Implement NSG rule management for CCM loadbalancers and add respective e2e test cases

Author: pranavsriram8

cmd/oci-cloud-controller-manager/main.go

@@ -21,7 +21,6 @@ import (
 	"os"
 	"time"
 
-	"github.com/oracle/oci-cloud-controller-manager/pkg/cloudprovider/providers/oci"
 	"github.com/oracle/oci-cloud-controller-manager/pkg/logging"
 	"github.com/spf13/pflag"
 	"go.uber.org/zap"

hack/existing-standalone-cluster-env-template.sh

@@ -50,6 +50,9 @@ export CMEK_KMS_KEY=""
 # Mandatory
 export NSG_OCIDS=","
 
+# NSG Network security group created in cluster's VCN for backend management, this NSG will have to be attached to the nodes manually for tests to pass
+export BACKEND_NSG_OCIDS=""
+
 # FSS VOLUME HANDLE in the format filesystem_ocid:mountTargetIP:export_path
 # Make sure fss volume handle is in the same subnet as your nodes
 # Create a file system, file export path and mount target in your VCN by following

hack/run_e2e_test.sh

@@ -21,11 +21,12 @@ function check-env () {
     fi
 }
 
-check-env "CLUSTER_KUBECONFIG"    $CLUSTER_KUBECONFIG
-check-env "CLOUD_CONFIG"          $CLOUD_CONFIG
-check-env "ADLOCATION"      $ADLOCATION
-check-env "NSG_OCIDS"       $NSG_OCIDS
-check-env "FSS_VOLUME_HANDLE"       $FSS_VOLUME_HANDLE
+check-env "CLUSTER_KUBECONFIG"        $CLUSTER_KUBECONFIG
+check-env "CLOUD_CONFIG"              $CLOUD_CONFIG
+check-env "ADLOCATION"                $ADLOCATION
+check-env "NSG_OCIDS"                 $NSG_OCIDS
+check-env "BACKEND_NSG_OCIDS"         $BACKEND_NSG_OCIDS
+check-env "FSS_VOLUME_HANDLE"         $FSS_VOLUME_HANDLE
 check-env "MNT_TARGET_ID"             $MNT_TARGET_ID
 check-env "MNT_TARGET_SUBNET_ID"      $MNT_TARGET_SUBNET_ID
 check-env "MNT_TARGET_COMPARTMENT_ID" $MNT_TARGET_COMPARTMENT_ID
@@ -51,6 +52,7 @@ function run_e2e_tests_existing_cluster() {
         --mnt-target-subnet-id=${MNT_TARGET_SUBNET_ID} \
         --mnt-target-compartment-id=${MNT_TARGET_COMPARTMENT_ID} \
         --nsg-ocids=${NSG_OCIDS} \
+        --backend-nsg-ocids=${BACKEND_NSG_OCIDS} \
         --reserved-ip=${RESERVED_IP} \
         --architecture=${ARCHITECTURE} \
         --volume-handle=${FSS_VOLUME_HANDLE} \

pkg/cloudprovider/providers/oci/instances.go

@@ -50,7 +50,7 @@ func (cp *CloudProvider) getCompartmentIDByInstanceID(instanceID string) (string
 		return "", errors.Wrap(err, "error listing all the nodes using node informer")
 	}
 	for _, node := range nodeList {
-		providerID, err := MapProviderIDToInstanceID(node.Spec.ProviderID)
+		providerID, err := MapProviderIDToResourceID(node.Spec.ProviderID)
 		if err != nil {
 			return "", errors.New("Failed to map providerID to instanceID")
 		}
@@ -147,9 +147,9 @@ func (cp *CloudProvider) NodeAddresses(ctx context.Context, name types.NodeName)
 func (cp *CloudProvider) NodeAddressesByProviderID(ctx context.Context, providerID string) ([]api.NodeAddress, error) {
 	cp.logger.With("instanceID", providerID).Debug("Getting node addresses by provider id")
 
-	instanceID, err := MapProviderIDToInstanceID(providerID)
+	instanceID, err := MapProviderIDToResourceID(providerID)
 	if err != nil {
-		return nil, errors.Wrap(err, "MapProviderIDToInstanceID")
+		return nil, errors.Wrap(err, "MapProviderIDToResourceID")
 	}
 	return cp.extractNodeAddresses(ctx, instanceID)
 
@@ -196,9 +196,9 @@ func (cp *CloudProvider) InstanceType(ctx context.Context, name types.NodeName)
 func (cp *CloudProvider) InstanceTypeByProviderID(ctx context.Context, providerID string) (string, error) {
 	cp.logger.With("instanceID", providerID).Debug("Getting instance type by provider id")
 
-	instanceID, err := MapProviderIDToInstanceID(providerID)
+	instanceID, err := MapProviderIDToResourceID(providerID)
 	if err != nil {
-		return "", errors.Wrap(err, "MapProviderIDToInstanceID")
+		return "", errors.Wrap(err, "MapProviderIDToResourceID")
 	}
 	item, exists, err := cp.instanceCache.GetByKey(instanceID)
 	if err != nil {
@@ -237,7 +237,7 @@ func (cp *CloudProvider) CurrentNodeName(ctx context.Context, hostname string) (
 func (cp *CloudProvider) InstanceExistsByProviderID(ctx context.Context, providerID string) (bool, error) {
 	//Please do not try to optimise it by using InstanceCache because we prefer correctness over efficiency here
 	cp.logger.With("instanceID", providerID).Debug("Checking instance exists by provider id")
-	instanceID, err := MapProviderIDToInstanceID(providerID)
+	instanceID, err := MapProviderIDToResourceID(providerID)
 	if err != nil {
 		return false, err
 	}
@@ -256,7 +256,7 @@ func (cp *CloudProvider) InstanceExistsByProviderID(ctx context.Context, provide
 func (cp *CloudProvider) InstanceShutdownByProviderID(ctx context.Context, providerID string) (bool, error) {
 	//Please do not try to optimise it by using InstanceCache because we prefer correctness over efficiency here
 	cp.logger.With("instanceID", providerID).Debug("Checking instance is stopped by provider id")
-	instanceID, err := MapProviderIDToInstanceID(providerID)
+	instanceID, err := MapProviderIDToResourceID(providerID)
 	if err != nil {
 		return false, err
 	}

pkg/cloudprovider/providers/oci/instances_test.go

@@ -278,6 +278,18 @@ func (MockSecurityListManager) Delete(ctx context.Context, lbSubnets []*core.Sub
 
 type MockSecurityListManagerFactory func(mode string) MockSecurityListManager
 
+type MockNsgManager struct{}
+
+func (MockNsgManager) Add(ctx context.Context, lbService serviceComponents) error {
+	return nil
+}
+
+func (MockNsgManager) Delete(ctx context.Context, lbService serviceComponents) error {
+	return nil
+}
+
+type MockNsgManagerFactory func(mode string) MockNsgManager
+
 type MockOCIClient struct{}
 
 func (MockOCIClient) Compute() client.ComputeInterface {
@@ -401,7 +413,7 @@ func (c *MockVirtualNetworkClient) IsRegionalSubnet(ctx context.Context, id stri
 	return subnets[id].AvailabilityDomain == nil, nil
 }
 
-func (c *MockVirtualNetworkClient) GetPrivateIP(ctx context.Context, id string) (*core.PrivateIp, error) {
+func (c *MockVirtualNetworkClient) GetPrivateIp(ctx context.Context, id string) (*core.PrivateIp, error) {
 	return nil, nil
 }