Power VS: Granular security groups

pkg/asset/installconfig/powervs/client.go

@@ -80,8 +80,9 @@ type API interface {
 	ServiceInstanceNameToGUID(ctx context.Context, name string) (string, error)
 
 	// Security Group
+	ListSecurityGroups(ctx context.Context, vpcID string, regions string) ([]vpcv1.SecurityGroup, error)
 	ListSecurityGroupRules(ctx context.Context, securityGroupID string) (*vpcv1.SecurityGroupRuleCollection, error)
-	AddSecurityGroupRule(ctx context.Context, securityGroupID string, rule *vpcv1.SecurityGroupRulePrototype) error
+	AddSecurityGroupRule(ctx context.Context, vpcID string, sgID string, rule *vpcv1.SecurityGroupRulePrototype) error
 
 	// SSH
 	CreateSSHKey(ctx context.Context, serviceInstance string, zone string, sshKeyName string, sshKey string) error
@@ -1280,6 +1281,44 @@ func (c *Client) getTransitConnections(ctx context.Context, tgID string) ([]tran
 	return result, nil
 }
 
+func (c *Client) ListSecurityGroups(ctx context.Context, vpcID string, region string) ([]vpcv1.SecurityGroup, error) {
+	var groupID string
+	localContext, cancel := context.WithTimeout(ctx, 1*time.Minute)
+	defer cancel()
+	groups, err := c.ListResourceGroups(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list resource groups: %w", err)
+	}
+
+	err = c.SetVPCServiceURLForRegion(ctx, region)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, group := range groups.Resources {
+		if *group.Name == c.BXCli.PowerVSResourceGroup {
+			groupID = *group.ID
+		}
+	}
+	listSecurityGroupOptions := c.vpcAPI.NewListSecurityGroupsOptions()
+	listSecurityGroupOptions.SetVPCID(vpcID)
+	listSecurityGroupOptions.SetResourceGroupID(groupID)
+	securityGroupsPager, err := c.vpcAPI.NewSecurityGroupsPager(listSecurityGroupOptions)
+	if err != nil {
+		return nil, fmt.Errorf("failed creating pager for security group lookup: %w", err)
+	}
+
+	securityGroups, err := securityGroupsPager.GetAllWithContext(localContext)
+	logrus.Debugf("%v security groups found", len(securityGroups))
+	if err != nil {
+		return nil, fmt.Errorf("failed collecting all security groups with pager: %w", err)
+	}
+	for _, sg := range securityGroups {
+		logrus.Debugf("SG Name %v found", *sg.Name)
+	}
+	return securityGroups, nil
+}
+
 // ListSecurityGroupRules returns a list of the security group rules.
 func (c *Client) ListSecurityGroupRules(ctx context.Context, securityGroupID string) (*vpcv1.SecurityGroupRuleCollection, error) {
 	logrus.Debugf("ListSecurityGroupRules: securityGroupID = %s", securityGroupID)
@@ -1312,8 +1351,8 @@ func (c *Client) ListSecurityGroupRules(ctx context.Context, securityGroupID str
 }
 
 // AddSecurityGroupRule adds a security group rule to an existing security group.
-func (c *Client) AddSecurityGroupRule(ctx context.Context, securityGroupID string, rule *vpcv1.SecurityGroupRulePrototype) error {
-	logrus.Debugf("AddSecurityGroupRule: securityGroupID = %s, rule = %+v", securityGroupID, *rule)
+func (c *Client) AddSecurityGroupRule(ctx context.Context, vpcID string, sgID string, rule *vpcv1.SecurityGroupRulePrototype) error {
+	logrus.Debugf("AddSecurityGroupRule: vpcID = %s, rule = %+v", vpcID, *rule)
 
 	var (
 		vpcOptions  *vpcv1.GetVPCOptions
@@ -1324,7 +1363,7 @@ func (c *Client) AddSecurityGroupRule(ctx context.Context, securityGroupID strin
 		err         error
 	)
 
-	vpcOptions = c.vpcAPI.NewGetVPCOptions(securityGroupID)
+	vpcOptions = c.vpcAPI.NewGetVPCOptions(vpcID)
 
 	vpc, response, err = c.vpcAPI.GetVPC(vpcOptions)
 	if err != nil {
@@ -1333,7 +1372,11 @@ func (c *Client) AddSecurityGroupRule(ctx context.Context, securityGroupID strin
 	logrus.Debugf("AddSecurityGroupRule: vpc = %+v", vpc)
 
 	optionsCSGR = &vpcv1.CreateSecurityGroupRuleOptions{}
-	optionsCSGR.SetSecurityGroupID(*vpc.DefaultSecurityGroup.ID)
+	if sgID == "" {
+		optionsCSGR.SetSecurityGroupID(*vpc.DefaultSecurityGroup.ID)
+	} else {
+		optionsCSGR.SetSecurityGroupID(sgID)
+	}
 	optionsCSGR.SetSecurityGroupRulePrototype(rule)
 
 	result, response, err = c.vpcAPI.CreateSecurityGroupRuleWithContext(ctx, optionsCSGR)

pkg/asset/installconfig/powervs/metadata.go

@@ -462,7 +462,7 @@ func (m *Metadata) SetVPCServiceURLForRegion(ctx context.Context, vpcRegion stri
 }
 
 // AddSecurityGroupRule adds a security group rule to the specified VPC.
-func (m *Metadata) AddSecurityGroupRule(ctx context.Context, rule *vpcv1.SecurityGroupRulePrototype, vpcID string) error {
+func (m *Metadata) AddSecurityGroupRule(ctx context.Context, rule *vpcv1.SecurityGroupRulePrototype, vpcID string, sgID string) error {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
@@ -479,7 +479,7 @@ func (m *Metadata) AddSecurityGroupRule(ctx context.Context, rule *vpcv1.Securit
 
 	var lastErr error
 	err = wait.ExponentialBackoffWithContext(ctx, backoff, func(context.Context) (bool, error) {
-		lastErr = client.AddSecurityGroupRule(ctx, vpcID, rule)
+		lastErr = client.AddSecurityGroupRule(ctx, vpcID, sgID, rule)
 		return lastErr == nil, nil
 	})
 

pkg/asset/manifests/powervs/cluster.go

@@ -168,6 +168,7 @@ func GenerateClusterAssets(installConfig *installconfig.InstallConfig, clusterID
 
 	bucketName = fmt.Sprintf("%s-bootstrap-ign", clusterID.InfraID)
 
+	vpcSecurityGroups := getVPCSecurityGroups(clusterID.InfraID, installConfig.Config.Publish)
 	powerVSCluster = &capibm.IBMPowerVSCluster{
 		TypeMeta: metav1.TypeMeta{
 			APIVersion: capibm.GroupVersion.String(),
@@ -187,8 +188,9 @@ func GenerateClusterAssets(installConfig *installconfig.InstallConfig, clusterID
 			DHCPServer: &capibm.DHCPServer{
 				Cidr: &dhcpSubnet,
 			},
-			ServiceInstance: &service,
-			Zone:            &installConfig.Config.Platform.PowerVS.Zone,
+			VPCSecurityGroups: vpcSecurityGroups,
+			ServiceInstance:   &service,
+			Zone:              &installConfig.Config.Platform.PowerVS.Zone,
 			ResourceGroup: &capibm.IBMPowerVSResourceReference{
 				Name: &installConfig.Config.Platform.PowerVS.PowerVSResourceGroup,
 			},
@@ -207,6 +209,11 @@ func GenerateClusterAssets(installConfig *installconfig.InstallConfig, clusterID
 						//	Port: 6443,
 						// },
 					},
+					SecurityGroups: []capibm.VPCResource{
+						{
+							Name: ptr.To(fmt.Sprintf("%s-%s", clusterID.InfraID, kubeAPILBSGNameSuffix)),
+						},
+					},
 				},
 				{
 					Name:   fmt.Sprintf("%s-loadbalancer-int", clusterID.InfraID),

pkg/asset/manifests/powervs/securitygroups.go

@@ -0,0 +1,111 @@
+package powervs
+
+import (
+	"fmt"
+
+	"k8s.io/utils/ptr"
+	capibmcloud "sigs.k8s.io/cluster-api-provider-ibmcloud/api/v1beta2"
+
+	"github.com/openshift/installer/pkg/types"
+)
+
+const (
+	bootstrapSGNameSuffix    = "sg-bootstrap"
+	clusterWideSGNameSuffix  = "sg-clusterwide"
+	controlPlaneSGNameSuffix = "sg-control-plane"
+	cpInternalSGNameSuffix   = "sg-cp-internal"
+	kubeAPILBSGNameSuffix    = "sg-kube-api-lb"
+	openshiftNetSGNameSuffix = "sg-openshift-net"
+)
+
+func buildBootstrapSecurityGroup(infraID string) capibmcloud.VPCSecurityGroup {
+	bootstrapSGNamePtr := ptr.To(fmt.Sprintf("%s-%s", infraID, bootstrapSGNameSuffix))
+	return capibmcloud.VPCSecurityGroup{
+		Name: bootstrapSGNamePtr,
+		Rules: []*capibmcloud.VPCSecurityGroupRule{
+			{
+				// SSH inbound bootstrap
+				Action:    capibmcloud.VPCSecurityGroupRuleActionAllow,
+				Direction: capibmcloud.VPCSecurityGroupRuleDirectionInbound,
+				Source: &capibmcloud.VPCSecurityGroupRulePrototype{
+					PortRange: &capibmcloud.VPCSecurityGroupPortRange{
+						MaximumPort: 22,
+						MinimumPort: 22,
+					},
+					Protocol: capibmcloud.VPCSecurityGroupRuleProtocolTCP,
+					Remotes: []capibmcloud.VPCSecurityGroupRuleRemote{
+						{
+							RemoteType: capibmcloud.VPCSecurityGroupRuleRemoteTypeAny,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func buildClusterWideSecurityGroup(infraID string) capibmcloud.VPCSecurityGroup {
+	clusterWideSGNamePtr := ptr.To(fmt.Sprintf("%s-%s", infraID, clusterWideSGNameSuffix))
+	return capibmcloud.VPCSecurityGroup{
+		Name: clusterWideSGNamePtr,
+	}
+}
+
+func buildControlPlaneSecurityGroup(infraID string) capibmcloud.VPCSecurityGroup {
+	controlPlaneSGNamePtr := ptr.To(fmt.Sprintf("%s-%s", infraID, controlPlaneSGNameSuffix))
+	return capibmcloud.VPCSecurityGroup{
+		Name: controlPlaneSGNamePtr,
+	}
+}
+
+func buildCPInternalSecurityGroup(infraID string) capibmcloud.VPCSecurityGroup {
+	cpInternalSGNamePtr := ptr.To(fmt.Sprintf("%s-%s", infraID, cpInternalSGNameSuffix))
+	return capibmcloud.VPCSecurityGroup{
+		Name: cpInternalSGNamePtr,
+	}
+}
+
+func buildKubeAPILBSecurityGroup(infraID string) capibmcloud.VPCSecurityGroup {
+	kubeAPILBSGNamePtr := ptr.To(fmt.Sprintf("%s-%s", infraID, kubeAPILBSGNameSuffix))
+	return capibmcloud.VPCSecurityGroup{
+		Name: kubeAPILBSGNamePtr,
+		Rules: []*capibmcloud.VPCSecurityGroupRule{
+			{
+				// SSH inbound bootstrap
+				Action:    capibmcloud.VPCSecurityGroupRuleActionAllow,
+				Direction: capibmcloud.VPCSecurityGroupRuleDirectionInbound,
+				Source: &capibmcloud.VPCSecurityGroupRulePrototype{
+					PortRange: &capibmcloud.VPCSecurityGroupPortRange{
+						MaximumPort: 6443,
+						MinimumPort: 6443,
+					},
+					Protocol: capibmcloud.VPCSecurityGroupRuleProtocolTCP,
+					Remotes: []capibmcloud.VPCSecurityGroupRuleRemote{
+						{
+							RemoteType: capibmcloud.VPCSecurityGroupRuleRemoteTypeAny,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func buildOpenShiftNetSecurityGroup(infraID string) capibmcloud.VPCSecurityGroup {
+	clusterWideSGNamePtr := ptr.To(fmt.Sprintf("%s-%s", infraID, clusterWideSGNameSuffix))
+	return capibmcloud.VPCSecurityGroup{
+		Name: clusterWideSGNamePtr,
+	}
+}
+
+func getVPCSecurityGroups(infraID string, publishStrategy types.PublishingStrategy) []capibmcloud.VPCSecurityGroup {
+	// IBM Power VS will rely on 6 SecurityGroups to manage traffic and 1 SecurityGroup for bootstrapping.
+	securityGroups := make([]capibmcloud.VPCSecurityGroup, 0, 6)
+	securityGroups = append(securityGroups, buildKubeAPILBSecurityGroup(infraID))
+	securityGroups = append(securityGroups, buildBootstrapSecurityGroup(infraID))
+	securityGroups = append(securityGroups, buildClusterWideSecurityGroup(infraID))
+	securityGroups = append(securityGroups, buildControlPlaneSecurityGroup(infraID))
+	securityGroups = append(securityGroups, buildCPInternalSecurityGroup(infraID))
+	securityGroups = append(securityGroups, buildOpenShiftNetSecurityGroup(infraID))
+	return securityGroups
+}