Update vpc-go-sdk module and introduce the new SecurityGroupRule types by Pacho20 · Pull Request #2603 · kubernetes-sigs/cluster-api-provider-ibmcloud

Pacho20 · 2026-01-21T14:07:22Z

What this PR does / why we need it:
This PR updates the vpc-go-sdk version

The latest release of vpc-go-sdk contains some breaking changes for SecurityGroupRuleProtocol, Its changed from all to icmp_tcp_udp and we are no more able to use 'all' protocol. Besides that it introduced two new protocol types Any and Individual.

This PR changes the protocol usage from 'all' to 'icmp_tcp_udp' and add support for the new protocol types 'any' and 'individual'.

The release notes: https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log#9-december-2025

Which issue(s) this PR fixes:
Fixes #2579

Special notes for your reviewer:

/area provider/ibmcloud

Please confirm that if this PR changes any image versions, then that's the sole change this PR makes.

Release note:

The VPC Security Group Rule protocol value 'all' has been replaced with 'icmp_tcp_udp', action required. Added support for the 'any' protocol and all individual protocols currently supported by IBM Cloud VPC Security Group Rules.

linux-foundation-easycla · 2026-01-21T14:07:31Z

The committers listed above are authorized under a signed CLA.

✅ login: Karthik-K-N / name: Karthik Bhat (8041a07)
✅ login: Pacho20 / name: Patrik Fodor (1d85fbd, 61c34a8, 83d6a53, dcdfb3d, e642bf6)

netlify · 2026-01-21T14:07:32Z

✅ Deploy Preview for kubernetes-sigs-cluster-api-ibmcloud ready!

Name	Link
🔨 Latest commit	`1d85fbd`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-sigs-cluster-api-ibmcloud/deploys/697cc87fa046cb0008af70d9
😎 Deploy Preview	https://deploy-preview-2603.cluster-api-ibmcloud.sigs.k8s.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

k8s-ci-robot · 2026-01-21T14:07:32Z

Welcome @Pacho20!

It looks like this is your first PR to kubernetes-sigs/cluster-api-provider-ibmcloud 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/cluster-api-provider-ibmcloud has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-01-21T14:07:33Z

Hi @Pacho20. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2026-01-21T14:07:34Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Pacho20
Once this PR has been reviewed and has the lgtm label, please assign prajyot-parab for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

mkumatag · 2026-01-23T04:48:40Z

/cc @Karthik-K-N

mkumatag · 2026-01-23T04:49:04Z

/ok-to-test

The latest vpc-go-sdk release introduced a breaking change to SecurityGroupRuleProtocol: the value 'all' was removed and replaced by 'icmp_tcp_udp'. This commit updates the security group rule creation and validation to use 'icmp_tcp_udp' instead of 'all'.

The latest vpc-go-sdk introduces two new security group rule protocol types: any and individual. This commit adds full compatibility for these new protocols in the VPC implementation.

The latest vpc-go-sdk introduces two new security group rule protocol types: 'any' and 'individual'. This commit adds full compatibility for these new protocols in the PowerVS implementation.

Karthik-K-N

Overall LGTM, Couple of changes required in error statements or logs.

Thanks for working on it

Karthik-K-N · 2026-01-30T08:28:37Z

cloud/scope/powervs/powervs_cluster.go

+			ogRule := ogRuleIntf.(*vpcv1.SecurityGroupRuleProtocolAny)
+			ruleID = ogRule.ID
+
+			if *ogRule.Direction == string(direction) && *ogRule.Protocol == protocol {


Is it safe to directly deref the pointer? is it non nil always?

Yes, it should be safe. If you check the API docs, these values are marked as always included. Without the direction and protocol fields, the rule would not make sense at all. Besides that the same pattern is used for all the other SGR types.
https://cloud.ibm.com/apidocs/vpc/latest#get-security-group

Karthik-K-N · 2026-01-30T08:31:18Z

cloud/scope/vpc/cluster_v2.go

 	IBMVPCCluster   *infrav1.IBMVPCCluster
 	ServiceEndpoint []endpoints.ServiceEndpoint
+
+	individualSgrRegexp *regexp.Regexp


Is it required to be part of ClusterScope, as its a constant and can't we keep it as variable?

You are right it can be a variable. I will move it from ClusterScope.

Karthik-K-N · 2026-01-30T08:33:20Z

cloud/scope/vpc/cluster_v2.go

+	if exists, err := s.checkSecurityGroupRulePrototypeRemote(ctx, securityGroupRuleRemote, existingRule.Remote); err != nil {
+		return false, fmt.Errorf("error failed checking security group rule all remote: %w", err)
+	} else if exists {
+		log.V(3).Info("security group rule all protocols match")


security group rule all or security group rule any?

Yeah...
Will change those.

Karthik-K-N · 2026-01-30T08:34:09Z

cloud/scope/vpc/cluster_v2.go

+	}
+
+	if exists, err := s.checkSecurityGroupRulePrototypeRemote(ctx, securityGroupRuleRemote, existingRule.Remote); err != nil {
+		return false, fmt.Errorf("error failed checking security group rule all remote: %w", err)


k8s-ci-robot · 2026-02-05T18:27:02Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Karthik-K-N · 2026-02-11T07:15:39Z

Most of the things LGTM, Have you tested this change by creating a cluster?
Also whats the scenario when a user upgrades from previous version to this version?

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. area/provider/ibmcloud Issues or PRs related to ibmcloud provider labels Jan 21, 2026

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 21, 2026

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Jan 21, 2026

k8s-ci-robot requested review from Prajyot-Parab and mkumatag January 21, 2026 14:07

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jan 21, 2026

k8s-ci-robot requested a review from Karthik-K-N January 23, 2026 04:48

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 23, 2026

Pacho20 force-pushed the new-vpc-sgr branch 2 times, most recently from b072c8b to 4ae0b24 Compare January 27, 2026 11:54

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 27, 2026

Pacho20 marked this pull request as ready for review January 27, 2026 11:55

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 27, 2026

Pacho20 force-pushed the new-vpc-sgr branch from 4ae0b24 to ea834a4 Compare January 27, 2026 12:42

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 29, 2026

Karthik-K-N and others added 3 commits January 29, 2026 16:06

Add support for new SGR protocols in VPC

61c34a8

The latest vpc-go-sdk introduces two new security group rule protocol types: any and individual. This commit adds full compatibility for these new protocols in the VPC implementation.

Add support for new SGR protocols in PowerVS

e642bf6

The latest vpc-go-sdk introduces two new security group rule protocol types: 'any' and 'individual'. This commit adds full compatibility for these new protocols in the PowerVS implementation.

add new sgr to powervs v1beta3

dcdfb3d

Pacho20 force-pushed the new-vpc-sgr branch from ea834a4 to dcdfb3d Compare January 29, 2026 15:12

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 29, 2026

Karthik-K-N reviewed Jan 30, 2026

View reviewed changes

Pacho20 added 2 commits January 30, 2026 13:01

fix checkSecurityGroupRuleProtocol logs

83d6a53

make individualSgrRegexp a variable

1d85fbd

Pacho20 force-pushed the new-vpc-sgr branch from ee255d1 to 1d85fbd Compare January 30, 2026 15:04

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 5, 2026

Pacho20 mentioned this pull request Feb 24, 2026

[release-0.13] Bump github.com/IBM/vpc-go-sdk from v0.76.2 to v0.76.4 #2646

Merged

Conversation

Pacho20 commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linux-foundation-easycla bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubernetes-sigs-cluster-api-ibmcloud ready!

Uh oh!

k8s-ci-robot commented Jan 21, 2026

Uh oh!

k8s-ci-robot commented Jan 21, 2026

Uh oh!

k8s-ci-robot commented Jan 21, 2026

Uh oh!

mkumatag commented Jan 23, 2026

Uh oh!

mkumatag commented Jan 23, 2026

Uh oh!

Karthik-K-N left a comment

Choose a reason for hiding this comment

Uh oh!

Karthik-K-N Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Pacho20 Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Karthik-K-N Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Pacho20 Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Karthik-K-N Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Pacho20 Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Karthik-K-N Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Feb 5, 2026

Uh oh!

Karthik-K-N commented Feb 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Pacho20 commented Jan 21, 2026 •

edited

Loading

linux-foundation-easycla bot commented Jan 21, 2026 •

edited

Loading

netlify bot commented Jan 21, 2026 •

edited

Loading

Pacho20 Jan 30, 2026 •

edited

Loading