErrs = append(allErrs, err)
101+
}
102+
99103
return allErrs
100104
}
101105

@@ -117,6 +121,15 @@ func (c *AzureCluster) validateClusterName() field.ErrorList {
117121
return allErrs
118122
}
119123

124+
// validateBastionSpec validates a BastionSpec.
125+
func validateBastionSpec(bastionSpec BastionSpec, fldPath *field.Path) *field.Error {
126+
if bastionSpec.AzureBastion != nil && bastionSpec.AzureBastion.Sku != StandardBastionHostSku && bastionSpec.AzureBastion.EnableTunneling {
127+
return field.Invalid(fldPath.Child("sku"), bastionSpec.AzureBastion.Sku,
128+
"sku must be Standard if tunneling is enabled")
129+
}
130+
return nil
131+
}
132+
120133
// validateNetworkSpec validates a NetworkSpec.
121134
func validateNetworkSpec(networkSpec NetworkSpec, old NetworkSpec, fldPath *field.Path) field.ErrorList {
122135
var allErrs field.ErrorList

‎api/v1beta1/types.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -832,6 +832,16 @@ const (
832832
AvailabilitySetRateLimit = "availabilitySetRateLimit"
833833
)
834834

835+
// BastionHostSkuName is the name of the SKU used to specify the tier of Azure Bastion Host.
836+
type BastionHostSkuName string
837+
838+
const (
839+
// BasicBastionHostSku SKU for the Azure Bastion Host.
840+
BasicBastionHostSku BastionHostSkuName = "Basic"
841+
// StandardBastionHostSku SKU for the Azure Bastion Host.
842+
StandardBastionHostSku BastionHostSkuName = "Standard"
843+
)
844+
835845
// BastionSpec specifies how the Bastion feature should be set up for the cluster.
836846
type BastionSpec struct {
837847
// +optional
@@ -846,6 +856,15 @@ type AzureBastion struct {
846856
Subnet SubnetSpec `json:"subnet,omitempty"`
847857
// +optional
848858
PublicIP PublicIPSpec `json:"publicIP,omitempty"`
859+
// BastionHostSkuName configures the tier of the Azure Bastion Host. Can be either Basic or Standard. Defaults to Basic.
860+
// +kubebuilder:default=Basic
861+
// +kubebuilder:validation:Enum=Basic;Standard
862+
// +optional
863+
Sku BastionHostSkuName `json:"sku,omitempty"`
864+
// EnableTunneling enables the native client support feature for the Azure Bastion Host. Defaults to false.
865+
// +kubebuilder:default=false
866+
// +optional
867+
EnableTunneling bool `json:"enableTunneling,omitempty"`
849868
}
850869

851870
// BackendPool describes the backend pool of the load balancer.

‎azure/scope/cluster.go‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -520,12 +520,14 @@ func (s *ClusterScope) AzureBastionSpec() azure.ResourceSpecGetter {
520520
publicIPID := azure.PublicIPID(s.SubscriptionID(), s.ResourceGroup(), s.AzureBastion().PublicIP.Name)
521521

522522
return &bastionhosts.AzureBastionSpec{
523-
Name: s.AzureBastion().Name,
524-
ResourceGroup: s.ResourceGroup(),
525-
Location: s.Location(),
526-
ClusterName: s.ClusterName(),
527-
SubnetID: subnetID,
528-
PublicIPID: publicIPID,
523+
Name: s.AzureBastion().Name,
524+
ResourceGroup: s.ResourceGroup(),
525+
Location: s.Location(),
526+
ClusterName: s.ClusterName(),
527+
SubnetID: subnetID,
528+
PublicIPID: publicIPID,
529+
Sku: s.AzureBastion().Sku,
530+
EnableTunneling: s.AzureBastion().EnableTunneling,
529531
}
530532
}
531533

‎azure/services/bastionhosts/spec.go‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,14 @@ import (
3030

3131
// AzureBastionSpec defines the specification for azure bastion feature.
3232
type AzureBastionSpec struct {
33-
Name string
34-
ResourceGroup string
35-
Location string
36-
ClusterName string
37-
SubnetID string
38-
PublicIPID string
33+
Name string
34+
ResourceGroup string
35+
Location string
36+
ClusterName string
37+
SubnetID string
38+
PublicIPID string
39+
Sku infrav1.BastionHostSkuName
40+
EnableTunneling bool
3941
}
4042

4143
// AzureBastionSpecInput defines the required inputs to construct an azure bastion spec.
@@ -81,8 +83,12 @@ func (s *AzureBastionSpec) Parameters(ctx context.Context, existing interface{})
8183
Name: pointer.String(s.Name),
8284
Role: pointer.String("Bastion"),
8385
})),
86+
Sku: &network.Sku{
87+
Name: network.BastionHostSkuName(s.Sku),
88+
},
8489
BastionHostPropertiesFormat: &network.BastionHostPropertiesFormat{
85-
DNSName: pointer.String(fmt.Sprintf("%s-bastion", strings.ToLower(s.Name))),
90+
EnableTunneling: pointer.Bool(s.EnableTunneling),
91+
DNSName: pointer.String(fmt.Sprintf("%s-bastion", strings.ToLower(s.Name))),
8692
IPConfigurations: &[]network.BastionHostIPConfiguration{
8793
{
8894
Name: pointer.String(bastionHostIPConfigName),

‎config/crd/bases/infrastructure.cluster.x-k8s.io_azureclusters.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1318,6 +1318,11 @@ spec:
13181318
description: AzureBastion specifies how the Azure Bastion cloud
13191319
component should be configured.
13201320
properties:
1321+
enableTunneling:
1322+
default: false
1323+
description: EnableTunneling enables the native client support
1324+
feature for the Azure Bastion Host. Defaults to false.
1325+
type: boolean
13211326
name:
13221327
type: string
13231328
publicIP:
@@ -1349,6 +1354,15 @@ spec:
13491354
required:
13501355
- name
13511356
type: object
1357+
sku:
1358+
default: Basic
1359+
description: BastionHostSkuName configures the tier of the
1360+
Azure Bastion Host. Can be either Basic or Standard. Defaults
1361+
to Basic.
1362+
enum:
1363+
- Basic
1364+
- Standard
1365+
type: string
13521366
subnet:
13531367
description: SubnetSpec configures an Azure subnet.
13541368
properties:

‎docs/book/src/topics/ssh-access.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,8 @@ spec:
107107
securityGroup: {} // No security group is assigned by default. You can choose to have one created and assigned by defining it.
108108
publicIP:
109109
"name": "..." // The name of the Public IP, defaults to '<cluster name>-azure-bastion-pip'.
110+
sku: "..." // The SKU/tier of the Azure Bastion resource. The options are `Standard` and `Basic`. The default value is `Basic`.
111+
enableTunneling: "..." // Whether or not to enable tunneling/native client support. The default value is `false`.
110112
```
111113
112114
If you specify a security group to be associated with the Azure Bastion subnet, it needs to have some networking rules defined or

‎templates/test/ci/cluster-template-prow-private.yaml‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎templates/test/ci/prow-private/patches/bastion.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,5 @@ spec:
1313
- ${AZURE_BASTION_SUBNET_CIDR}
1414
name: AzureBastionSubnet
1515
role: bastion
16+
sku: Standard
17+
enableTunneling: true

0 commit comments

Comments
 (0)