Skip to content

Commit 5746c60

Browse files
author
Alexandr Demicev
committed
Add natgatewayips as source for ingress rules
Signed-off-by: Alexandr Demicev <alexandr.demicev@suse.com>
1 parent 3a28a4d commit 5746c60

9 files changed

+262
-23
lines changed

‎api/v1beta1/zz_generated.conversion.go‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_webhook.go‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -264,9 +264,7 @@ func (r *AWSCluster) validateNetwork() field.ErrorList {
264264
}
265265

266266
for _, rule := range r.Spec.NetworkSpec.AdditionalControlPlaneIngressRules {
267-
if (rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil) && (rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil) {
268-
allErrs = append(allErrs, field.Invalid(field.NewPath("additionalControlPlaneIngressRules"), r.Spec.NetworkSpec.AdditionalControlPlaneIngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
269-
}
267+
allErrs = append(allErrs, r.validateIngressRule(rule)...)
270268
}
271269

272270
return allErrs
@@ -307,9 +305,7 @@ func (r *AWSCluster) validateControlPlaneLBs() field.ErrorList {
307305
}
308306

309307
for _, rule := range cp.IngressRules {
310-
if (rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil) && (rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil) {
311-
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "ingressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
312-
}
308+
allErrs = append(allErrs, r.validateIngressRule(rule)...)
313309
}
314310
}
315311

@@ -351,11 +347,19 @@ func (r *AWSCluster) validateControlPlaneLBs() field.ErrorList {
351347
}
352348
}
353349

354-
for _, rule := range r.Spec.ControlPlaneLoadBalancer.IngressRules {
350+
return allErrs
351+
}
352+
353+
func (r *AWSCluster) validateIngressRule(rule IngressRule) field.ErrorList {
354+
var allErrs field.ErrorList
355+
if rule.NatGatewaysIPsSource {
356+
if rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil || rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil {
357+
allErrs = append(allErrs, field.Invalid(field.NewPath("additionalControlPlaneIngressRules"), r.Spec.NetworkSpec.AdditionalControlPlaneIngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
358+
}
359+
} else {
355360
if (rule.CidrBlocks != nil || rule.IPv6CidrBlocks != nil) && (rule.SourceSecurityGroupIDs != nil || rule.SourceSecurityGroupRoles != nil) {
356361
allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "controlPlaneLoadBalancer", "ingressRules"), r.Spec.ControlPlaneLoadBalancer.IngressRules, "CIDR blocks and security group IDs or security group roles cannot be used together"))
357362
}
358363
}
359-
360364
return allErrs
361365
}

‎api/v1beta2/awscluster_webhook_test.go‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -408,6 +408,59 @@ func TestAWSClusterValidateCreate(t *testing.T) {
408408
},
409409
wantErr: true,
410410
},
411+
{
412+
name: "rejects ingress rules with cidr block, source security group id, role and nat gateway IP source",
413+
cluster: &AWSCluster{
414+
Spec: AWSClusterSpec{
415+
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
416+
IngressRules: []IngressRule{
417+
{
418+
Protocol: SecurityGroupProtocolTCP,
419+
IPv6CidrBlocks: []string{"test"},
420+
SourceSecurityGroupIDs: []string{"test"},
421+
SourceSecurityGroupRoles: []SecurityGroupRole{SecurityGroupBastion},
422+
NatGatewaysIPsSource: true,
423+
},
424+
},
425+
},
426+
},
427+
},
428+
wantErr: true,
429+
},
430+
{
431+
name: "rejects ingress rules with source security role and nat gateway IP source",
432+
cluster: &AWSCluster{
433+
Spec: AWSClusterSpec{
434+
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
435+
IngressRules: []IngressRule{
436+
{
437+
Protocol: SecurityGroupProtocolTCP,
438+
SourceSecurityGroupRoles: []SecurityGroupRole{SecurityGroupBastion},
439+
NatGatewaysIPsSource: true,
440+
},
441+
},
442+
},
443+
},
444+
},
445+
wantErr: true,
446+
},
447+
{
448+
name: "rejects ingress rules with cidr block and nat gateway IP source",
449+
cluster: &AWSCluster{
450+
Spec: AWSClusterSpec{
451+
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
452+
IngressRules: []IngressRule{
453+
{
454+
Protocol: SecurityGroupProtocolTCP,
455+
IPv6CidrBlocks: []string{"test"},
456+
NatGatewaysIPsSource: true,
457+
},
458+
},
459+
},
460+
},
461+
},
462+
wantErr: true,
463+
},
411464
{
412465
name: "accepts ingress rules with cidr block",
413466
cluster: &AWSCluster{
@@ -424,6 +477,22 @@ func TestAWSClusterValidateCreate(t *testing.T) {
424477
},
425478
wantErr: false,
426479
},
480+
{
481+
name: "accepts ingress rules with nat gateway IPs source",
482+
cluster: &AWSCluster{
483+
Spec: AWSClusterSpec{
484+
ControlPlaneLoadBalancer: &AWSLoadBalancerSpec{
485+
IngressRules: []IngressRule{
486+
{
487+
Protocol: SecurityGroupProtocolTCP,
488+
NatGatewaysIPsSource: true,
489+
},
490+
},
491+
},
492+
},
493+
},
494+
wantErr: false,
495+
},
427496
{
428497
name: "accepts ingress rules with source security group role",
429498
cluster: &AWSCluster{

‎api/v1beta2/network_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -908,6 +908,10 @@ type IngressRule struct {
908908
// The field will be combined with source security group IDs if specified.
909909
// +optional
910910
SourceSecurityGroupRoles []SecurityGroupRole `json:"sourceSecurityGroupRoles,omitempty"`
911+
912+
// NatGatewaysIPsSource use the NAT gateways IPs as the source for the ingress rule.
913+
// +optional
914+
NatGatewaysIPsSource bool `json:"natGatewaysIPsSource,omitempty"`
911915
}
912916

913917
// String returns a string representation of the ingress rule.

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -393,6 +393,10 @@ spec:
393393
items:
394394
type: string
395395
type: array
396+
natGatewaysIPsSource:
397+
description: NatGatewaysIPsSource use the NAT gateways IPs
398+
as the source for the ingress rule.
399+
type: boolean
396400
protocol:
397401
description: Protocol is the protocol for the ingress rule.
398402
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
@@ -1887,6 +1891,10 @@ spec:
18871891
items:
18881892
type: string
18891893
type: array
1894+
natGatewaysIPsSource:
1895+
description: NatGatewaysIPsSource use the NAT gateways
1896+
IPs as the source for the ingress rule.
1897+
type: boolean
18901898
protocol:
18911899
description: Protocol is the protocol for the ingress
18921900
rule. Accepted values are "-1" (all), "4" (IP in
@@ -2343,6 +2351,10 @@ spec:
23432351
items:
23442352
type: string
23452353
type: array
2354+
natGatewaysIPsSource:
2355+
description: NatGatewaysIPsSource use the NAT gateways IPs
2356+
as the source for the ingress rule.
2357+
type: boolean
23462358
protocol:
23472359
description: Protocol is the protocol for the ingress rule.
23482360
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
@@ -3850,6 +3862,10 @@ spec:
38503862
items:
38513863
type: string
38523864
type: array
3865+
natGatewaysIPsSource:
3866+
description: NatGatewaysIPsSource use the NAT gateways
3867+
IPs as the source for the ingress rule.
3868+
type: boolean
38533869
protocol:
38543870
description: Protocol is the protocol for the ingress
38553871
rule. Accepted values are "-1" (all), "4" (IP in

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1164,6 +1164,10 @@ spec:
11641164
items:
11651165
type: string
11661166
type: array
1167+
natGatewaysIPsSource:
1168+
description: NatGatewaysIPsSource use the NAT gateways IPs
1169+
as the source for the ingress rule.
1170+
type: boolean
11671171
protocol:
11681172
description: Protocol is the protocol for the ingress rule.
11691173
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
@@ -1329,6 +1333,10 @@ spec:
13291333
items:
13301334
type: string
13311335
type: array
1336+
natGatewaysIPsSource:
1337+
description: NatGatewaysIPsSource use the NAT gateways IPs
1338+
as the source for the ingress rule.
1339+
type: boolean
13321340
protocol:
13331341
description: Protocol is the protocol for the ingress rule.
13341342
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
@@ -1910,6 +1918,10 @@ spec:
19101918
items:
19111919
type: string
19121920
type: array
1921+
natGatewaysIPsSource:
1922+
description: NatGatewaysIPsSource use the NAT gateways IPs
1923+
as the source for the ingress rule.
1924+
type: boolean
19131925
protocol:
19141926
description: Protocol is the protocol for the ingress rule.
19151927
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
@@ -2833,6 +2845,10 @@ spec:
28332845
items:
28342846
type: string
28352847
type: array
2848+
natGatewaysIPsSource:
2849+
description: NatGatewaysIPsSource use the NAT gateways
2850+
IPs as the source for the ingress rule.
2851+
type: boolean
28362852
protocol:
28372853
description: Protocol is the protocol for the ingress
28382854
rule. Accepted values are "-1" (all), "4" (IP in

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -756,6 +756,10 @@ spec:
756756
items:
757757
type: string
758758
type: array
759+
natGatewaysIPsSource:
760+
description: NatGatewaysIPsSource use the NAT gateways
761+
IPs as the source for the ingress rule.
762+
type: boolean
759763
protocol:
760764
description: Protocol is the protocol for the ingress
761765
rule. Accepted values are "-1" (all), "4" (IP
@@ -925,6 +929,10 @@ spec:
925929
items:
926930
type: string
927931
type: array
932+
natGatewaysIPsSource:
933+
description: NatGatewaysIPsSource use the NAT gateways
934+
IPs as the source for the ingress rule.
935+
type: boolean
928936
protocol:
929937
description: Protocol is the protocol for the ingress
930938
rule. Accepted values are "-1" (all), "4" (IP
@@ -1511,6 +1519,10 @@ spec:
15111519
items:
15121520
type: string
15131521
type: array
1522+
natGatewaysIPsSource:
1523+
description: NatGatewaysIPsSource use the NAT gateways
1524+
IPs as the source for the ingress rule.
1525+
type: boolean
15141526
protocol:
15151527
description: Protocol is the protocol for the ingress
15161528
rule. Accepted values are "-1" (all), "4" (IP

‎pkg/cloud/services/securitygroup/securitygroups.go‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -592,7 +592,12 @@ func (s *Service) getSecurityGroupIngressRules(role infrav1.SecurityGroupRole) (
592592
rules = append(rules, s.defaultSSHIngressRule(s.scope.SecurityGroups()[infrav1.SecurityGroupBastion].ID))
593593
}
594594

595-
rules = append(rules, s.processIngressRulesSGs(s.scope.AdditionalControlPlaneIngressRules())...)
595+
additionalIngressRules, err := s.processIngressRulesSGs(s.scope.AdditionalControlPlaneIngressRules())
596+
if err != nil {
597+
return nil, err
598+
}
599+
600+
rules = append(rules, additionalIngressRules...)
596601

597602
return append(cniRules, rules...), nil
598603

@@ -639,7 +644,10 @@ func (s *Service) getSecurityGroupIngressRules(role infrav1.SecurityGroupRole) (
639644
return infrav1.IngressRules{}, nil
640645
case infrav1.SecurityGroupAPIServerLB:
641646
kubeletRules := s.getIngressRulesToAllowKubeletToAccessTheControlPlaneLB()
642-
customIngressRules := s.processIngressRulesSGs(s.getControlPlaneLBIngressRules())
647+
customIngressRules, err := s.processIngressRulesSGs(s.getControlPlaneLBIngressRules())
648+
if err != nil {
649+
return nil, err
650+
}
643651
rulesToApply := customIngressRules.Difference(kubeletRules)
644652
return append(kubeletRules, rulesToApply...), nil
645653
case infrav1.SecurityGroupLB:
@@ -964,10 +972,25 @@ func (s *Service) getIngressRuleToAllowVPCCidrInTheAPIServer() infrav1.IngressRu
964972
}
965973
}
966974

967-
func (s *Service) processIngressRulesSGs(ingressRules []infrav1.IngressRule) infrav1.IngressRules {
975+
func (s *Service) processIngressRulesSGs(ingressRules []infrav1.IngressRule) (infrav1.IngressRules, error) {
968976
output := []infrav1.IngressRule{}
969977

970978
for _, rule := range ingressRules {
979+
if rule.NatGatewaysIPsSource { // if the rule has NatGatewaysIPsSource set to true, use the NAT Gateway IPs as the source
980+
natGatewaysCidrs := []string{}
981+
natGatewaysIPs := s.scope.GetNatGatewaysIPs()
982+
for _, ip := range natGatewaysIPs {
983+
natGatewaysCidrs = append(natGatewaysCidrs, fmt.Sprintf("%s/32", ip))
984+
}
985+
if len(natGatewaysIPs) > 0 {
986+
rule.CidrBlocks = natGatewaysCidrs
987+
output = append(output, rule)
988+
continue
989+
}
990+
991+
return nil, errors.New("NAT Gateway IPs are not available yet")
992+
}
993+
971994
if len(rule.CidrBlocks) != 0 || len(rule.IPv6CidrBlocks) != 0 { // don't set source security group if cidr blocks are set
972995
output = append(output, rule)
973996
continue
@@ -988,5 +1011,5 @@ func (s *Service) processIngressRulesSGs(ingressRules []infrav1.IngressRule) inf
9881011
output = append(output, rule)
9891012
}
9901013

991-
return output
1014+
return output, nil
9921015
}

0 commit comments

Comments
 (0)