Skip to content

Commit 4151342

Browse files
haouchaouc
committed
Adding supports for air gapped regions through feature gate.
1 parent 10aab91 commit 4151342

File tree

5 files changed

+52
-28
lines changed

5 files changed

+52
-28
lines changed

‎docs/deploy/configurations.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
8383
|enable-waf | boolean | true | Enable WAF addon for ALB |
8484
|enable-wafv2 | boolean | true | Enable WAF V2 addon for ALB |
8585
|external-managed-tags | stringList | | AWS Tag keys that will be managed externally. Specified Tags are ignored during reconciliation |
86-
|feature-gate | string | true | A set of key=value pairs to enable or disable features |
86+
|feature-gate | string | boolean | A set of key=value pairs to enable or disable features |
8787
|ingress-class | string | alb | Name of the ingress class this controller satisfies |
8888
|ingress-max-concurrent-reconciles | int | 3 | Maximum number of concurrently running reconcile loops for ingress |
8989
|kubeconfig | string | in-cluster config | Path to the kubeconfig file containing authorization and API server information |
@@ -102,6 +102,12 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
102102
|webhook-cert-file | string | tls.crt | The server certificate name |
103103
|webhook-key-file | string | tls.key | The server key name |
104104

105+
|Feature-gate Supported Key | Type | Default Value | Description |
106+
|---------------------------------------|---------------------------------|-----------------|-------------|
107+
|enable-listener-rules-tagging | string | true | Enable tagging load balancer listeners |
108+
|enforce-single-target-group | string | false | Enforce using only one target group |
109+
110+
105111
### disable-ingress-class-annotation
106112
`--disable-ingress-class-annotation` controls whether to disable new usage of the `kubernetes.io/ingress.class` annotation.
107113

‎pkg/config/feature_gate.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ type Feature string
1111

1212
const (
1313
EnableListenerRulesTagging Feature = "enable-listener-rules-tagging"
14+
EnforceSingleTargetGroup Feature = "enforce-single-target-group"
1415
)
1516

1617
type FeatureGate interface {
@@ -39,6 +40,7 @@ func NewFeatureGate() FeatureGate {
3940
return &defaultFeatureGate{
4041
featureState: map[Feature]bool{
4142
EnableListenerRulesTagging: true,
43+
EnforceSingleTargetGroup: false,
4244
},
4345
}
4446
}

‎pkg/deploy/elbv2/listener_manager.go

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ type defaultListenerManager struct {
5757
}
5858

5959
func (m *defaultListenerManager) Create(ctx context.Context, resLS *elbv2model.Listener) (elbv2model.ListenerStatus, error) {
60-
req, err := buildSDKCreateListenerInput(resLS.Spec)
60+
req, err := buildSDKCreateListenerInput(resLS.Spec, m.featureGate)
6161
if err != nil {
6262
return elbv2model.ListenerStatus{}, err
6363
}
@@ -128,7 +128,7 @@ func (m *defaultListenerManager) updateSDKListenerWithTags(ctx context.Context,
128128
}
129129

130130
func (m *defaultListenerManager) updateSDKListenerWithSettings(ctx context.Context, resLS *elbv2model.Listener, sdkLS ListenerWithTags) error {
131-
desiredDefaultActions, err := buildSDKActions(resLS.Spec.DefaultActions)
131+
desiredDefaultActions, err := buildSDKActions(resLS.Spec.DefaultActions, m.featureGate)
132132
if err != nil {
133133
return err
134134
}
@@ -156,6 +156,13 @@ func (m *defaultListenerManager) updateSDKListenerWithSettings(ctx context.Conte
156156
// currentExtraCertificates is the current extra certificates, if it's nil, the current extra certificates will be fetched from AWS.
157157
func (m *defaultListenerManager) updateSDKListenerWithExtraCertificates(ctx context.Context, resLS *elbv2model.Listener,
158158
sdkLS ListenerWithTags, isNewSDKListener bool) error {
159+
// if TLS is not supported, we shouldn't update
160+
if sdkLS.Listener.SslPolicy == nil {
161+
m.logger.Info("SDK Listner doesn't have SSL Policy set, we skip updating extra certs.")
162+
return nil
163+
}
164+
165+
159166
desiredExtraCertARNs := sets.NewString()
160167
_, desiredExtraCerts := buildSDKCertificates(resLS.Spec.Certificates)
161168
for _, cert := range desiredExtraCerts {
@@ -262,7 +269,7 @@ func isSDKListenerSettingsDrifted(lsSpec elbv2model.ListenerSpec, sdkLS Listener
262269
return false
263270
}
264271

265-
func buildSDKCreateListenerInput(lsSpec elbv2model.ListenerSpec) (*elbv2sdk.CreateListenerInput, error) {
272+
func buildSDKCreateListenerInput(lsSpec elbv2model.ListenerSpec, featureGate config.FeatureGate) (*elbv2sdk.CreateListenerInput, error) {
266273
ctx := context.Background()
267274
lbARN, err := lsSpec.LoadBalancerARN.Resolve(ctx)
268275
if err != nil {
@@ -272,7 +279,7 @@ func buildSDKCreateListenerInput(lsSpec elbv2model.ListenerSpec) (*elbv2sdk.Crea
272279
sdkObj.LoadBalancerArn = awssdk.String(lbARN)
273280
sdkObj.Port = awssdk.Int64(lsSpec.Port)
274281
sdkObj.Protocol = awssdk.String(string(lsSpec.Protocol))
275-
defaultActions, err := buildSDKActions(lsSpec.DefaultActions)
282+
defaultActions, err := buildSDKActions(lsSpec.DefaultActions, featureGate)
276283
if err != nil {
277284
return nil, err
278285
}

‎pkg/deploy/elbv2/listener_rule_manager.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ type defaultListenerRuleManager struct {
5454
}
5555

5656
func (m *defaultListenerRuleManager) Create(ctx context.Context, resLR *elbv2model.ListenerRule) (elbv2model.ListenerRuleStatus, error) {
57-
req, err := buildSDKCreateListenerRuleInput(resLR.Spec)
57+
req, err := buildSDKCreateListenerRuleInput(resLR.Spec, m.featureGate)
5858
if err != nil {
5959
return elbv2model.ListenerRuleStatus{}, err
6060
}
@@ -116,7 +116,7 @@ func (m *defaultListenerRuleManager) Delete(ctx context.Context, sdkLR ListenerR
116116
}
117117

118118
func (m *defaultListenerRuleManager) updateSDKListenerRuleWithSettings(ctx context.Context, resLR *elbv2model.ListenerRule, sdkLR ListenerRuleWithTags) error {
119-
desiredActions, err := buildSDKActions(resLR.Spec.Actions)
119+
desiredActions, err := buildSDKActions(resLR.Spec.Actions, m.featureGate)
120120
if err != nil {
121121
return err
122122
}
@@ -161,7 +161,7 @@ func isSDKListenerRuleSettingsDrifted(lrSpec elbv2model.ListenerRuleSpec, sdkLR
161161
return false
162162
}
163163

164-
func buildSDKCreateListenerRuleInput(lrSpec elbv2model.ListenerRuleSpec) (*elbv2sdk.CreateRuleInput, error) {
164+
func buildSDKCreateListenerRuleInput(lrSpec elbv2model.ListenerRuleSpec, featureGate config.FeatureGate) (*elbv2sdk.CreateRuleInput, error) {
165165
ctx := context.Background()
166166
lsARN, err := lrSpec.ListenerARN.Resolve(ctx)
167167
if err != nil {
@@ -170,7 +170,7 @@ func buildSDKCreateListenerRuleInput(lrSpec elbv2model.ListenerRuleSpec) (*elbv2
170170
sdkObj := &elbv2sdk.CreateRuleInput{}
171171
sdkObj.ListenerArn = awssdk.String(lsARN)
172172
sdkObj.Priority = awssdk.Int64(lrSpec.Priority)
173-
actions, err := buildSDKActions(lrSpec.Actions)
173+
actions, err := buildSDKActions(lrSpec.Actions, featureGate)
174174
if err != nil {
175175
return nil, err
176176
}

‎pkg/deploy/elbv2/listener_utils.go

Lines changed: 28 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
elbv2sdk "github.com/aws/aws-sdk-go/service/elbv2"
88
"github.com/pkg/errors"
99
elbv2model "sigs.k8s.io/aws-load-balancer-controller/pkg/model/elbv2"
10+
"sigs.k8s.io/aws-load-balancer-controller/pkg/config"
1011
"time"
1112
)
1213

@@ -15,12 +16,12 @@ const (
1516
defaultWaitLSExistenceTimeout = 20 * time.Second
1617
)
1718

18-
func buildSDKActions(modelActions []elbv2model.Action) ([]*elbv2sdk.Action, error) {
19+
func buildSDKActions(modelActions []elbv2model.Action, featureGate config.FeatureGate) ([]*elbv2sdk.Action, error) {
1920
var sdkActions []*elbv2sdk.Action
2021
if len(modelActions) != 0 {
2122
sdkActions = make([]*elbv2sdk.Action, 0, len(modelActions))
2223
for index, modelAction := range modelActions {
23-
sdkAction, err := buildSDKAction(modelAction)
24+
sdkAction, err := buildSDKAction(modelAction, featureGate)
2425
sdkAction.Order = awssdk.Int64(int64(index) + 1)
2526
if err != nil {
2627
return nil, err
@@ -31,7 +32,7 @@ func buildSDKActions(modelActions []elbv2model.Action) ([]*elbv2sdk.Action, erro
3132
return sdkActions, nil
3233
}
3334

34-
func buildSDKAction(modelAction elbv2model.Action) (*elbv2sdk.Action, error) {
35+
func buildSDKAction(modelAction elbv2model.Action, featureGate config.FeatureGate) (*elbv2sdk.Action, error) {
3536
sdkObj := &elbv2sdk.Action{}
3637
sdkObj.Type = awssdk.String(string(modelAction.Type))
3738
if modelAction.AuthenticateCognitoConfig != nil {
@@ -51,7 +52,15 @@ func buildSDKAction(modelAction elbv2model.Action) (*elbv2sdk.Action, error) {
5152
if err != nil {
5253
return nil, err
5354
}
54-
sdkObj.ForwardConfig = forwardConfig
55+
if featureGate.Enabled(config.EnforceSingleTargetGroup) {
56+
if len(forwardConfig.TargetGroups) == 1 {
57+
sdkObj.TargetGroupArn = forwardConfig.TargetGroups[0].TargetGroupArn
58+
} else {
59+
return nil, errors.New("The controller is configured to specify single Target Group but has more than one.")
60+
}
61+
} else {
62+
sdkObj.ForwardConfig = forwardConfig
63+
}
5564
}
5665
return sdkObj, nil
5766
}
@@ -60,28 +69,28 @@ func buildSDKAuthenticateCognitoActionConfig(modelCfg elbv2model.AuthenticateCog
6069
return &elbv2sdk.AuthenticateCognitoActionConfig{
6170
AuthenticationRequestExtraParams: awssdk.StringMap(modelCfg.AuthenticationRequestExtraParams),
6271
OnUnauthenticatedRequest: (*string)(modelCfg.OnUnauthenticatedRequest),
63-
Scope: modelCfg.Scope,
64-
SessionCookieName: modelCfg.SessionCookieName,
65-
SessionTimeout: modelCfg.SessionTimeout,
66-
UserPoolArn: awssdk.String(modelCfg.UserPoolARN),
67-
UserPoolClientId: awssdk.String(modelCfg.UserPoolClientID),
68-
UserPoolDomain: awssdk.String(modelCfg.UserPoolDomain),
72+
Scope: modelCfg.Scope,
73+
SessionCookieName: modelCfg.SessionCookieName,
74+
SessionTimeout: modelCfg.SessionTimeout,
75+
UserPoolArn: awssdk.String(modelCfg.UserPoolARN),
76+
UserPoolClientId: awssdk.String(modelCfg.UserPoolClientID),
77+
UserPoolDomain: awssdk.String(modelCfg.UserPoolDomain),
6978
}
7079
}
7180

7281
func buildSDKAuthenticateOidcActionConfig(modelCfg elbv2model.AuthenticateOIDCActionConfig) *elbv2sdk.AuthenticateOidcActionConfig {
7382
return &elbv2sdk.AuthenticateOidcActionConfig{
7483
AuthenticationRequestExtraParams: awssdk.StringMap(modelCfg.AuthenticationRequestExtraParams),
7584
OnUnauthenticatedRequest: (*string)(modelCfg.OnUnauthenticatedRequest),
76-
Scope: modelCfg.Scope,
77-
SessionCookieName: modelCfg.SessionCookieName,
78-
SessionTimeout: modelCfg.SessionTimeout,
79-
ClientId: awssdk.String(modelCfg.ClientID),
80-
ClientSecret: awssdk.String(modelCfg.ClientSecret),
81-
Issuer: awssdk.String(modelCfg.Issuer),
82-
AuthorizationEndpoint: awssdk.String(modelCfg.AuthorizationEndpoint),
83-
TokenEndpoint: awssdk.String(modelCfg.TokenEndpoint),
84-
UserInfoEndpoint: awssdk.String(modelCfg.UserInfoEndpoint),
85+
Scope: modelCfg.Scope,
86+
SessionCookieName: modelCfg.SessionCookieName,
87+
SessionTimeout: modelCfg.SessionTimeout,
88+
ClientId: awssdk.String(modelCfg.ClientID),
89+
ClientSecret: awssdk.String(modelCfg.ClientSecret),
90+
Issuer: awssdk.String(modelCfg.Issuer),
91+
AuthorizationEndpoint: awssdk.String(modelCfg.AuthorizationEndpoint),
92+
TokenEndpoint: awssdk.String(modelCfg.TokenEndpoint),
93+
UserInfoEndpoint: awssdk.String(modelCfg.UserInfoEndpoint),
8594
}
8695
}
8796

0 commit comments

Comments
 (0)