Skip to content

Commit 92445ac

Browse files
oliviassssoliviassss
authored
Add port range restriction for SG (#2236)
* add port range restriction * add CIDRs tests and add flag check on model_build_target_group * simplify computeRestrictedIngressPermissionsPerSG
1 parent 862890a commit 92445ac

File tree

9 files changed

+669
-85
lines changed

9 files changed

+669
-85
lines changed

‎controllers/ingress/group_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ func NewGroupReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorder
5757
annotationParser, subnetsResolver,
5858
authConfigBuilder, enhancedBackendBuilder, trackingProvider, elbv2TaggingManager,
5959
cloud.VpcID(), config.ClusterName, config.DefaultTags, config.ExternalManagedTags,
60-
config.DefaultSSLPolicy, backendSGProvider, config.EnableBackendSecurityGroup, logger)
60+
config.DefaultSSLPolicy, backendSGProvider, config.EnableBackendSecurityGroup, config.DisableRestrictedSGRules, logger)
6161
stackMarshaller := deploy.NewDefaultStackMarshaller()
6262
stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler,
6363
config, ingressTagPrefix, logger)

‎main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ func main() {
107107
subnetResolver := networking.NewDefaultSubnetsResolver(azInfoProvider, cloud.EC2(), cloud.VpcID(), controllerCFG.ClusterName, ctrl.Log.WithName("subnets-resolver"))
108108
vpcResolver := networking.NewDefaultVPCResolver(cloud.EC2(), cloud.VpcID(), ctrl.Log.WithName("vpc-resolver"))
109109
tgbResManager := targetgroupbinding.NewDefaultResourceManager(mgr.GetClient(), cloud.ELBV2(), cloud.EC2(),
110-
podInfoRepo, sgManager, sgReconciler, cloud.VpcID(), controllerCFG.ClusterName, mgr.GetEventRecorderFor("targetGroupBinding"), ctrl.Log, controllerCFG.EnableEndpointSlices)
110+
podInfoRepo, sgManager, sgReconciler, cloud.VpcID(), controllerCFG.ClusterName, mgr.GetEventRecorderFor("targetGroupBinding"), ctrl.Log, controllerCFG.EnableEndpointSlices, controllerCFG.DisableRestrictedSGRules)
111111
backendSGProvider := networking.NewBackendSGProvider(controllerCFG.ClusterName, controllerCFG.BackendSecurityGroup,
112112
cloud.VpcID(), cloud.EC2(), mgr.GetClient(), ctrl.Log.WithName("backend-sg-provider"))
113113
ingGroupReconciler := ingress.NewGroupReconciler(cloud, mgr.GetClient(), mgr.GetEventRecorderFor("ingress"),

‎pkg/config/controller_config.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,14 @@ const (
2323
flagEnableBackendSG = "enable-backend-security-group"
2424
flagBackendSecurityGroup = "backend-security-group"
2525
flagEnableEndpointSlices = "enable-endpoint-slices"
26+
flagDisableRestrictedSGRules = "disable-restricted-sg-rules"
2627
defaultLogLevel = "info"
2728
defaultMaxConcurrentReconciles = 3
2829
defaultMaxExponentialBackoffDelay = time.Second * 1000
2930
defaultSSLPolicy = "ELBSecurityPolicy-2016-08"
3031
defaultEnableBackendSG = true
3132
defaultEnableEndpointSlices = false
33+
defaultDisableRestrictedSGRules = false
3234
)
3335

3436
var (
@@ -84,6 +86,9 @@ type ControllerConfig struct {
8486
// BackendSecurityGroups specifies the configured backend security group to use
8587
// for optimized security group rules
8688
BackendSecurityGroup string
89+
90+
// DisableRestrictedSGRules specifies whether to use restricted security group rules
91+
DisableRestrictedSGRules bool
8792
}
8893

8994
// BindFlags binds the command line flags to the fields in the config object
@@ -109,6 +114,9 @@ func (cfg *ControllerConfig) BindFlags(fs *pflag.FlagSet) {
109114
"Backend security group id to use for the ingress rules on the worker node SG")
110115
fs.BoolVar(&cfg.EnableEndpointSlices, flagEnableEndpointSlices, defaultEnableEndpointSlices,
111116
"Enable EndpointSlices for IP targets instead of Endpoints")
117+
fs.BoolVar(&cfg.DisableRestrictedSGRules, flagDisableRestrictedSGRules, defaultDisableRestrictedSGRules,
118+
"Disable the usage of restricted security group rules")
119+
112120
cfg.AWSConfig.BindFlags(fs)
113121
cfg.RuntimeConfig.BindFlags(fs)
114122

‎pkg/ingress/model_build_target_group.go

Lines changed: 44 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ func (t *defaultModelBuildTask) buildTargetGroupBinding(ctx context.Context, tg
5353

5454
func (t *defaultModelBuildTask) buildTargetGroupBindingSpec(ctx context.Context, tg *elbv2model.TargetGroup, svc *corev1.Service, port intstr.IntOrString, nodeSelector *metav1.LabelSelector) elbv2model.TargetGroupBindingResourceSpec {
5555
targetType := elbv2api.TargetType(tg.Spec.TargetType)
56-
tgbNetworking := t.buildTargetGroupBindingNetworking(ctx)
56+
tgbNetworking := t.buildTargetGroupBindingNetworking(ctx, tg.Spec.Port, *tg.Spec.HealthCheckConfig.Port)
5757
return elbv2model.TargetGroupBindingResourceSpec{
5858
Template: elbv2model.TargetGroupBindingTemplate{
5959
ObjectMeta: metav1.ObjectMeta{
@@ -74,29 +74,59 @@ func (t *defaultModelBuildTask) buildTargetGroupBindingSpec(ctx context.Context,
7474
}
7575
}
7676

77-
func (t *defaultModelBuildTask) buildTargetGroupBindingNetworking(ctx context.Context) *elbv2model.TargetGroupBindingNetworking {
77+
func (t *defaultModelBuildTask) buildTargetGroupBindingNetworking(ctx context.Context, targetGroupPort int64, healthCheckPort intstr.IntOrString) *elbv2model.TargetGroupBindingNetworking {
7878
if t.backendSGIDToken == nil {
7979
return nil
8080
}
8181
protocolTCP := elbv2api.NetworkingProtocolTCP
82-
return &elbv2model.TargetGroupBindingNetworking{
83-
Ingress: []elbv2model.NetworkingIngressRule{
84-
{
85-
From: []elbv2model.NetworkingPeer{
86-
{
87-
SecurityGroup: &elbv2model.SecurityGroup{
88-
GroupID: t.backendSGIDToken,
82+
if t.disableRestrictedSGRules {
83+
return &elbv2model.TargetGroupBindingNetworking{
84+
Ingress: []elbv2model.NetworkingIngressRule{
85+
{
86+
From: []elbv2model.NetworkingPeer{
87+
{
88+
SecurityGroup: &elbv2model.SecurityGroup{
89+
GroupID: t.backendSGIDToken,
90+
},
91+
},
92+
},
93+
Ports: []elbv2api.NetworkingPort{
94+
{
95+
Protocol: &protocolTCP,
96+
Port: nil,
8997
},
9098
},
9199
},
92-
Ports: []elbv2api.NetworkingPort{
93-
{
94-
Protocol: &protocolTCP,
95-
Port: nil,
100+
},
101+
}
102+
}
103+
var networkingPorts []elbv2api.NetworkingPort
104+
var networkingRules []elbv2model.NetworkingIngressRule
105+
tgPort := intstr.FromInt(int(targetGroupPort))
106+
networkingPorts = append(networkingPorts, elbv2api.NetworkingPort{
107+
Protocol: &protocolTCP,
108+
Port: &tgPort,
109+
})
110+
if healthCheckPort.String() != healthCheckPortTrafficPort {
111+
networkingPorts = append(networkingPorts, elbv2api.NetworkingPort{
112+
Protocol: &protocolTCP,
113+
Port: &healthCheckPort,
114+
})
115+
}
116+
for _, port := range networkingPorts {
117+
networkingRules = append(networkingRules, elbv2model.NetworkingIngressRule{
118+
From: []elbv2model.NetworkingPeer{
119+
{
120+
SecurityGroup: &elbv2model.SecurityGroup{
121+
GroupID: t.backendSGIDToken,
96122
},
97123
},
98124
},
99-
},
125+
Ports: []elbv2api.NetworkingPort{port},
126+
})
127+
}
128+
return &elbv2model.TargetGroupBindingNetworking{
129+
Ingress: networkingRules,
100130
}
101131
}
102132

‎pkg/ingress/model_builder.go

Lines changed: 58 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -40,29 +40,30 @@ func NewDefaultModelBuilder(k8sClient client.Client, eventRecorder record.EventR
4040
authConfigBuilder AuthConfigBuilder, enhancedBackendBuilder EnhancedBackendBuilder,
4141
trackingProvider tracking.Provider, elbv2TaggingManager elbv2deploy.TaggingManager,
4242
vpcID string, clusterName string, defaultTags map[string]string, externalManagedTags []string, defaultSSLPolicy string,
43-
backendSGProvider networkingpkg.BackendSGProvider, enableBackendSG bool, logger logr.Logger) *defaultModelBuilder {
43+
backendSGProvider networkingpkg.BackendSGProvider, enableBackendSG bool, disableRestrictedSGRules bool, logger logr.Logger) *defaultModelBuilder {
4444
certDiscovery := NewACMCertDiscovery(acmClient, logger)
4545
ruleOptimizer := NewDefaultRuleOptimizer(logger)
4646
return &defaultModelBuilder{
47-
k8sClient: k8sClient,
48-
eventRecorder: eventRecorder,
49-
ec2Client: ec2Client,
50-
vpcID: vpcID,
51-
clusterName: clusterName,
52-
annotationParser: annotationParser,
53-
subnetsResolver: subnetsResolver,
54-
backendSGProvider: backendSGProvider,
55-
certDiscovery: certDiscovery,
56-
authConfigBuilder: authConfigBuilder,
57-
enhancedBackendBuilder: enhancedBackendBuilder,
58-
ruleOptimizer: ruleOptimizer,
59-
trackingProvider: trackingProvider,
60-
elbv2TaggingManager: elbv2TaggingManager,
61-
defaultTags: defaultTags,
62-
externalManagedTags: sets.NewString(externalManagedTags...),
63-
defaultSSLPolicy: defaultSSLPolicy,
64-
enableBackendSG: enableBackendSG,
65-
logger: logger,
47+
k8sClient: k8sClient,
48+
eventRecorder: eventRecorder,
49+
ec2Client: ec2Client,
50+
vpcID: vpcID,
51+
clusterName: clusterName,
52+
annotationParser: annotationParser,
53+
subnetsResolver: subnetsResolver,
54+
backendSGProvider: backendSGProvider,
55+
certDiscovery: certDiscovery,
56+
authConfigBuilder: authConfigBuilder,
57+
enhancedBackendBuilder: enhancedBackendBuilder,
58+
ruleOptimizer: ruleOptimizer,
59+
trackingProvider: trackingProvider,
60+
elbv2TaggingManager: elbv2TaggingManager,
61+
defaultTags: defaultTags,
62+
externalManagedTags: sets.NewString(externalManagedTags...),
63+
defaultSSLPolicy: defaultSSLPolicy,
64+
enableBackendSG: enableBackendSG,
65+
disableRestrictedSGRules: disableRestrictedSGRules,
66+
logger: logger,
6667
}
6768
}
6869

@@ -77,19 +78,20 @@ type defaultModelBuilder struct {
7778
vpcID string
7879
clusterName string
7980

80-
annotationParser annotations.Parser
81-
subnetsResolver networkingpkg.SubnetsResolver
82-
backendSGProvider networkingpkg.BackendSGProvider
83-
certDiscovery CertDiscovery
84-
authConfigBuilder AuthConfigBuilder
85-
enhancedBackendBuilder EnhancedBackendBuilder
86-
ruleOptimizer RuleOptimizer
87-
trackingProvider tracking.Provider
88-
elbv2TaggingManager elbv2deploy.TaggingManager
89-
defaultTags map[string]string
90-
externalManagedTags sets.String
91-
defaultSSLPolicy string
92-
enableBackendSG bool
81+
annotationParser annotations.Parser
82+
subnetsResolver networkingpkg.SubnetsResolver
83+
backendSGProvider networkingpkg.BackendSGProvider
84+
certDiscovery CertDiscovery
85+
authConfigBuilder AuthConfigBuilder
86+
enhancedBackendBuilder EnhancedBackendBuilder
87+
ruleOptimizer RuleOptimizer
88+
trackingProvider tracking.Provider
89+
elbv2TaggingManager elbv2deploy.TaggingManager
90+
defaultTags map[string]string
91+
externalManagedTags sets.String
92+
defaultSSLPolicy string
93+
enableBackendSG bool
94+
disableRestrictedSGRules bool
9395

9496
logger logr.Logger
9597
}
@@ -98,22 +100,23 @@ type defaultModelBuilder struct {
98100
func (b *defaultModelBuilder) Build(ctx context.Context, ingGroup Group) (core.Stack, *elbv2model.LoadBalancer, error) {
99101
stack := core.NewDefaultStack(core.StackID(ingGroup.ID))
100102
task := &defaultModelBuildTask{
101-
k8sClient: b.k8sClient,
102-
eventRecorder: b.eventRecorder,
103-
ec2Client: b.ec2Client,
104-
vpcID: b.vpcID,
105-
clusterName: b.clusterName,
106-
annotationParser: b.annotationParser,
107-
subnetsResolver: b.subnetsResolver,
108-
certDiscovery: b.certDiscovery,
109-
authConfigBuilder: b.authConfigBuilder,
110-
enhancedBackendBuilder: b.enhancedBackendBuilder,
111-
ruleOptimizer: b.ruleOptimizer,
112-
trackingProvider: b.trackingProvider,
113-
elbv2TaggingManager: b.elbv2TaggingManager,
114-
backendSGProvider: b.backendSGProvider,
115-
logger: b.logger,
116-
enableBackendSG: b.enableBackendSG,
103+
k8sClient: b.k8sClient,
104+
eventRecorder: b.eventRecorder,
105+
ec2Client: b.ec2Client,
106+
vpcID: b.vpcID,
107+
clusterName: b.clusterName,
108+
annotationParser: b.annotationParser,
109+
subnetsResolver: b.subnetsResolver,
110+
certDiscovery: b.certDiscovery,
111+
authConfigBuilder: b.authConfigBuilder,
112+
enhancedBackendBuilder: b.enhancedBackendBuilder,
113+
ruleOptimizer: b.ruleOptimizer,
114+
trackingProvider: b.trackingProvider,
115+
elbv2TaggingManager: b.elbv2TaggingManager,
116+
backendSGProvider: b.backendSGProvider,
117+
logger: b.logger,
118+
enableBackendSG: b.enableBackendSG,
119+
disableRestrictedSGRules: b.disableRestrictedSGRules,
117120

118121
ingGroup: ingGroup,
119122
stack: stack,
@@ -163,11 +166,12 @@ type defaultModelBuildTask struct {
163166
elbv2TaggingManager elbv2deploy.TaggingManager
164167
logger logr.Logger
165168

166-
ingGroup Group
167-
sslRedirectConfig *SSLRedirectConfig
168-
stack core.Stack
169-
backendSGIDToken core.StringToken
170-
enableBackendSG bool
169+
ingGroup Group
170+
sslRedirectConfig *SSLRedirectConfig
171+
stack core.Stack
172+
backendSGIDToken core.StringToken
173+
enableBackendSG bool
174+
disableRestrictedSGRules bool
171175

172176
defaultTags map[string]string
173177
externalManagedTags sets.String

0 commit comments

Comments
 (0)