Skip to content

Commit 217844f

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #1247 from giantswarm/firewall_restriction_on_api_lb
✨ Feature: restrict API Server LB access via IPs
2 parents 398fa9f + e78f0b8 commit 217844f

26 files changed

+1000
-194
lines changed

‎api/v1alpha3/conversion.go

Lines changed: 54 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121

2222
corev1 "k8s.io/api/core/v1"
2323
conversion "k8s.io/apimachinery/pkg/conversion"
24+
utilconversion "sigs.k8s.io/cluster-api/util/conversion"
2425
ctrlconversion "sigs.k8s.io/controller-runtime/pkg/conversion"
2526

2627
infrav1 "sigs.k8s.io/cluster-api-provider-openstack/api/v1alpha5"
@@ -31,13 +32,36 @@ var _ ctrlconversion.Convertible = &OpenStackCluster{}
3132
func (r *OpenStackCluster) ConvertTo(dstRaw ctrlconversion.Hub) error {
3233
dst := dstRaw.(*infrav1.OpenStackCluster)
3334

34-
return Convert_v1alpha3_OpenStackCluster_To_v1alpha5_OpenStackCluster(r, dst, nil)
35+
if err := Convert_v1alpha3_OpenStackCluster_To_v1alpha5_OpenStackCluster(r, dst, nil); err != nil {
36+
return err
37+
}
38+
39+
// Manually restore data.
40+
restored := &infrav1.OpenStackCluster{}
41+
if ok, err := utilconversion.UnmarshalData(r, restored); err != nil || !ok {
42+
return err
43+
}
44+
45+
if restored.Spec.APIServerLoadBalancer.AllowedCIDRs != nil {
46+
dst.Spec.APIServerLoadBalancer.AllowedCIDRs = restored.Spec.APIServerLoadBalancer.AllowedCIDRs
47+
}
48+
49+
return nil
3550
}
3651

3752
func (r *OpenStackCluster) ConvertFrom(srcRaw ctrlconversion.Hub) error {
3853
src := srcRaw.(*infrav1.OpenStackCluster)
3954

40-
return Convert_v1alpha5_OpenStackCluster_To_v1alpha3_OpenStackCluster(src, r, nil)
55+
if err := Convert_v1alpha5_OpenStackCluster_To_v1alpha3_OpenStackCluster(src, r, nil); err != nil {
56+
return err
57+
}
58+
59+
// Preserve Hub data on down-conversion except for metadata
60+
if err := utilconversion.MarshalData(src, r); err != nil {
61+
return err
62+
}
63+
64+
return nil
4165
}
4266

4367
var _ ctrlconversion.Convertible = &OpenStackClusterList{}
@@ -65,7 +89,16 @@ func (r *OpenStackMachine) ConvertTo(dstRaw ctrlconversion.Hub) error {
6589
func (r *OpenStackMachine) ConvertFrom(srcRaw ctrlconversion.Hub) error {
6690
src := srcRaw.(*infrav1.OpenStackMachine)
6791

68-
return Convert_v1alpha5_OpenStackMachine_To_v1alpha3_OpenStackMachine(src, r, nil)
92+
if err := Convert_v1alpha5_OpenStackMachine_To_v1alpha3_OpenStackMachine(src, r, nil); err != nil {
93+
return err
94+
}
95+
96+
// Preserve Hub data on down-conversion except for metadata
97+
if err := utilconversion.MarshalData(src, r); err != nil {
98+
return err
99+
}
100+
101+
return nil
69102
}
70103

71104
var _ ctrlconversion.Convertible = &OpenStackMachineList{}
@@ -93,7 +126,16 @@ func (r *OpenStackMachineTemplate) ConvertTo(dstRaw ctrlconversion.Hub) error {
93126
func (r *OpenStackMachineTemplate) ConvertFrom(srcRaw ctrlconversion.Hub) error {
94127
src := srcRaw.(*infrav1.OpenStackMachineTemplate)
95128

96-
return Convert_v1alpha5_OpenStackMachineTemplate_To_v1alpha3_OpenStackMachineTemplate(src, r, nil)
129+
if err := Convert_v1alpha5_OpenStackMachineTemplate_To_v1alpha3_OpenStackMachineTemplate(src, r, nil); err != nil {
130+
return err
131+
}
132+
133+
// Preserve Hub data on down-conversion except for metadata
134+
if err := utilconversion.MarshalData(src, r); err != nil {
135+
return err
136+
}
137+
138+
return nil
97139
}
98140

99141
var _ ctrlconversion.Convertible = &OpenStackMachineTemplateList{}
@@ -318,3 +360,11 @@ func Convert_v1alpha5_Instance_To_v1alpha3_Instance(in *infrav1.Instance, out *I
318360
}
319361
return nil
320362
}
363+
364+
func Convert_v1alpha5_Router_To_v1alpha3_Router(in *infrav1.Router, out *Router, s conversion.Scope) error {
365+
return autoConvert_v1alpha5_Router_To_v1alpha3_Router(in, out, s)
366+
}
367+
368+
func Convert_v1alpha5_LoadBalancer_To_v1alpha3_LoadBalancer(in *infrav1.LoadBalancer, out *LoadBalancer, s conversion.Scope) error {
369+
return autoConvert_v1alpha5_LoadBalancer_To_v1alpha3_LoadBalancer(in, out, s)
370+
}

‎api/v1alpha3/conversion_test.go

Lines changed: 93 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
fuzz "github.com/google/gofuzz"
2323
"github.com/onsi/gomega"
2424
"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
25+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2526
runtime "k8s.io/apimachinery/pkg/runtime"
2627
runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
2728
utilconversion "sigs.k8s.io/cluster-api/util/conversion"
@@ -99,6 +100,11 @@ func TestConvertFrom(t *testing.T) {
99100
ManagedAPIServerLoadBalancer: true,
100101
APIServerLoadBalancerAdditionalPorts: []int{80, 443},
101102
},
103+
ObjectMeta: metav1.ObjectMeta{
104+
Annotations: map[string]string{
105+
"cluster.x-k8s.io/conversion-data": "{\"spec\":{\"allowAllInClusterTraffic\":false,\"apiServerLoadBalancer\":{\"additionalPorts\":[80,443],\"enabled\":true},\"cloudName\":\"\",\"controlPlaneEndpoint\":{\"host\":\"\",\"port\":0},\"disableAPIServerFloatingIP\":false,\"managedSecurityGroups\":false,\"network\":{},\"subnet\":{}},\"status\":{\"ready\":false}}",
106+
},
107+
},
102108
},
103109
},
104110
}
@@ -121,15 +127,24 @@ func TestFuzzyConversion(t *testing.T) {
121127
fuzzerFuncs := func(_ runtimeserializer.CodecFactory) []interface{} {
122128
return []interface{}{
123129
// Don't test spoke-hub-spoke conversion of v1alpha3 fields which are not in v1alpha5
124-
func(v1alpha3ClusterSpec *OpenStackClusterSpec, c fuzz.Continue) {
125-
c.FuzzNoCustom(v1alpha3ClusterSpec)
130+
func(v1alpha3Cluster *OpenStackCluster, c fuzz.Continue) {
131+
c.FuzzNoCustom(v1alpha3Cluster)
126132

127-
v1alpha3ClusterSpec.UseOctavia = false
133+
v1alpha3Cluster.ObjectMeta.Annotations = map[string]string{}
128134

129-
if v1alpha3ClusterSpec.CloudsSecret != nil {
135+
v1alpha3Cluster.Spec.UseOctavia = false
136+
if v1alpha3Cluster.Spec.CloudsSecret != nil {
130137
// In switching to IdentityRef, fetching the cloud secret
131138
// from a different namespace is no longer supported
132-
v1alpha3ClusterSpec.CloudsSecret.Namespace = ""
139+
v1alpha3Cluster.Spec.CloudsSecret.Namespace = ""
140+
}
141+
142+
if v1alpha3Cluster.Spec.Bastion != nil {
143+
v1alpha3Cluster.Spec.Bastion.Instance.Image = ""
144+
v1alpha3Cluster.Spec.Bastion.Instance.UserDataSecret = nil
145+
if v1alpha3Cluster.Spec.Bastion.Instance.CloudsSecret != nil {
146+
v1alpha3Cluster.Spec.Bastion.Instance.CloudsSecret.Namespace = ""
147+
}
133148
}
134149
},
135150
func(v1alpha3RootVolume *RootVolume, c fuzz.Continue) {
@@ -139,20 +154,34 @@ func TestFuzzyConversion(t *testing.T) {
139154
v1alpha3RootVolume.DeviceType = "disk"
140155
v1alpha3RootVolume.SourceType = "image"
141156
},
142-
func(v1alpha3MachineSpec *OpenStackMachineSpec, c fuzz.Continue) {
143-
c.FuzzNoCustom(v1alpha3MachineSpec)
157+
func(v1alpha3Machine *OpenStackMachine, c fuzz.Continue) {
158+
c.FuzzNoCustom(v1alpha3Machine)
159+
160+
v1alpha3Machine.ObjectMeta.Annotations = map[string]string{}
144161

145-
v1alpha3MachineSpec.UserDataSecret = nil
162+
v1alpha3Machine.Spec.UserDataSecret = nil
146163

147-
if v1alpha3MachineSpec.CloudsSecret != nil {
164+
if v1alpha3Machine.Spec.CloudsSecret != nil {
148165
// In switching to IdentityRef, fetching the cloud secret
149166
// from a different namespace is no longer supported
150-
v1alpha3MachineSpec.CloudsSecret.Namespace = ""
167+
v1alpha3Machine.Spec.CloudsSecret.Namespace = ""
151168
}
152169

153-
if v1alpha3MachineSpec.RootVolume != nil {
170+
if v1alpha3Machine.Spec.RootVolume != nil {
154171
// OpenStackMachineSpec.Image is ignored in v1alpha3 if RootVolume is set
155-
v1alpha3MachineSpec.Image = ""
172+
v1alpha3Machine.Spec.Image = ""
173+
}
174+
},
175+
func(v1alpha3MachineTemplate *OpenStackMachineTemplate, c fuzz.Continue) {
176+
c.FuzzNoCustom(v1alpha3MachineTemplate)
177+
178+
v1alpha3MachineTemplate.ObjectMeta.Annotations = map[string]string{}
179+
180+
v1alpha3MachineTemplate.Spec.Template.Spec.Image = ""
181+
v1alpha3MachineTemplate.Spec.Template.Spec.UserDataSecret = nil
182+
183+
if v1alpha3MachineTemplate.Spec.Template.Spec.CloudsSecret != nil {
184+
v1alpha3MachineTemplate.Spec.Template.Spec.CloudsSecret.Namespace = ""
156185
}
157186
},
158187
func(v1alpha3Instance *Instance, c fuzz.Continue) {
@@ -193,33 +222,67 @@ func TestFuzzyConversion(t *testing.T) {
193222
},
194223

195224
// Don't test hub-spoke-hub conversion of v1alpha5 fields which are not in v1alpha3
196-
func(v1alpha5ClusterSpec *infrav1.OpenStackClusterSpec, c fuzz.Continue) {
197-
c.FuzzNoCustom(v1alpha5ClusterSpec)
225+
func(v1alpha5Cluster *infrav1.OpenStackCluster, c fuzz.Continue) {
226+
c.FuzzNoCustom(v1alpha5Cluster)
227+
228+
v1alpha5Cluster.ObjectMeta.Annotations = map[string]string{}
229+
230+
v1alpha5Cluster.Spec.APIServerFixedIP = ""
231+
v1alpha5Cluster.Spec.AllowAllInClusterTraffic = false
232+
v1alpha5Cluster.Spec.DisableAPIServerFloatingIP = false
233+
v1alpha5Cluster.Spec.APIServerLoadBalancer.AllowedCIDRs = nil
234+
if v1alpha5Cluster.Spec.Bastion != nil {
235+
v1alpha5Cluster.Spec.Bastion.Instance.ImageUUID = ""
236+
v1alpha5Cluster.Spec.Bastion.Instance.Ports = nil
237+
}
238+
239+
v1alpha5Cluster.Status.FailureMessage = nil
240+
v1alpha5Cluster.Status.FailureReason = nil
198241

199-
v1alpha5ClusterSpec.APIServerFixedIP = ""
200-
v1alpha5ClusterSpec.AllowAllInClusterTraffic = false
201-
v1alpha5ClusterSpec.DisableAPIServerFloatingIP = false
242+
if v1alpha5Cluster.Status.Bastion != nil {
243+
v1alpha5Cluster.Status.Bastion.ImageUUID = ""
244+
v1alpha5Cluster.Status.Bastion.Networks = nil
245+
}
246+
247+
if v1alpha5Cluster.Status.Network != nil {
248+
if v1alpha5Cluster.Status.Network.APIServerLoadBalancer != nil {
249+
v1alpha5Cluster.Status.Network.APIServerLoadBalancer.AllowedCIDRs = nil
250+
}
251+
if v1alpha5Cluster.Status.Network.Router != nil {
252+
v1alpha5Cluster.Status.Network.Router.IPs = []string{}
253+
}
254+
}
255+
256+
if v1alpha5Cluster.Status.ExternalNetwork != nil {
257+
if v1alpha5Cluster.Status.ExternalNetwork.APIServerLoadBalancer != nil {
258+
v1alpha5Cluster.Status.ExternalNetwork.APIServerLoadBalancer.AllowedCIDRs = nil
259+
}
260+
if v1alpha5Cluster.Status.ExternalNetwork.Router != nil {
261+
v1alpha5Cluster.Status.ExternalNetwork.Router.IPs = []string{}
262+
}
263+
}
202264
},
203-
func(v1alpha5MachineSpec *infrav1.OpenStackMachineSpec, c fuzz.Continue) {
204-
c.FuzzNoCustom(v1alpha5MachineSpec)
265+
func(v1alpha5Machine *infrav1.OpenStackMachine, c fuzz.Continue) {
266+
c.FuzzNoCustom(v1alpha5Machine)
205267

206-
v1alpha5MachineSpec.Ports = nil
207-
v1alpha5MachineSpec.ImageUUID = ""
268+
v1alpha5Machine.ObjectMeta.Annotations = map[string]string{}
269+
v1alpha5Machine.Spec.Ports = nil
270+
v1alpha5Machine.Spec.ImageUUID = ""
271+
},
272+
func(v1alpha5MachineTemplate *infrav1.OpenStackMachineTemplate, c fuzz.Continue) {
273+
c.FuzzNoCustom(v1alpha5MachineTemplate)
274+
275+
v1alpha5MachineTemplate.ObjectMeta.Annotations = map[string]string{}
276+
277+
v1alpha5MachineTemplate.Spec.Template.Spec.Image = ""
278+
v1alpha5MachineTemplate.Spec.Template.Spec.ImageUUID = ""
279+
v1alpha5MachineTemplate.Spec.Template.Spec.Ports = nil
208280
},
209281
func(v1alpha5Network *infrav1.Network, c fuzz.Continue) {
210282
c.FuzzNoCustom(v1alpha5Network)
211283

212284
v1alpha5Network.PortOpts = nil
213285
},
214-
func(v1alpha5ClusterStatus *infrav1.OpenStackClusterStatus, c fuzz.Continue) {
215-
c.FuzzNoCustom(v1alpha5ClusterStatus)
216-
217-
v1alpha5ClusterStatus.FailureMessage = nil
218-
v1alpha5ClusterStatus.FailureReason = nil
219-
if v1alpha5ClusterStatus.Bastion != nil {
220-
v1alpha5ClusterStatus.Bastion.ImageUUID = ""
221-
}
222-
},
223286
func(v1alpha5OpenStackIdentityRef *infrav1.OpenStackIdentityReference, c fuzz.Continue) {
224287
c.FuzzNoCustom(v1alpha5OpenStackIdentityRef)
225288

0 commit comments

Comments
 (0)