Skip to content

Update vpc-go-sdk module and introduce the new SecurityGroupRule types #2603

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Pacho20 wants to merge 6 commits into
base: main
Choose a base branch
from
+626 −173
Open

Update vpc-go-sdk module and introduce the new SecurityGroupRule types #2603

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8041a07
Bump vpc-go-sdk and replace all with icmp_tcp_udp
Karthik-K-N Jan 6, 2026
61c34a8
Add support for new SGR protocols in VPC
Pacho20 Jan 19, 2026
e642bf6
Add support for new SGR protocols in PowerVS
Pacho20 Jan 21, 2026
dcdfb3d
add new sgr to powervs v1beta3
Pacho20 Jan 27, 2026
83d6a53
fix checkSecurityGroupRuleProtocol logs
Pacho20 Jan 30, 2026
1d85fbd
make individualSgrRegexp a variable
Pacho20 Jan 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions api/powervs/v1beta2/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,14 +285,20 @@ var (
)

const (
// VPCSecurityGroupRuleProtocolAllType is a string representation of the 'SecurityGroupRuleSecurityGroupRuleProtocolAll' type.
VPCSecurityGroupRuleProtocolAllType = "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolAll"
// VPCSecurityGroupRuleProtocolAnyType is a string representation of the 'SecurityGroupRuleProtocolAny' type.
VPCSecurityGroupRuleProtocolAnyType = "*vpcv1.SecurityGroupRuleProtocolAny"

// VPCSecurityGroupRuleProtocolIcmptcpudpType is a string representation of the 'SecurityGroupRuleProtocolIcmptcpudp' type.
VPCSecurityGroupRuleProtocolIcmptcpudpType = "*vpcv1.SecurityGroupRuleProtocolIcmptcpudp"

// VPCSecurityGroupRuleProtocolIcmpType is a string representation of the 'SecurityGroupRuleSecurityGroupRuleProtocolIcmp' type.
VPCSecurityGroupRuleProtocolIcmpType = "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolIcmp"

// VPCSecurityGroupRuleProtocolTcpudpType is a string representation of the 'SecurityGroupRuleSecurityGroupRuleProtocolTcpudp' type.
VPCSecurityGroupRuleProtocolTcpudpType = "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudp"

// VPCSecurityGroupRuleProtocolIndividualType is a string representation of the 'SecurityGroupRuleProtocolIndividual' type.
VPCSecurityGroupRuleProtocolIndividualType = "*vpcv1.SecurityGroupRuleProtocolIndividual"
)

// VPCSecurityGroupRuleAction represents the actions for a Security Group Rule.
Expand All @@ -318,12 +324,14 @@ const (
)

// VPCSecurityGroupRuleProtocol represents the protocols for a Security Group Rule.
// +kubebuilder:validation:Enum=all;icmp;tcp;udp
// +kubebuilder:validation:Pattern=`^(any|icmp_tcp_udp|icmp|tcp|udp|ah|esp|gre|ip_in_ip|l2tp|rsvp|sctp|vrrp|number_(?:0|2|3|5|[7-9]|1[0-6]|1[8-9]|[2-3][0-9]|4[0-5]|4[89]|5[2-9]|[6-9][0-9]|10[0-9]|11[0-1]|11[3-4]|11[6-9]|12[0-9]|13[0-1]|13[3-9]|1[4-9][0-9]|2[0-4][0-9]|25[0-5]))$`
type VPCSecurityGroupRuleProtocol string

const (
// VPCSecurityGroupRuleProtocolAll defines the Rule is for all network protocols.
VPCSecurityGroupRuleProtocolAll VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolAllConst
// VPCSecurityGroupRuleProtocolAny defines the Rule is for any network protocols.
VPCSecurityGroupRuleProtocolAny VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolAnyConst
// VPCSecurityGroupRuleProtocolIcmpTCPUDP defines the Rule is for ICMP, TCP and UDP protocols.
VPCSecurityGroupRuleProtocolIcmpTCPUDP VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolIcmpTCPUDPConst
// VPCSecurityGroupRuleProtocolIcmp defiens the Rule is for ICMP network protocol.
VPCSecurityGroupRuleProtocolIcmp VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolIcmpConst
// VPCSecurityGroupRuleProtocolTCP defines the Rule is for TCP network protocol.
Expand Down Expand Up @@ -446,8 +454,9 @@ type VPCSecurityGroupRuleRemote struct {

// VPCSecurityGroupRulePrototype defines a VPC Security Group Rule's traffic specifics for a series of remotes (destinations or sources).
// +kubebuilder:validation:XValidation:rule="self.protocol != 'icmp' ? (!has(self.icmpCode) && !has(self.icmpType)) : true",message="icmpCode and icmpType are only supported for VPCSecurityGroupRuleProtocolIcmp protocol"
// +kubebuilder:validation:XValidation:rule="self.protocol == 'all' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolAll protocol"
// +kubebuilder:validation:XValidation:rule="self.protocol == 'icmp' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolIcmp protocol"
// +kubebuilder:validation:XValidation:rule="(self.protocol != 'tcp' && self.protocol != 'udp') ? !has(self.portRange) : true",message="portRange is not valid for protocol"
// +kubebuilder:validation:XValidation:rule="self.protocol == 'icmp_tcp_udp' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolIcmpTCPUDP protocol"
type VPCSecurityGroupRulePrototype struct {
// icmpCode is the ICMP code for the Rule.
// Only used when Protocol is VPCSecurityGroupRuleProtocolIcmp.
Expand Down
21 changes: 15 additions & 6 deletions api/powervs/v1beta3/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,14 +285,20 @@ var (
)

const (
// VPCSecurityGroupRuleProtocolAllType is a string representation of the 'SecurityGroupRuleSecurityGroupRuleProtocolAll' type.
VPCSecurityGroupRuleProtocolAllType = "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolAll"
// VPCSecurityGroupRuleProtocolAnyType is a string representation of the 'SecurityGroupRuleProtocolAny' type.
VPCSecurityGroupRuleProtocolAnyType = "*vpcv1.SecurityGroupRuleProtocolAny"

// VPCSecurityGroupRuleProtocolIcmptcpudpType is a string representation of the 'SecurityGroupRuleProtocolIcmptcpudp' type.
VPCSecurityGroupRuleProtocolIcmptcpudpType = "*vpcv1.SecurityGroupRuleProtocolIcmptcpudp"

// VPCSecurityGroupRuleProtocolIcmpType is a string representation of the 'SecurityGroupRuleSecurityGroupRuleProtocolIcmp' type.
VPCSecurityGroupRuleProtocolIcmpType = "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolIcmp"

// VPCSecurityGroupRuleProtocolTcpudpType is a string representation of the 'SecurityGroupRuleSecurityGroupRuleProtocolTcpudp' type.
VPCSecurityGroupRuleProtocolTcpudpType = "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudp"

// VPCSecurityGroupRuleProtocolIndividualType is a string representation of the 'SecurityGroupRuleProtocolIndividual' type.
VPCSecurityGroupRuleProtocolIndividualType = "*vpcv1.SecurityGroupRuleProtocolIndividual"
)

// VPCSecurityGroupRuleAction represents the actions for a Security Group Rule.
Expand All @@ -318,12 +324,14 @@ const (
)

// VPCSecurityGroupRuleProtocol represents the protocols for a Security Group Rule.
// +kubebuilder:validation:Enum=all;icmp;tcp;udp
// +kubebuilder:validation:Pattern=`^(any|icmp_tcp_udp|icmp|tcp|udp|ah|esp|gre|ip_in_ip|l2tp|rsvp|sctp|vrrp|number_(?:0|2|3|5|[7-9]|1[0-6]|1[8-9]|[2-3][0-9]|4[0-5]|4[89]|5[2-9]|[6-9][0-9]|10[0-9]|11[0-1]|11[3-4]|11[6-9]|12[0-9]|13[0-1]|13[3-9]|1[4-9][0-9]|2[0-4][0-9]|25[0-5]))$`
type VPCSecurityGroupRuleProtocol string

const (
// VPCSecurityGroupRuleProtocolAll defines the Rule is for all network protocols.
VPCSecurityGroupRuleProtocolAll VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolAllConst
// VPCSecurityGroupRuleProtocolAny defines the Rule is for any network protocols.
VPCSecurityGroupRuleProtocolAny VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolAnyConst
// VPCSecurityGroupRuleProtocolIcmpTCPUDP defines the Rule is for ICMP, TCP and UDP protocols.
VPCSecurityGroupRuleProtocolIcmpTCPUDP VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolIcmpTCPUDPConst
// VPCSecurityGroupRuleProtocolIcmp defiens the Rule is for ICMP network protocol.
VPCSecurityGroupRuleProtocolIcmp VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolIcmpConst
// VPCSecurityGroupRuleProtocolTCP defines the Rule is for TCP network protocol.
Expand Down Expand Up @@ -446,8 +454,9 @@ type VPCSecurityGroupRuleRemote struct {

// VPCSecurityGroupRulePrototype defines a VPC Security Group Rule's traffic specifics for a series of remotes (destinations or sources).
// +kubebuilder:validation:XValidation:rule="self.protocol != 'icmp' ? (!has(self.icmpCode) && !has(self.icmpType)) : true",message="icmpCode and icmpType are only supported for VPCSecurityGroupRuleProtocolIcmp protocol"
// +kubebuilder:validation:XValidation:rule="self.protocol == 'all' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolAll protocol"
// +kubebuilder:validation:XValidation:rule="self.protocol == 'icmp' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolIcmp protocol"
// +kubebuilder:validation:XValidation:rule="(self.protocol != 'tcp' && self.protocol != 'udp') ? !has(self.portRange) : true",message="portRange is not valid for protocol"
// +kubebuilder:validation:XValidation:rule="self.protocol == 'icmp_tcp_udp' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolIcmpTCPUDP protocol"
type VPCSecurityGroupRulePrototype struct {
// icmpCode is the ICMP code for the Rule.
// Only used when Protocol is VPCSecurityGroupRuleProtocolIcmp.
Expand Down
21 changes: 15 additions & 6 deletions api/vpc/v1beta2/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,14 +164,20 @@ var (
)

const (
// VPCSecurityGroupRuleProtocolAllType is a string representation of the 'SecurityGroupRuleSecurityGroupRuleProtocolAll' type.
VPCSecurityGroupRuleProtocolAllType = "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolAll"
// VPCSecurityGroupRuleProtocolAnyType is a string representation of the 'SecurityGroupRuleProtocolAny' type.
VPCSecurityGroupRuleProtocolAnyType = "*vpcv1.SecurityGroupRuleProtocolAny"

// VPCSecurityGroupRuleProtocolIcmptcpudpType is a string representation of the 'SecurityGroupRuleProtocolIcmptcpudp' type.
VPCSecurityGroupRuleProtocolIcmptcpudpType = "*vpcv1.SecurityGroupRuleProtocolIcmptcpudp"

// VPCSecurityGroupRuleProtocolIcmpType is a string representation of the 'SecurityGroupRuleSecurityGroupRuleProtocolIcmp' type.
VPCSecurityGroupRuleProtocolIcmpType = "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolIcmp"

// VPCSecurityGroupRuleProtocolTcpudpType is a string representation of the 'SecurityGroupRuleSecurityGroupRuleProtocolTcpudp' type.
VPCSecurityGroupRuleProtocolTcpudpType = "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudp"

// VPCSecurityGroupRuleProtocolIndividualType is a string representation of the 'SecurityGroupRuleProtocolIndividual' type.
VPCSecurityGroupRuleProtocolIndividualType = "*vpcv1.SecurityGroupRuleProtocolIndividual"
)

// VPCSecurityGroupRuleAction represents the actions for a Security Group Rule.
Expand All @@ -197,12 +203,14 @@ const (
)

// VPCSecurityGroupRuleProtocol represents the protocols for a Security Group Rule.
// +kubebuilder:validation:Enum=all;icmp;tcp;udp
// +kubebuilder:validation:Pattern=`^(any|icmp_tcp_udp|icmp|tcp|udp|ah|esp|gre|ip_in_ip|l2tp|rsvp|sctp|vrrp|number_(?:0|2|3|5|[7-9]|1[0-6]|1[8-9]|[2-3][0-9]|4[0-5]|4[89]|5[2-9]|[6-9][0-9]|10[0-9]|11[0-1]|11[3-4]|11[6-9]|12[0-9]|13[0-1]|13[3-9]|1[4-9][0-9]|2[0-4][0-9]|25[0-5]))$`
type VPCSecurityGroupRuleProtocol string

const (
// VPCSecurityGroupRuleProtocolAll defines the Rule is for all network protocols.
VPCSecurityGroupRuleProtocolAll VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolAllConst
// VPCSecurityGroupRuleProtocolAny defines the Rule is for any network protocols.
VPCSecurityGroupRuleProtocolAny VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolAnyConst
// VPCSecurityGroupRuleProtocolIcmpTCPUDP defines the Rule is for ICMP, TCP and UDP protocols.
VPCSecurityGroupRuleProtocolIcmpTCPUDP VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolIcmpTCPUDPConst
// VPCSecurityGroupRuleProtocolIcmp defiens the Rule is for ICMP network protocol.
VPCSecurityGroupRuleProtocolIcmp VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolIcmpConst
// VPCSecurityGroupRuleProtocolTCP defines the Rule is for TCP network protocol.
Expand Down Expand Up @@ -398,8 +406,9 @@ type VPCSecurityGroupRuleRemote struct {

// VPCSecurityGroupRulePrototype defines a VPC Security Group Rule's traffic specifics for a series of remotes (destinations or sources).
// +kubebuilder:validation:XValidation:rule="self.protocol != 'icmp' ? (!has(self.icmpCode) && !has(self.icmpType)) : true",message="icmpCode and icmpType are only supported for VPCSecurityGroupRuleProtocolIcmp protocol"
// +kubebuilder:validation:XValidation:rule="self.protocol == 'all' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolAll protocol"
// +kubebuilder:validation:XValidation:rule="self.protocol == 'icmp' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolIcmp protocol"
// +kubebuilder:validation:XValidation:rule="(self.protocol != 'tcp' && self.protocol != 'udp') ? !has(self.portRange) : true",message="portRange is not valid for protocol"
// +kubebuilder:validation:XValidation:rule="self.protocol == 'icmp_tcp_udp' ? !has(self.portRange) : true",message="portRange is not valid for VPCSecurityGroupRuleProtocolIcmpTCPUDP protocol"
type VPCSecurityGroupRulePrototype struct {
// icmpCode is the ICMP code for the Rule.
// Only used when Protocol is VPCSecurityGroupRuleProtocolIcmp.
Expand Down
48 changes: 39 additions & 9 deletions cloud/scope/powervs/powervs_cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1462,15 +1462,21 @@ func (s *ClusterScope) createVPCSecurityGroupRule(ctx context.Context, securityG
}

switch reflect.TypeOf(ruleIntf).String() {
case "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolAll":
rule := ruleIntf.(*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolAll)
case infrav1.VPCSecurityGroupRuleProtocolAnyType:
rule := ruleIntf.(*vpcv1.SecurityGroupRuleProtocolAny)
ruleID = rule.ID
case "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudp":
case infrav1.VPCSecurityGroupRuleProtocolIcmptcpudpType:
rule := ruleIntf.(*vpcv1.SecurityGroupRuleProtocolIcmptcpudp)
ruleID = rule.ID
case infrav1.VPCSecurityGroupRuleProtocolTcpudpType:
rule := ruleIntf.(*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudp)
ruleID = rule.ID
case "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolIcmp":
case infrav1.VPCSecurityGroupRuleProtocolIcmpType:
rule := ruleIntf.(*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolIcmp)
ruleID = rule.ID
case infrav1.VPCSecurityGroupRuleProtocolIndividualType:
rule := ruleIntf.(*vpcv1.SecurityGroupRuleProtocolIndividual)
ruleID = rule.ID
}
log.Info("Created VPC security group rule", "ruleID", *ruleID)
return ruleID, nil
Expand Down Expand Up @@ -1600,7 +1606,7 @@ func (s *ClusterScope) validateVPCSecurityGroupRuleRemote(originalSGRemote *vpcv
}

// validateSecurityGroupRule compares a specific security group's rule with the spec and existing security group's rule.
func (s *ClusterScope) validateSecurityGroupRule(originalSecurityGroupRules []vpcv1.SecurityGroupRuleIntf, direction infrav1.VPCSecurityGroupRuleDirection, rule *infrav1.VPCSecurityGroupRulePrototype, remote infrav1.VPCSecurityGroupRuleRemote) (ruleID *string, match bool, err error) {
func (s *ClusterScope) validateSecurityGroupRule(originalSecurityGroupRules []vpcv1.SecurityGroupRuleIntf, direction infrav1.VPCSecurityGroupRuleDirection, rule *infrav1.VPCSecurityGroupRulePrototype, remote infrav1.VPCSecurityGroupRuleRemote) (ruleID *string, match bool, err error) { //nolint: gocyclo
updateError := func(e error) {
err = fmt.Errorf("failed to validate VPC security group rule's remote: %w", e)
}
Expand All @@ -1609,8 +1615,20 @@ func (s *ClusterScope) validateSecurityGroupRule(originalSecurityGroupRules []vp

for _, ogRuleIntf := range originalSecurityGroupRules {
switch reflect.TypeOf(ogRuleIntf).String() {
case "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolAll":
ogRule := ogRuleIntf.(*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolAll)
case infrav1.VPCSecurityGroupRuleProtocolAnyType:
ogRule := ogRuleIntf.(*vpcv1.SecurityGroupRuleProtocolAny)
ruleID = ogRule.ID

if *ogRule.Direction == string(direction) && *ogRule.Protocol == protocol {
Copy link
Contributor

@Karthik-K-N Karthik-K-N Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it safe to directly deref the pointer? is it non nil always?

Copy link
Author

@Pacho20 Pacho20 Jan 30, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it should be safe. If you check the API docs, these values are marked as always included. Without the direction and protocol fields, the rule would not make sense at all. Besides that the same pattern is used for all the other SGR types.
https://cloud.ibm.com/apidocs/vpc/latest#get-security-group

ogRemote := ogRule.Remote.(*vpcv1.SecurityGroupRuleRemote)
match, err = s.validateVPCSecurityGroupRuleRemote(ogRemote, remote)
if err != nil {
updateError(err)
return nil, false, err
}
}
case infrav1.VPCSecurityGroupRuleProtocolIcmptcpudpType:
ogRule := ogRuleIntf.(*vpcv1.SecurityGroupRuleProtocolIcmptcpudp)
ruleID = ogRule.ID

if *ogRule.Direction == string(direction) && *ogRule.Protocol == protocol {
Expand All @@ -1621,7 +1639,7 @@ func (s *ClusterScope) validateSecurityGroupRule(originalSecurityGroupRules []vp
return nil, false, err
}
}
case "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudp":
case infrav1.VPCSecurityGroupRuleProtocolTcpudpType:
portMin := rule.PortRange.MinimumPort
portMax := rule.PortRange.MaximumPort
ogRule := ogRuleIntf.(*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolTcpudp)
Expand All @@ -1635,7 +1653,7 @@ func (s *ClusterScope) validateSecurityGroupRule(originalSecurityGroupRules []vp
return nil, false, err
}
}
case "*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolIcmp":
case infrav1.VPCSecurityGroupRuleProtocolIcmpType:
icmpCode := rule.ICMPCode
icmpType := rule.ICMPType
ogRule := ogRuleIntf.(*vpcv1.SecurityGroupRuleSecurityGroupRuleProtocolIcmp)
Expand All @@ -1649,6 +1667,18 @@ func (s *ClusterScope) validateSecurityGroupRule(originalSecurityGroupRules []vp
return nil, false, err
}
}
case infrav1.VPCSecurityGroupRuleProtocolIndividualType:
ogRule := ogRuleIntf.(*vpcv1.SecurityGroupRuleProtocolIndividual)
ruleID = ogRule.ID

if *ogRule.Direction == string(direction) && *ogRule.Protocol == protocol {
ogRemote := ogRule.Remote.(*vpcv1.SecurityGroupRuleRemote)
match, err = s.validateVPCSecurityGroupRuleRemote(ogRemote, remote)
if err != nil {
updateError(err)
return nil, false, err
}
}
}
if match {
return ruleID, match, nil
Expand Down
Loading