Skip to content

Commit 03dccef

Browse files
chrisliu1995chrisliu1995
authored
feat: add SecurityProtectionTypes support for Auto-NLBs-V2 (#305)
- Support DDoS protection (AntiDDoS_Enhanced) - Add SecurityProtectionTypes configuration parameter - Update documentation with examples and restrictions - Add comprehensive test cases - Compatible with existing configurations (backward compatible) Changes: - cloudprovider: Add SecurityProtectionTypes config parsing - cloudprovider: Apply SecurityProtectionTypes to EIP CR creation - docs: Add SecurityProtectionTypes parameter documentation (EN/CN) - docs: Add DDoS protection usage example - test: Add 4 test cases for SecurityProtectionTypes Test coverage: 41.0% (alibabacloud package)
1 parent 25626ff commit 03dccef

File tree

5 files changed

+265
-29
lines changed

5 files changed

+265
-29
lines changed

‎cloudprovider/alibabacloud/auto_nlbs.go‎

Lines changed: 35 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,8 @@ const (
4848
MinPortConfigName = "MinPort"
4949
MaxPortConfigName = "MaxPort"
5050
BlockPortsConfigName = "BlockPorts"
51+
// EIP 高防护相关配置
52+
SecurityProtectionTypesConfigName = "SecurityProtectionTypes" // EIP 安全防护类型，多个用逗号分隔
5153

5254
NLBZoneMapsServiceAnnotationKey = "service.beta.kubernetes.io/alibaba-cloud-loadbalancer-zone-maps"
5355
NLBAddressTypeAnnotationKey = "service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type"
@@ -62,16 +64,17 @@ type AutoNLBsPlugin struct {
6264
}
6365

6466
type autoNLBsConfig struct {
65-
minPort int32
66-
maxPort int32
67-
blockPorts []int32
68-
zoneMaps string
69-
reserveNlbNum int
70-
targetPorts []int
71-
protocols []corev1.Protocol
72-
eipIspTypes []string
73-
externalTrafficPolicy corev1.ServiceExternalTrafficPolicyType
74-
retainNLBOnDelete bool // 是否在 GSS 删除时保留 NLB 和 EIP 资源（默认 true）
67+
minPort int32
68+
maxPort int32
69+
blockPorts []int32
70+
zoneMaps string
71+
reserveNlbNum int
72+
targetPorts []int
73+
protocols []corev1.Protocol
74+
eipIspTypes []string
75+
externalTrafficPolicy corev1.ServiceExternalTrafficPolicyType
76+
retainNLBOnDelete bool // 是否在 GSS 删除时保留 NLB 和 EIP 资源（默认 true）
77+
securityProtectionTypes []string // EIP 安全防护类型（如 AntiDDoS_Enhanced）
7578
*nlbHealthConfig
7679
}
7780

@@ -471,6 +474,7 @@ func parseAutoNLBsConfig(conf []gamekruiseiov1alpha1.NetworkConfParams) (*autoNL
471474
blockPorts := make([]int32, 0)
472475
minPort := int32(1000)
473476
maxPort := int32(1499)
477+
securityProtectionTypes := make([]string, 0) // 默认为空，不启用高防护
474478

475479
for _, c := range conf {
476480
switch c.Name {
@@ -519,6 +523,15 @@ func parseAutoNLBsConfig(conf []gamekruiseiov1alpha1.NetworkConfParams) (*autoNL
519523
} else {
520524
maxPort = int32(val)
521525
}
526+
case SecurityProtectionTypesConfigName:
527+
// 解析安全防护类型，支持逗号分隔多个类型
528+
if c.Value != "" {
529+
securityProtectionTypes = strings.Split(c.Value, ",")
530+
// 去除空格
531+
for i := range securityProtectionTypes {
532+
securityProtectionTypes[i] = strings.TrimSpace(securityProtectionTypes[i])
533+
}
534+
}
522535
}
523536
}
524537

@@ -541,16 +554,17 @@ func parseAutoNLBsConfig(conf []gamekruiseiov1alpha1.NetworkConfParams) (*autoNL
541554
}
542555

543556
return &autoNLBsConfig{
544-
blockPorts: blockPorts,
545-
minPort: minPort,
546-
maxPort: maxPort,
547-
nlbHealthConfig: nlbHealthConfig,
548-
reserveNlbNum: reserveNlbNum,
549-
eipIspTypes: eipIspTypes,
550-
protocols: protocols,
551-
targetPorts: ports,
552-
zoneMaps: zoneMaps,
553-
externalTrafficPolicy: externalTrafficPolicy,
554-
retainNLBOnDelete: retainNLBOnDelete,
557+
blockPorts: blockPorts,
558+
minPort: minPort,
559+
maxPort: maxPort,
560+
nlbHealthConfig: nlbHealthConfig,
561+
reserveNlbNum: reserveNlbNum,
562+
eipIspTypes: eipIspTypes,
563+
protocols: protocols,
564+
targetPorts: ports,
565+
zoneMaps: zoneMaps,
566+
externalTrafficPolicy: externalTrafficPolicy,
567+
retainNLBOnDelete: retainNLBOnDelete,
568+
securityProtectionTypes: securityProtectionTypes,
555569
}, nil
556570
}

‎cloudprovider/alibabacloud/auto_nlbs_v2.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1230,12 +1230,13 @@ func (a *AutoNLBsV2Plugin) ensureEIPCR(ctx context.Context, c client.Client, nam
12301230
},
12311231
},
12321232
Spec: eipv1.EIPSpec{
1233-
Name: eipName,
1234-
Bandwidth: "5", // 默认带宽 5Mbps，可以后续通过配置调整
1235-
InternetChargeType: internetChargeType, // 根据 ISP 类型选择计费方式
1236-
ISP: eipIspType, // 设置 ISP 线路类型（支持单线 EIP）
1237-
ReleaseStrategy: "OnDelete", // CR 删除时释放 EIP
1238-
Description: fmt.Sprintf("EIP for GameServerSet %s, NLB index %d, zone %d", gssName, nlbIndex, zoneIndex),
1233+
Name: eipName,
1234+
Bandwidth: "5", // 默认带宽 5Mbps，可以后续通过配置调整
1235+
InternetChargeType: internetChargeType, // 根据 ISP 类型选择计费方式
1236+
ISP: eipIspType, // 设置 ISP 线路类型（支持单线 EIP）
1237+
ReleaseStrategy: "OnDelete", // CR 删除时释放 EIP
1238+
Description: fmt.Sprintf("EIP for GameServerSet %s, NLB index %d, zone %d", gssName, nlbIndex, zoneIndex),
1239+
SecurityProtectionTypes: config.securityProtectionTypes, // 安全防护类型（高防护 EIP）
12391240
},
12401241
}
12411242

‎cloudprovider/alibabacloud/auto_nlbs_v2_test.go‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,101 @@ func TestParseAutoNLBsConfig(t *testing.T) {
181181
expectError: true,
182182
errorContains: "MinPort",
183183
},
184+
{
185+
name: "valid config with SecurityProtectionTypes - single type",
186+
conf: []gamekruiseiov1alpha1.NetworkConfParams{
187+
{Name: "ZoneMaps", Value: "vpc-xxx@cn-hangzhou-h:vsw-aaa,cn-hangzhou-i:vsw-bbb"},
188+
{Name: "PortProtocols", Value: "8080/TCP"},
189+
{Name: "EipIspTypes", Value: "BGP"},
190+
{Name: "SecurityProtectionTypes", Value: "AntiDDoS_Enhanced"},
191+
{Name: "MinPort", Value: "10000"},
192+
{Name: "MaxPort", Value: "10999"},
193+
},
194+
expectConfig: &autoNLBsConfig{
195+
zoneMaps: "vpc-xxx@cn-hangzhou-h:vsw-aaa,cn-hangzhou-i:vsw-bbb",
196+
eipIspTypes: []string{"BGP"},
197+
targetPorts: []int{8080},
198+
protocols: []corev1.Protocol{corev1.ProtocolTCP},
199+
minPort: 10000,
200+
maxPort: 10999,
201+
reserveNlbNum: 1,
202+
externalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeLocal,
203+
retainNLBOnDelete: true,
204+
securityProtectionTypes: []string{"AntiDDoS_Enhanced"},
205+
},
206+
expectError: false,
207+
},
208+
{
209+
name: "valid config with SecurityProtectionTypes - whitespace trimming",
210+
conf: []gamekruiseiov1alpha1.NetworkConfParams{
211+
{Name: "ZoneMaps", Value: "vpc-xxx@cn-hangzhou-h:vsw-aaa,cn-hangzhou-i:vsw-bbb"},
212+
{Name: "PortProtocols", Value: "8080/TCP,9000/UDP"},
213+
{Name: "EipIspTypes", Value: "BGP"},
214+
{Name: "SecurityProtectionTypes", Value: " AntiDDoS_Enhanced "},
215+
{Name: "MinPort", Value: "10000"},
216+
{Name: "MaxPort", Value: "10999"},
217+
},
218+
expectConfig: &autoNLBsConfig{
219+
zoneMaps: "vpc-xxx@cn-hangzhou-h:vsw-aaa,cn-hangzhou-i:vsw-bbb",
220+
eipIspTypes: []string{"BGP"},
221+
targetPorts: []int{8080, 9000},
222+
protocols: []corev1.Protocol{corev1.ProtocolTCP, corev1.ProtocolUDP},
223+
minPort: 10000,
224+
maxPort: 10999,
225+
reserveNlbNum: 1,
226+
externalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeLocal,
227+
retainNLBOnDelete: true,
228+
securityProtectionTypes: []string{"AntiDDoS_Enhanced"},
229+
},
230+
expectError: false,
231+
},
232+
{
233+
name: "empty SecurityProtectionTypes should result in empty slice",
234+
conf: []gamekruiseiov1alpha1.NetworkConfParams{
235+
{Name: "ZoneMaps", Value: "vpc-xxx@cn-hangzhou-h:vsw-aaa,cn-hangzhou-i:vsw-bbb"},
236+
{Name: "PortProtocols", Value: "8080/TCP"},
237+
{Name: "EipIspTypes", Value: "BGP"},
238+
{Name: "SecurityProtectionTypes", Value: ""},
239+
{Name: "MinPort", Value: "10000"},
240+
{Name: "MaxPort", Value: "10999"},
241+
},
242+
expectConfig: &autoNLBsConfig{
243+
zoneMaps: "vpc-xxx@cn-hangzhou-h:vsw-aaa,cn-hangzhou-i:vsw-bbb",
244+
eipIspTypes: []string{"BGP"},
245+
targetPorts: []int{8080},
246+
protocols: []corev1.Protocol{corev1.ProtocolTCP},
247+
minPort: 10000,
248+
maxPort: 10999,
249+
reserveNlbNum: 1,
250+
externalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeLocal,
251+
retainNLBOnDelete: true,
252+
securityProtectionTypes: []string{},
253+
},
254+
expectError: false,
255+
},
256+
{
257+
name: "no SecurityProtectionTypes specified - default to empty",
258+
conf: []gamekruiseiov1alpha1.NetworkConfParams{
259+
{Name: "ZoneMaps", Value: "vpc-xxx@cn-hangzhou-h:vsw-aaa,cn-hangzhou-i:vsw-bbb"},
260+
{Name: "PortProtocols", Value: "8080/TCP"},
261+
{Name: "EipIspTypes", Value: "BGP"},
262+
{Name: "MinPort", Value: "10000"},
263+
{Name: "MaxPort", Value: "10999"},
264+
},
265+
expectConfig: &autoNLBsConfig{
266+
zoneMaps: "vpc-xxx@cn-hangzhou-h:vsw-aaa,cn-hangzhou-i:vsw-bbb",
267+
eipIspTypes: []string{"BGP"},
268+
targetPorts: []int{8080},
269+
protocols: []corev1.Protocol{corev1.ProtocolTCP},
270+
minPort: 10000,
271+
maxPort: 10999,
272+
reserveNlbNum: 1,
273+
externalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeLocal,
274+
retainNLBOnDelete: true,
275+
securityProtectionTypes: []string{},
276+
},
277+
expectError: false,
278+
},
184279
}
185280

186281
for _, tt := range tests {
@@ -230,6 +325,10 @@ func TestParseAutoNLBsConfig(t *testing.T) {
230325
if config.retainNLBOnDelete != tt.expectConfig.retainNLBOnDelete {
231326
t.Errorf("retainNLBOnDelete: expected %v, got %v", tt.expectConfig.retainNLBOnDelete, config.retainNLBOnDelete)
232327
}
328+
329+
if !stringSliceEqual(config.securityProtectionTypes, tt.expectConfig.securityProtectionTypes) {
330+
t.Errorf("securityProtectionTypes: expected %v, got %v", tt.expectConfig.securityProtectionTypes, config.securityProtectionTypes)
331+
}
233332
})
234333
}
235334
}

‎docs/en/user_manuals/network.md‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -845,6 +845,23 @@ EipIspTypes
845845
- Example: `BGP,BGP_PRO` or `ChinaTelecom,ChinaMobile,ChinaUnicom`
846846
- Configuration change supported: No
847847

848+
SecurityProtectionTypes
849+
850+
- Meaning: EIP security protection types, supports DDoS protection
851+
- Format: `type1,type2,...` (comma-separated for multiple types)
852+
- Available values:
853+
- `AntiDDoS_Enhanced`: DDoS Protection (Enhanced) - Provides Tbps-level professional DDoS protection
854+
- Example: `AntiDDoS_Enhanced`
855+
- Configuration change supported: No
856+
- Default: Empty (no protection enabled)
857+
- Usage restrictions:
858+
- Only supports pay-as-you-go mode (`PostPaid`)
859+
- Only supports BGP (multi-line) ISP type
860+
- Not compatible with single-line ISP types (ChinaTelecom/ChinaMobile/ChinaUnicom)
861+
- Supported regions: cn-beijing, cn-hangzhou, cn-shanghai, cn-hongkong, etc.
862+
- Additional security protection fees apply
863+
- Note: Currently only `AntiDDoS_Enhanced` type is supported. If configured with incompatible ISP types, EIP CR creation will fail with error from Alibaba Cloud API
864+
848865
MinPort
849866

850867
- Meaning: Minimum value for NLB external port allocation
@@ -1148,6 +1165,50 @@ spec:
11481165
name: gameserver
11491166
```
11501167
1168+
**Example 5: Enable DDoS Protection (Enhanced)**
1169+
1170+
```yaml
1171+
apiVersion: game.kruise.io/v1alpha1
1172+
kind: GameServerSet
1173+
metadata:
1174+
name: gs-ddos-protected
1175+
namespace: default
1176+
spec:
1177+
replicas: 5
1178+
updateStrategy:
1179+
rollingUpdate:
1180+
podUpdatePolicy: InPlaceIfPossible
1181+
network:
1182+
networkType: AlibabaCloud-AutoNLBs-V2
1183+
networkConf:
1184+
- name: ZoneMaps
1185+
value: "vpc-xxx@cn-hangzhou-h:vsw-aaa,cn-hangzhou-i:vsw-bbb"
1186+
- name: PortProtocols
1187+
value: "8080/TCP,9000/UDP"
1188+
- name: EipIspTypes
1189+
value: "BGP" # DDoS protection requires BGP line
1190+
- name: SecurityProtectionTypes
1191+
value: "AntiDDoS_Enhanced" # Enable DDoS Protection (Enhanced)
1192+
- name: MinPort
1193+
value: "10000"
1194+
- name: MaxPort
1195+
value: "10999"
1196+
- name: LBHealthCheckFlag
1197+
value: "on"
1198+
gameServerTemplate:
1199+
spec:
1200+
containers:
1201+
- image: registry.cn-hangzhou.aliyuncs.com/gs-demo/gameserver:network
1202+
name: gameserver
1203+
```
1204+
1205+
> **Important Notes for DDoS Protection:**
1206+
> - Must use BGP line type (`EipIspTypes: BGP`), not compatible with single-line ISP (ChinaTelecom/ChinaMobile/ChinaUnicom)
1207+
> - Only supports pay-as-you-go mode, cannot use subscription billing
1208+
> - Additional security protection fees will apply
1209+
> - Check EIP CR status to verify successful activation: `kubectl get eip -n default`
1210+
> - If configuration is incompatible, EIP CR creation will fail with error message from Alibaba Cloud API
1211+
11511212
#### Generated GameServer Network Status
11521213

11531214
> **Note**: In Auto NLB V2 mode, `externalAddresses` will be populated with:
@@ -1287,7 +1348,7 @@ kubectl get svc -l game.kruise.io/owner-gss=gs-auto-nlb-v2
12871348
- **Cascade deletion mode (`RetainNLBOnDelete=false`)**: NLB and EIP resources will be automatically deleted when GSS is deleted, no manual cleanup required
12881349

12891350
2. **Network Configuration Immutability**
1290-
- Parameters like `ZoneMaps`, `PortProtocols`, `EipIspTypes` cannot be changed after creation
1351+
- Parameters like `ZoneMaps`, `PortProtocols`, `EipIspTypes`, `SecurityProtectionTypes` cannot be changed after creation
12911352
- When changes are needed, recommend creating a new GameServerSet and migrating
12921353

12931354
3. **Single-line ISP Billing**

‎docs/中文/用户手册/网络模型.md‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -843,6 +843,23 @@ EipIspTypes
843843
- 示例：`BGP,BGP_PRO` 或 `ChinaTelecom,ChinaMobile,ChinaUnicom`
844844
- 是否支持变更：否
845845

846+
SecurityProtectionTypes
847+
848+
- 含义：EIP 安全防护类型，支持 DDoS 高防护
849+
- 填写格式：`type1,type2,...`（多个类型用逗号分隔）
850+
- 可选值：
851+
- `AntiDDoS_Enhanced`：DDoS 防护（增强版）- 提供 Tbps 级专业 DDoS 防护能力
852+
- 示例：`AntiDDoS_Enhanced`
853+
- 是否支持变更：否
854+
- 默认值：空（不启用防护）
855+
- 使用限制：
856+
- 仅支持按量付费模式（`PostPaid`）
857+
- 仅支持 BGP（多线）线路类型
858+
- 不兼容单线 ISP 类型（ChinaTelecom/ChinaMobile/ChinaUnicom）
859+
- 支持地域：华北2（北京）、华东1（杭州）、华东2（上海）、中国香港等
860+
- 会产生额外的安全防护费用
861+
- 说明：目前仅支持 `AntiDDoS_Enhanced` 类型。如果配置了不兼容的 ISP 类型，EIP CR 创建将失败，错误信息由阿里云 API 返回
862+
846863
MinPort
847864

848865
- 含义：NLB 外部端口分配的最小值
@@ -1146,6 +1163,50 @@ spec:
11461163
name: gameserver
11471164
```
11481165
1166+
**示例 5：启用 DDoS 高防护（增强版）**
1167+
1168+
```yaml
1169+
apiVersion: game.kruise.io/v1alpha1
1170+
kind: GameServerSet
1171+
metadata:
1172+
name: gs-ddos-protected
1173+
namespace: default
1174+
spec:
1175+
replicas: 5
1176+
updateStrategy:
1177+
rollingUpdate:
1178+
podUpdatePolicy: InPlaceIfPossible
1179+
network:
1180+
networkType: AlibabaCloud-AutoNLBs-V2
1181+
networkConf:
1182+
- name: ZoneMaps
1183+
value: "vpc-xxx@cn-hangzhou-h:vsw-aaa,cn-hangzhou-i:vsw-bbb"
1184+
- name: PortProtocols
1185+
value: "8080/TCP,9000/UDP"
1186+
- name: EipIspTypes
1187+
value: "BGP" # DDoS 高防护必须使用 BGP 线路
1188+
- name: SecurityProtectionTypes
1189+
value: "AntiDDoS_Enhanced" # 启用 DDoS 防护（增强版）
1190+
- name: MinPort
1191+
value: "10000"
1192+
- name: MaxPort
1193+
value: "10999"
1194+
- name: LBHealthCheckFlag
1195+
value: "on"
1196+
gameServerTemplate:
1197+
spec:
1198+
containers:
1199+
- image: registry.cn-hangzhou.aliyuncs.com/gs-demo/gameserver:network
1200+
name: gameserver
1201+
```
1202+
1203+
> **DDoS 高防护重要说明：**
1204+
> - 必须使用 BGP 线路类型（`EipIspTypes: BGP`），不兼容单线 ISP（ChinaTelecom/ChinaMobile/ChinaUnicom）
1205+
> - 仅支持按量付费模式，不能使用包年包月
1206+
> - 会产生额外的安全防护费用
1207+
> - 查看 EIP CR 状态确认是否成功激活：`kubectl get eip -n default`
1208+
> - 如果配置不兼容，EIP CR 创建将失败，错误信息由阿里云 API 返回
1209+
11491210
#### 生成的 GameServer 网络状态
11501211

11511212
> **注意**：Auto NLB V2 模式下，`externalAddresses` 中会填充：
@@ -1285,7 +1346,7 @@ kubectl get svc -l game.kruise.io/owner-gss=gs-auto-nlb-v2
12851346
- **级联删除模式（`RetainNLBOnDelete=false`）**：删除 GSS 时会自动删除对应的 NLB 和 EIP 资源，无需手动清理
12861347

12871348
2. **网络配置不可变**
1288-
- `ZoneMaps`、`PortProtocols`、`EipIspTypes` 等参数创建后不可修改
1349+
- `ZoneMaps`、`PortProtocols`、`EipIspTypes`、`SecurityProtectionTypes` 等参数创建后不可修改
12891350
- 需要变更时，建议创建新的 GameServerSet 并迁移
12901351

12911352
3. **单线 ISP 计费**

0 commit comments

Comments
 (0)