Add additional sec group rule for additionalPorts of LB

Author: jichenjc

pkg/cloud/services/networking/securitygroups.go

@@ -121,6 +121,11 @@ func (s *Service) generateDesiredSecGroups(openStackCluster *infrav1.OpenStackCl
 	controlPlaneRules = append(controlPlaneRules, GetSGControlPlaneHTTPS()...)
 	workerRules = append(workerRules, GetSGWorkerNodePort()...)
 
+	// If we set additional ports to LB, we need create secgroup rules those ports, this apply to controlPlaneRules only
+	if openStackCluster.Spec.APIServerLoadBalancer.Enabled {
+		controlPlaneRules = append(controlPlaneRules, GetSGControlPlaneAdditionalPorts(openStackCluster.Spec.APIServerLoadBalancer.AdditionalPorts)...)
+	}
+
 	if openStackCluster.Spec.AllowAllInClusterTraffic {
 		// Permit all ingress from the cluster security groups
 		controlPlaneRules = append(controlPlaneRules, GetSGControlPlaneAllowAll(remoteGroupIDSelf, secWorkerGroupID)...)

pkg/cloud/services/networking/securitygroups_rules.go

@@ -291,6 +291,34 @@ func GetSGWorkerAllowAll(remoteGroupIDSelf, secControlPlaneGroupID string) []inf
 	}
 }
 
+// Permit ports that defined in openStackCluster.Spec.APIServerLoadBalancer.AdditionalPorts.
+func GetSGControlPlaneAdditionalPorts(ports []int) []infrav1.SecurityGroupRule {
+	controlPlaneRules := []infrav1.SecurityGroupRule{}
+
+	r := []infrav1.SecurityGroupRule{
+		{
+			Description: "Additional ports",
+			Direction:   "ingress",
+			EtherType:   "IPv4",
+			Protocol:    "tcp",
+		},
+		{
+			Description: "Additional ports",
+			Direction:   "ingress",
+			EtherType:   "IPv4",
+			Protocol:    "udp",
+		},
+	}
+	for _, p := range ports {
+		r[0].PortRangeMin = p
+		r[0].PortRangeMax = p
+		r[1].PortRangeMin = p
+		r[1].PortRangeMax = p
+		controlPlaneRules = append(controlPlaneRules, r...)
+	}
+	return controlPlaneRules
+}
+
 func GetSGControlPlaneGeneral(remoteGroupIDSelf, secWorkerGroupID string) []infrav1.SecurityGroupRule {
 	controlPlaneRules := []infrav1.SecurityGroupRule{}
 	controlPlaneRules = append(controlPlaneRules, getSGControlPlaneCommon(remoteGroupIDSelf, secWorkerGroupID)...)