Skip to content

Commit bdd1212

Browse files
robo-caphyder
robo-cap
authored and
hyder
committed
allow traffic between pods and lbs
1 parent aa802e0 commit bdd1212

10 files changed

+82
-12
lines changed

‎examples/cluster/vars-cluster-basic.auto.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
33

44
cluster_name = "oke-example"
5-
kubernetes_version = "v1.32.1"
5+
kubernetes_version = "v1.34.1"

‎examples/cluster/vars-cluster-enhanced.auto.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ cluster_type = "enhanced" // *basic/enhanced
99
cni_type = "flannel" // *flannel/npn
1010
assign_public_ip_to_control_plane = true // true/*false
1111
image_signing_keys = []
12-
kubernetes_version = "v1.32.1"
12+
kubernetes_version = "v1.34.1"
1313
pods_cidr = "10.244.0.0/16"
1414
services_cidr = "10.96.0.0/16"
1515
use_signed_images = false // true/*false

‎examples/cluster/vars-cluster-oidc-auth-multiple.auto.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ cluster_type = "enhanced" // *basic/enhanced
99
cni_type = "flannel" // *flannel/npn
1010
assign_public_ip_to_control_plane = true // true/*false
1111
image_signing_keys = []
12-
kubernetes_version = "v1.32.1"
12+
kubernetes_version = "v1.34.1"
1313
pods_cidr = "10.244.0.0/16"
1414
services_cidr = "10.96.0.0/16"
1515
use_signed_images = false // true/*false

‎examples/cluster/vars-cluster-oidc-auth-single.auto.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ cluster_type = "enhanced" // *basic/enhanced
99
cni_type = "flannel" // *flannel/npn
1010
assign_public_ip_to_control_plane = true // true/*false
1111
image_signing_keys = []
12-
kubernetes_version = "v1.32.1"
12+
kubernetes_version = "v1.34.2"
1313
pods_cidr = "10.244.0.0/16"
1414
services_cidr = "10.96.0.0/16"
1515
use_signed_images = false // true/*false

‎examples/cluster/vars-cluster-oidc-discovery.auto.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ cluster_type = "enhanced" // *basic/enhanced
99
cni_type = "flannel" // *flannel/npn
1010
assign_public_ip_to_control_plane = true // true/*false
1111
image_signing_keys = []
12-
kubernetes_version = "v1.32.1"
12+
kubernetes_version = "v1.34.2"
1313
pods_cidr = "10.244.0.0/16"
1414
services_cidr = "10.96.0.0/16"
1515
use_signed_images = false // true/*false

‎modules/cluster/cluster.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ resource "oci_containerengine_cluster" "k8s_cluster" {
103103
}
104104

105105
lifecycle {
106-
ignore_changes = [defined_tags]
106+
ignore_changes = [defined_tags, options["kubernetes_network_config"]]
107107

108108
precondition {
109109
condition = !var.use_signed_images || length(var.image_signing_keys) > 0

‎modules/network/nsg-loadbalancers-int.tf‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,13 @@ locals {
3030
protocol = local.tcp_protocol, port = local.health_check_port, destination = local.worker_nsg_id, destination_type = local.rule_type_nsg,
3131
},
3232
},
33+
34+
local.pod_nsg_enabled ? {
35+
"Allow all egress from internal load balancers to pods" : {
36+
protocol = local.all_protocols, port = local.all_ports, destination = local.pod_nsg_id, destination_type = local.rule_type_nsg,
37+
},
38+
} : {},
39+
3340
var.enable_ipv6 ? {
3441
"Allow ICMPv6 egress from internal load balancers to worker nodes for path discovery" : {
3542
protocol = local.icmpv6_protocol, port = local.all_ports, destination = local.worker_nsg_id, destination_type = local.rule_type_nsg,
@@ -55,17 +62,27 @@ locals {
5562
protocol = local.udp_protocol, source_port_min = local.node_port_min, source_port_max = local.node_port_max, source = local.worker_nsg_id, source_type = local.rule_type_nsg, stateless = true
5663
},
5764

58-
"Allow TCP egress from internal load balancers to workers for health checks" : {
59-
protocol = local.tcp_protocol, destination_port_min = local.health_check_port, destination_port_max = local.health_check_port, destination = local.worker_nsg_id, destination_type = local.rule_type_nsg, stateless = true
65+
"Allow TCP egress from internal load balancers to pods for health checks" : {
66+
protocol = local.tcp_protocol, destination_port_min = local.health_check_port, destination_port_max = local.health_check_port, destination = local.pod_nsg_id, destination_type = local.rule_type_nsg, stateless = true
6067
},
61-
"Allow TCP egress to internal load balancers from workers for health checks" : {
62-
protocol = local.tcp_protocol, source_port_min = local.health_check_port, source_port_max = local.health_check_port, source = local.worker_nsg_id, source_type = local.rule_type_nsg, stateless = true
68+
"Allow TCP egress to internal load balancers from pods for health checks" : {
69+
protocol = local.tcp_protocol, source_port_min = local.health_check_port, source_port_max = local.health_check_port, source = local.pod_nsg_id, source_type = local.rule_type_nsg, stateless = true
6370
},
6471

6572
"Allow ICMP egress from internal load balancers to worker nodes for path discovery" : {
6673
protocol = local.icmp_protocol, port = local.all_ports, destination = local.worker_nsg_id, destination_type = local.rule_type_nsg,
6774
},
6875
},
76+
77+
local.pod_nsg_enabled ? {
78+
"Allow all egress from internal load balancers to pods" : {
79+
protocol = local.all_protocols, port = local.all_ports, destination = local.pod_nsg_id, destination_type = local.rule_type_nsg, stateless = true
80+
},
81+
"Allow all ingress from pods to internal load balancers" : {
82+
protocol = local.all_protocols, port = local.all_ports, source = local.pod_nsg_id, source_type = local.rule_type_nsg, stateless = true
83+
},
84+
} : {},
85+
6986
var.enable_ipv6 ? {
7087
"Allow ICMPv6 egress from internal load balancers to worker nodes for path discovery" : {
7188
protocol = local.icmpv6_protocol, port = local.all_ports, destination = local.worker_nsg_id, destination_type = local.rule_type_nsg,

‎modules/network/nsg-loadbalancers-pub.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,13 @@ locals {
3131
protocol = local.icmp_protocol, port = local.all_ports, destination = local.worker_nsg_id, destination_type = local.rule_type_nsg,
3232
},
3333
},
34+
35+
local.pod_nsg_enabled ? {
36+
"Allow all egress from public load balancers to pods" : {
37+
protocol = local.all_protocols, port = local.all_ports, destination = local.pod_nsg_id, destination_type = local.rule_type_nsg,
38+
},
39+
} : {},
40+
3441
var.enable_ipv6 ? {
3542
"Allow ICMPv6 egress from public load balancers to worker nodes for path discovery" : {
3643
protocol = local.icmpv6_protocol, port = local.all_ports, destination = local.worker_nsg_id, destination_type = local.rule_type_nsg,
@@ -67,6 +74,16 @@ locals {
6774
protocol = local.icmp_protocol, port = local.all_ports, destination = local.worker_nsg_id, destination_type = local.rule_type_nsg,
6875
},
6976
},
77+
78+
local.pod_nsg_enabled ? {
79+
"Allow all egress from public load balancers to pods" : {
80+
protocol = local.all_protocols, port = local.all_ports, destination = local.pod_nsg_id, destination_type = local.rule_type_nsg, stateless = true
81+
},
82+
"Allow all ingress from pods to public load balancers" : {
83+
protocol = local.all_protocols, port = local.all_ports, source = local.pod_nsg_id, source_type = local.rule_type_nsg, stateless = true
84+
},
85+
} : {},
86+
7087
var.enable_ipv6 ? {
7188
"Allow ICMPv6 egress from public load balancers to worker nodes for path discovery" : {
7289
protocol = local.icmpv6_protocol, port = local.all_ports, destination = local.worker_nsg_id, destination_type = local.rule_type_nsg,

‎modules/network/nsg-pods.tf‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,27 @@ locals {
4848
}
4949
"Allow ICMP ingress to pods for path discovery" = {
5050
protocol = local.icmp_protocol, port = local.all_ports, source = local.anywhere, source_type = local.rule_type_cidr,
51-
}
51+
},
5252
},
5353

54+
local.int_lb_nsg_enabled ? {
55+
"Allow ALL egress from pods to internal_lb" = {
56+
protocol = local.all_protocols, port = local.all_ports, destination = local.int_lb_nsg_id, destination_type = local.rule_type_nsg,
57+
}
58+
"Allow ALL ingress from internal_lb to pods" = {
59+
protocol = local.all_protocols, port = local.all_ports, source = local.int_lb_nsg_id, source_type = local.rule_type_nsg,
60+
}
61+
} : {},
62+
63+
local.pub_lb_nsg_enabled ? {
64+
"Allow ALL egress from pods to pub_lb" = {
65+
protocol = local.all_protocols, port = local.all_ports, destination = local.pub_lb_nsg_id, destination_type = local.rule_type_nsg,
66+
}
67+
"Allow ALL ingress from pub_lb to pods" = {
68+
protocol = local.all_protocols, port = local.all_ports, source = local.pub_lb_nsg_id, source_type = local.rule_type_nsg,
69+
}
70+
}: {},
71+
5472
var.enable_ipv6 ? {
5573
"Allow ICMPv6 ingress to pods for path discovery" : {
5674
protocol = local.icmpv6_protocol, port = local.all_ports, source = local.anywhere_ipv6, source_type = local.rule_type_cidr,
@@ -114,6 +132,24 @@ locals {
114132
}
115133
},
116134

135+
local.int_lb_nsg_enabled ? {
136+
"Allow ALL egress from pods to internal_lb" = {
137+
protocol = local.all_protocols, port = local.all_ports, destination = local.int_lb_nsg_id, destination_type = local.rule_type_nsg, stateless = true
138+
}
139+
"Allow ALL egress from pods to internal_lb" = {
140+
protocol = local.all_protocols, port = local.all_ports, source = local.int_lb_nsg_id, source_type = local.rule_type_nsg, stateless = true
141+
}
142+
} : {},
143+
144+
local.pub_lb_nsg_enabled ? {
145+
"Allow ALL egress from pods to pub_lb" = {
146+
protocol = local.all_protocols, port = local.all_ports, destination = local.pub_lb_nsg_id, destination_type = local.rule_type_nsg, stateless = true
147+
}
148+
"Allow ALL egress from pods to pub_lb" = {
149+
protocol = local.all_protocols, port = local.all_ports, source = local.pub_lb_nsg_id, source_type = local.rule_type_nsg, stateless = true
150+
}
151+
}: {},
152+
117153
var.enable_ipv6 ? {
118154
"Allow ICMPv6 ingress to pods for path discovery" : {
119155
protocol = local.icmpv6_protocol, port = local.all_ports, source = local.anywhere_ipv6, source_type = local.rule_type_cidr,

‎variables-cluster.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ variable "services_cidr" {
8282
}
8383

8484
variable "kubernetes_version" {
85-
default = "v1.26.2"
85+
default = "v1.34.2"
8686
description = "The version of kubernetes to use when provisioning OKE or to upgrade an existing OKE cluster to."
8787
type = string
8888
}

0 commit comments

Comments
 (0)