Skip to content

Commit e5037a9

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #555 from hidekazuna/fix_secgroup
🐛 Fix auto generate security groups
2 parents 4343958 + e300493 commit e5037a9

File tree

8 files changed

+275
-155
lines changed

8 files changed

+275
-155
lines changed

‎api/v1alpha3/openstackcluster_types.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -136,9 +136,9 @@ type OpenStackClusterStatus struct {
136136
// TODO: Maybe instead of two properties, we add a property to the group?
137137
ControlPlaneSecurityGroup *SecurityGroup `json:"controlPlaneSecurityGroup,omitempty"`
138138

139-
// GlobalSecurityGroup contains all the information about the OpenStack Security
140-
// Group that needs to be applied to all nodes, both control plane and worker nodes.
141-
GlobalSecurityGroup *SecurityGroup `json:"globalSecurityGroup,omitempty"`
139+
// WorkerSecurityGroup contains all the information about the OpenStack Security
140+
// Group that needs to be applied to worker nodes.
141+
WorkerSecurityGroup *SecurityGroup `json:"workerSecurityGroup,omitempty"`
142142
}
143143

144144
// +kubebuilder:object:root=true

‎api/v1alpha3/types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ type SecurityGroup struct {
190190
// SecurityGroupRule represent the basic information of the associated OpenStack
191191
// Security Group Role.
192192
type SecurityGroupRule struct {
193+
Description string `json:"description"`
193194
ID string `json:"name"`
194195
Direction string `json:"direction"`
195196
EtherType string `json:"etherType"`
@@ -204,6 +205,7 @@ type SecurityGroupRule struct {
204205
// Equal checks if two SecurityGroupRules are the same.
205206
func (r SecurityGroupRule) Equal(x SecurityGroupRule) bool {
206207
return (r.Direction == x.Direction &&
208+
r.Description == x.Description &&
207209
r.EtherType == x.EtherType &&
208210
r.PortRangeMin == x.PortRangeMin &&
209211
r.PortRangeMax == x.PortRangeMax &&

‎api/v1alpha3/zz_generated.deepcopy.go‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_openstackclusters.yaml‎

Lines changed: 55 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -373,6 +373,8 @@ spec:
373373
description: SecurityGroupRule represent the basic information
374374
of the associated OpenStack Security Group Role.
375375
properties:
376+
description:
377+
type: string
376378
direction:
377379
type: string
378380
etherType:
@@ -392,6 +394,7 @@ spec:
392394
securityGroupID:
393395
type: string
394396
required:
397+
- description
395398
- direction
396399
- etherType
397400
- name
@@ -427,55 +430,6 @@ spec:
427430
type: object
428431
description: FailureDomains represent OpenStack availability zones
429432
type: object
430-
globalSecurityGroup:
431-
description: GlobalSecurityGroup contains all the information about
432-
the OpenStack Security Group that needs to be applied to all nodes,
433-
both control plane and worker nodes.
434-
properties:
435-
id:
436-
type: string
437-
name:
438-
type: string
439-
rules:
440-
items:
441-
description: SecurityGroupRule represent the basic information
442-
of the associated OpenStack Security Group Role.
443-
properties:
444-
direction:
445-
type: string
446-
etherType:
447-
type: string
448-
name:
449-
type: string
450-
portRangeMax:
451-
type: integer
452-
portRangeMin:
453-
type: integer
454-
protocol:
455-
type: string
456-
remoteGroupID:
457-
type: string
458-
remoteIPPrefix:
459-
type: string
460-
securityGroupID:
461-
type: string
462-
required:
463-
- direction
464-
- etherType
465-
- name
466-
- portRangeMax
467-
- portRangeMin
468-
- protocol
469-
- remoteGroupID
470-
- remoteIPPrefix
471-
- securityGroupID
472-
type: object
473-
type: array
474-
required:
475-
- id
476-
- name
477-
- rules
478-
type: object
479433
network:
480434
description: Network contains all information about the created OpenStack
481435
Network. It includes Subnets and Router.
@@ -535,6 +489,58 @@ spec:
535489
type: object
536490
ready:
537491
type: boolean
492+
workerSecurityGroup:
493+
description: WorkerSecurityGroup contains all the information about
494+
the OpenStack Security Group that needs to be applied to worker
495+
nodes.
496+
properties:
497+
id:
498+
type: string
499+
name:
500+
type: string
501+
rules:
502+
items:
503+
description: SecurityGroupRule represent the basic information
504+
of the associated OpenStack Security Group Role.
505+
properties:
506+
description:
507+
type: string
508+
direction:
509+
type: string
510+
etherType:
511+
type: string
512+
name:
513+
type: string
514+
portRangeMax:
515+
type: integer
516+
portRangeMin:
517+
type: integer
518+
protocol:
519+
type: string
520+
remoteGroupID:
521+
type: string
522+
remoteIPPrefix:
523+
type: string
524+
securityGroupID:
525+
type: string
526+
required:
527+
- description
528+
- direction
529+
- etherType
530+
- name
531+
- portRangeMax
532+
- portRangeMin
533+
- protocol
534+
- remoteGroupID
535+
- remoteIPPrefix
536+
- securityGroupID
537+
type: object
538+
type: array
539+
required:
540+
- id
541+
- name
542+
- rules
543+
type: object
538544
required:
539545
- ready
540546
type: object

‎controllers/openstackcluster_controller.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -136,9 +136,9 @@ func (r *OpenStackClusterReconciler) reconcileDelete(ctx context.Context, log lo
136136
}
137137

138138
// Delete other things
139-
if openStackCluster.Status.GlobalSecurityGroup != nil {
140-
log.Info("Deleting global security group", "name", openStackCluster.Status.GlobalSecurityGroup.Name)
141-
err := networkingService.DeleteSecurityGroups(openStackCluster.Status.GlobalSecurityGroup)
139+
if openStackCluster.Status.WorkerSecurityGroup != nil {
140+
log.Info("Deleting worker security group", "name", openStackCluster.Status.WorkerSecurityGroup.Name)
141+
err := networkingService.DeleteSecurityGroups(openStackCluster.Status.WorkerSecurityGroup)
142142
if err != nil {
143143
return reconcile.Result{}, errors.Errorf("failed to delete security group: %v", err)
144144
}

‎docs/configuration.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,21 @@ openstack keypair create <name>
6767
```
6868
The keypair must be exposed as an environment variable `OPENSTACK_SSH_AUTHORIZED_KEY`.
6969

70+
If you want to login to each machine by ssh, you have to configure security groups. If `spec.managedSecurityGroups` of `OpenStackCluster` set to true, two security groups will be created. One is `k8s-cluster-${NAMESPACE}-${CLUSTER_NAME}-secgroup-controlplane`, another is `k8s-cluster-${NAMESPACE}-${CLUSTER_NAME}-secgroup-worker`. These security group rules are following kubeadm's [Check required ports](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) so that each node can not be logged in through ssh by default. Please add existing security group allowing ssh port to `OpenStackMachineTemplate` spec. Here is an example:
71+
72+
```yaml
73+
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha3
74+
kind: OpenStackMachineTemplate
75+
metadata:
76+
name: ${CLUSTER_NAME}-control-plane
77+
spec:
78+
template:
79+
spec:
80+
securityGroups:
81+
- name: k8s-cluster-${NAMESPACE}-${CLUSTER_NAME}-secgroup-controlplane
82+
- name: allow-ssh
83+
```
84+
7085
## Network Filters
7186
7287
If you have a complex query that you want to use to lookup a network, then you can do this by using a network filter. More details about the filter can be found in [NetworkParam](../api/v1alpha3/types.go)

0 commit comments

Comments
 (0)