Skip to content

Commit 1fc9fc8

Browse files
johngmyersjohngmyers
committed
Implement securityGroups field of IngressClassParams
1 parent 2ba762d commit 1fc9fc8

File tree

7 files changed

+1150
-66
lines changed

7 files changed

+1150
-66
lines changed

‎main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ func main() {
111111
mgr.GetEventRecorderFor("targetGroupBinding"), ctrl.Log)
112112
backendSGProvider := networking.NewBackendSGProvider(controllerCFG.ClusterName, controllerCFG.BackendSecurityGroup,
113113
cloud.VpcID(), cloud.EC2(), mgr.GetClient(), controllerCFG.DefaultTags, ctrl.Log.WithName("backend-sg-provider"))
114-
sgResolver := networking.NewDefaultSecurityGroupResolver(cloud.EC2(), cloud.VpcID())
114+
sgResolver := networking.NewDefaultSecurityGroupResolver(cloud.EC2(), cloud.VpcID(), controllerCFG.ClusterName)
115115
ingGroupReconciler := ingress.NewGroupReconciler(cloud, mgr.GetClient(), mgr.GetEventRecorderFor("ingress"),
116116
finalizerManager, sgManager, sgReconciler, subnetResolver,
117117
controllerCFG, backendSGProvider, sgResolver, ctrl.Log.WithName("controllers").WithName("ingress"))

‎pkg/ingress/model_build_load_balancer.go

Lines changed: 98 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -203,12 +203,12 @@ func (t *defaultModelBuildTask) buildLoadBalancerSubnetMappings(ctx context.Cont
203203

204204
if len(explicitSubnetSelectorList) != 0 {
205205
if len(explicitSubnetNameOrIDsList) != 0 {
206-
return nil, errors.Errorf("conflicting subnet specifications: IngressClassParams versus annotation")
206+
return nil, errors.New("conflicting subnet specifications: IngressClassParams versus annotation")
207207
}
208208
chosenSubnetSelector := explicitSubnetSelectorList[0]
209209
for _, subnetSelector := range explicitSubnetSelectorList[1:] {
210210
if !cmp.Equal(*chosenSubnetSelector, *subnetSelector) {
211-
return nil, errors.Errorf("conflicting IngressClassParams subnet specifications")
211+
return nil, errors.New("conflicting IngressClassParams subnet specifications")
212212
}
213213
}
214214
chosenSubnets, err := t.subnetsResolver.ResolveViaSelector(ctx, chosenSubnetSelector,
@@ -227,7 +227,7 @@ func (t *defaultModelBuildTask) buildLoadBalancerSubnetMappings(ctx context.Cont
227227
for _, subnetNameOrIDs := range explicitSubnetNameOrIDsList[1:] {
228228
// subnetNameOrIDs order doesn't matter
229229
if !cmp.Equal(chosenSubnetNameOrIDs, subnetNameOrIDs, equality.IgnoreStringSliceOrder()) {
230-
return nil, errors.Errorf("conflicting subnets: %v | %v", chosenSubnetNameOrIDs, subnetNameOrIDs)
230+
return nil, fmt.Errorf("conflicting subnets: %v | %v", chosenSubnetNameOrIDs, subnetNameOrIDs)
231231
}
232232
}
233233
chosenSubnets, err := t.subnetsResolver.ResolveViaNameOrIDSlice(ctx, chosenSubnetNameOrIDs,
@@ -269,78 +269,120 @@ func (t *defaultModelBuildTask) buildLoadBalancerSubnetMappings(ctx context.Cont
269269
}
270270

271271
func (t *defaultModelBuildTask) buildLoadBalancerSecurityGroups(ctx context.Context, listenPortConfigByPort map[int64]listenPortConfig, ipAddressType elbv2model.IPAddressType) ([]core.StringToken, error) {
272-
sgNameOrIDsViaAnnotation, err := t.buildFrontendSGNameOrIDsFromAnnotation(ctx)
273-
if err != nil {
274-
return nil, err
275-
}
272+
var explicitSGSelectorList []*v1beta1.SecurityGroupSelector
273+
var explicitSGNameOrIDsList [][]string
276274
var lbSGTokens []core.StringToken
277-
if len(sgNameOrIDsViaAnnotation) == 0 {
278-
managedSG, err := t.buildManagedSecurityGroup(ctx, listenPortConfigByPort, ipAddressType)
279-
if err != nil {
280-
return nil, err
275+
manageBackendSG := t.enableBackendSG
276+
277+
for _, member := range t.ingGroup.Members {
278+
if member.IngClassConfig.IngClassParams != nil {
279+
if member.IngClassConfig.IngClassParams.Spec.SecurityGroups != nil {
280+
explicitSGSelectorList = append(explicitSGSelectorList, member.IngClassConfig.IngClassParams.Spec.SecurityGroups)
281+
continue
282+
}
283+
if len(member.IngClassConfig.IngClassParams.Spec.InboundCIDRs) > 0 {
284+
explicitSGSelectorList = append(explicitSGSelectorList, &v1beta1.SecurityGroupSelector{ManagedInbound: true})
285+
continue
286+
}
287+
}
288+
289+
var rawSGNameOrIDs []string
290+
if exists := t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixSecurityGroups, &rawSGNameOrIDs, member.Ing.Annotations); exists {
291+
explicitSGNameOrIDsList = append(explicitSGNameOrIDsList, rawSGNameOrIDs)
281292
}
282-
lbSGTokens = append(lbSGTokens, managedSG.GroupID())
283-
if !t.enableBackendSG {
284-
t.backendSGIDToken = managedSG.GroupID()
293+
}
294+
295+
if len(explicitSGSelectorList) != 0 {
296+
if len(explicitSGNameOrIDsList) != 0 {
297+
return nil, errors.New("conflicting security group specifications: IngressClassParams versus annotation")
298+
}
299+
chosenSGSelector := explicitSGSelectorList[0]
300+
for _, sgSelector := range explicitSGSelectorList[1:] {
301+
if !cmp.Equal(*chosenSGSelector, *sgSelector) {
302+
return nil, errors.New("conflicting IngressClassParams security group specifications")
303+
}
304+
}
305+
if chosenSGSelector.ManagedInbound {
306+
if chosenSGSelector.ManagedBackend != nil {
307+
manageBackendSG = *chosenSGSelector.ManagedBackend
308+
}
285309
} else {
286-
backendSGID, err := t.backendSGProvider.Get(ctx, networking.ResourceTypeIngress, k8s.ToSliceOfNamespacedNames(t.ingGroup.Members))
310+
frontendSGIDs, err := t.sgResolver.ResolveViaSelector(ctx, chosenSGSelector)
287311
if err != nil {
288312
return nil, err
289313
}
290-
t.backendSGIDToken = core.LiteralStringToken((backendSGID))
291-
t.backendSGAllocated = true
292-
lbSGTokens = append(lbSGTokens, t.backendSGIDToken)
293-
}
294-
t.logger.Info("Auto Create SG", "LB SGs", lbSGTokens, "backend SG", t.backendSGIDToken)
295-
} else {
296-
manageBackendSGRules, err := t.buildManageSecurityGroupRulesFlag(ctx)
297-
if err != nil {
298-
return nil, err
299-
}
300-
frontendSGIDs, err := t.sgResolver.ResolveViaNameOrID(ctx, sgNameOrIDsViaAnnotation)
301-
if err != nil {
302-
return nil, err
314+
for _, sgID := range frontendSGIDs {
315+
lbSGTokens = append(lbSGTokens, core.LiteralStringToken(sgID))
316+
}
317+
if chosenSGSelector.ManagedBackend != nil && *chosenSGSelector.ManagedBackend {
318+
backendSGID, err := t.backendSGProvider.Get(ctx, networking.ResourceTypeIngress, k8s.ToSliceOfNamespacedNames(t.ingGroup.Members))
319+
if err != nil {
320+
return nil, err
321+
}
322+
t.backendSGIDToken = core.LiteralStringToken(backendSGID)
323+
t.backendSGAllocated = true
324+
lbSGTokens = append(lbSGTokens, t.backendSGIDToken)
325+
}
326+
return lbSGTokens, nil
303327
}
304-
for _, sgID := range frontendSGIDs {
305-
lbSGTokens = append(lbSGTokens, core.LiteralStringToken(sgID))
328+
}
329+
330+
if len(explicitSGNameOrIDsList) > 0 {
331+
sgNameOrIDsViaAnnotation := explicitSGNameOrIDsList[0]
332+
for _, sgNameOrIDs := range explicitSGNameOrIDsList[1:] {
333+
if !cmp.Equal(sgNameOrIDsViaAnnotation, sgNameOrIDs) {
334+
return nil, fmt.Errorf("conflicting securityGroups: %v | %v", sgNameOrIDsViaAnnotation, sgNameOrIDs)
335+
}
306336
}
307337

308-
if manageBackendSGRules {
309-
if !t.enableBackendSG {
310-
return nil, errors.New("backendSG feature is required to manage worker node SG rules when frontendSG manually specified")
338+
if len(sgNameOrIDsViaAnnotation) > 0 {
339+
manageBackendSGRules, err := t.buildManageSecurityGroupRulesFlag(ctx)
340+
if err != nil {
341+
return nil, err
311342
}
312-
backendSGID, err := t.backendSGProvider.Get(ctx, networking.ResourceTypeIngress, k8s.ToSliceOfNamespacedNames(t.ingGroup.Members))
343+
frontendSGIDs, err := t.sgResolver.ResolveViaNameOrID(ctx, sgNameOrIDsViaAnnotation)
313344
if err != nil {
314345
return nil, err
315346
}
316-
t.backendSGIDToken = core.LiteralStringToken(backendSGID)
317-
t.backendSGAllocated = true
318-
lbSGTokens = append(lbSGTokens, t.backendSGIDToken)
319-
}
320-
t.logger.Info("SG configured via annotation", "LB SGs", lbSGTokens, "backend SG", t.backendSGIDToken)
321-
}
322-
return lbSGTokens, nil
323-
}
347+
for _, sgID := range frontendSGIDs {
348+
lbSGTokens = append(lbSGTokens, core.LiteralStringToken(sgID))
349+
}
324350

325-
func (t *defaultModelBuildTask) buildFrontendSGNameOrIDsFromAnnotation(ctx context.Context) ([]string, error) {
326-
var explicitSGNameOrIDsList [][]string
327-
for _, member := range t.ingGroup.Members {
328-
var rawSGNameOrIDs []string
329-
if exists := t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixSecurityGroups, &rawSGNameOrIDs, member.Ing.Annotations); !exists {
330-
continue
351+
if manageBackendSGRules {
352+
if !t.enableBackendSG {
353+
return nil, errors.New("backendSG feature is required to manage worker node SG rules when frontendSG manually specified")
354+
}
355+
backendSGID, err := t.backendSGProvider.Get(ctx, networking.ResourceTypeIngress, k8s.ToSliceOfNamespacedNames(t.ingGroup.Members))
356+
if err != nil {
357+
return nil, err
358+
}
359+
t.backendSGIDToken = core.LiteralStringToken(backendSGID)
360+
t.backendSGAllocated = true
361+
lbSGTokens = append(lbSGTokens, t.backendSGIDToken)
362+
}
363+
t.logger.Info("SG configured via annotation", "LB SGs", lbSGTokens, "backend SG", t.backendSGIDToken)
364+
return lbSGTokens, nil
331365
}
332-
explicitSGNameOrIDsList = append(explicitSGNameOrIDsList, rawSGNameOrIDs)
333366
}
334-
if len(explicitSGNameOrIDsList) == 0 {
335-
return nil, nil
367+
368+
managedSG, err := t.buildManagedSecurityGroup(ctx, listenPortConfigByPort, ipAddressType)
369+
if err != nil {
370+
return nil, err
336371
}
337-
chosenSGNameOrIDs := explicitSGNameOrIDsList[0]
338-
for _, sgNameOrIDs := range explicitSGNameOrIDsList[1:] {
339-
if !cmp.Equal(chosenSGNameOrIDs, sgNameOrIDs) {
340-
return nil, errors.Errorf("conflicting securityGroups: %v | %v", chosenSGNameOrIDs, sgNameOrIDs)
372+
lbSGTokens = append(lbSGTokens, managedSG.GroupID())
373+
if !manageBackendSG {
374+
t.backendSGIDToken = managedSG.GroupID()
375+
} else {
376+
backendSGID, err := t.backendSGProvider.Get(ctx, networking.ResourceTypeIngress, k8s.ToSliceOfNamespacedNames(t.ingGroup.Members))
377+
if err != nil {
378+
return nil, err
341379
}
380+
t.backendSGIDToken = core.LiteralStringToken(backendSGID)
381+
t.backendSGAllocated = true
382+
lbSGTokens = append(lbSGTokens, t.backendSGIDToken)
342383
}
343-
return chosenSGNameOrIDs, nil
384+
t.logger.Info("Auto Create SG", "LB SGs", lbSGTokens, "backend SG", t.backendSGIDToken)
385+
return lbSGTokens, nil
344386
}
345387

346388
func (t *defaultModelBuildTask) buildLoadBalancerCOIPv4Pool(_ context.Context) (*string, error) {

0 commit comments

Comments
 (0)