Skip to content

Commit 4b30d00

Browse files
authored
Add subnets field to IngressClassParams (#2945)
* Add subnets field to IngressClassParams * Add validating webhook for SubnetSpecs * Update documentation * make crds * Update Helm chart
1 parent a32c2a6 commit 4b30d00

17 files changed

+1272
-250
lines changed

apis/elbv2/v1beta1/ingressclassparams_types.go

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,25 @@ const (
4141
LoadBalancerSchemeInternetFacing LoadBalancerScheme = "internet-facing"
4242
)
4343

44+
// SubnetID specifies a subnet ID.
45+
// +kubebuilder:validation:Pattern=subnet-[0-9a-f]+
46+
type SubnetID string
47+
48+
// SubnetSelector selects one or more existing subnets.
49+
type SubnetSelector struct {
50+
// IDs specify the resource IDs of subnets. Exactly one of this or `tags` must be specified.
51+
// +kubebuilder:validation:MinItems=1
52+
// +optional
53+
IDs []SubnetID `json:"ids,omitempty"`
54+
55+
// Tags specifies subnets in the load balancer's VPC where each
56+
// tag specified in the map key contains one of the values in the corresponding
57+
// value list.
58+
// Exactly one of this or `ids` must be specified.
59+
// +optional
60+
Tags map[string][]string `json:"tags,omitempty"`
61+
}
62+
4463
// IngressGroup defines IngressGroup configuration.
4564
type IngressGroup struct {
4665
// Name is the name of IngressGroup.
@@ -80,6 +99,10 @@ type IngressClassParamsSpec struct {
8099
// +optional
81100
Scheme *LoadBalancerScheme `json:"scheme,omitempty"`
82101

102+
// Subnets defines the subnets for all Ingresses that belong to IngressClass with this IngressClassParams.
103+
// +optional
104+
Subnets *SubnetSelector `json:"subnets,omitempty"`
105+
83106
// IPAddressType defines the ip address type for all Ingresses that belong to IngressClass with this IngressClassParams.
84107
// +optional
85108
IPAddressType *IPAddressType `json:"ipAddressType,omitempty"`

apis/elbv2/v1beta1/zz_generated.deepcopy.go

Lines changed: 40 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,30 @@ spec:
140140
- internal
141141
- internet-facing
142142
type: string
143+
subnets:
144+
description: Subnets defines the subnets for all Ingresses that belong
145+
to IngressClass with this IngressClassParams.
146+
properties:
147+
ids:
148+
description: IDs specify the resource IDs of subnets. Exactly
149+
one of this or `tags` must be specified.
150+
items:
151+
description: SubnetID specifies a subnet ID.
152+
pattern: subnet-[0-9a-f]+
153+
type: string
154+
minItems: 1
155+
type: array
156+
tags:
157+
additionalProperties:
158+
items:
159+
type: string
160+
type: array
161+
description: Tags specifies subnets in the load balancer's VPC
162+
where each tag specified in the map key contains one of the
163+
values in the corresponding value list. Exactly one of this
164+
or `ids` must be specified.
165+
type: object
166+
type: object
143167
tags:
144168
description: Tags defines list of Tags on AWS resources provisioned
145169
for Ingresses that belong to IngressClass with this IngressClassParams.

config/webhook/manifests.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
apiVersion: admissionregistration.k8s.io/v1
23
kind: MutatingWebhookConfiguration
34
metadata:
@@ -50,6 +51,26 @@ metadata:
5051
creationTimestamp: null
5152
name: webhook
5253
webhooks:
54+
- admissionReviewVersions:
55+
- v1beta1
56+
clientConfig:
57+
service:
58+
name: webhook-service
59+
namespace: system
60+
path: /validate-elbv2-k8s-aws-v1beta1-ingressclassparams
61+
failurePolicy: Fail
62+
name: vingressclassparams.elbv2.k8s.aws
63+
rules:
64+
- apiGroups:
65+
- elbv2.k8s.aws
66+
apiVersions:
67+
- v1beta1
68+
operations:
69+
- CREATE
70+
- UPDATE
71+
resources:
72+
- ingressclassparams
73+
sideEffects: None
5374
- admissionReviewVersions:
5475
- v1beta1
5576
clientConfig:

docs/guide/ingress/ingress_class.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,24 @@ Cluster administrators can use the `scheme` field to restrict the scheme for all
135135
1. If `scheme` specified, all Ingresses with this IngressClass will have the specified scheme.
136136
2. If `scheme` un-specified, Ingresses with this IngressClass can continue to use `alb.ingress.kubernetes.io/scheme annotation` to specify scheme.
137137

138+
#### spec.subnets
139+
140+
Cluster administrators can use the optional `subnets` field to specify the subnets for the load balancers that belong to this IngressClass.
141+
They may specify either `ids` or `tags`. If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/subnets annotation` annotation.
142+
143+
##### spec.subnets.ids
144+
145+
If `ids` is specified, it must be a set of at least one resource ID of a subnet in the VPC. No two subnets may be in the same availability zone.
146+
147+
##### spec.subnets.tags
148+
149+
If `tags` is specified, it is a map of tag filters. The filters will match subnets in the VPC for which
150+
each listed tag key is present and has one of the corresponding tag values.
151+
152+
Unless the `SubnetsClusterTagCheck` feature gate is disabled, subnets without a cluster tag and with the cluster tag for another cluster will be excluded.
153+
154+
Within any given availability zone, subnets with a cluster tag will be chosen over subnets without, then the subnet with the lowest-sorting resource ID will be chosen.
155+
138156
#### spec.ipAddressType
139157

140158
`ipAddressType` is an optional setting. The available options are `ipv4` or `dualstack`.

0 commit comments

Comments
 (0)