Skip to content

Commit c472a5f

Browse files
johngmyersjohngmyers
committed
Add securityGroups field to IngressClassParams
1 parent 940efc7 commit c472a5f

File tree

5 files changed

+197
-2
lines changed

5 files changed

+197
-2
lines changed

‎apis/elbv2/v1beta1/ingressclassparams_types.go

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,39 @@ const (
4141
LoadBalancerSchemeInternetFacing LoadBalancerScheme = "internet-facing"
4242
)
4343

44+
// SecurityGroupID specifies a security group ID.
45+
// +kubebuilder:validation:Pattern=sg-[0-9a-f]+
46+
type SecurityGroupID string
47+
48+
// SecurityGroupSelector selects one or more existing security groups.
49+
type SecurityGroupSelector struct {
50+
// IDs specify the resource IDs of security groups.
51+
// Exactly one of this, `managedInbound`, or `tags` must be specified.
52+
// +kubebuilder:validation:MinItems=1
53+
// +optional
54+
IDs []SecurityGroupID `json:"ids,omitempty"`
55+
56+
// ManagedBackend specifies that the controller will create and include a security group for
57+
// traffic between the load balancer and its targets.
58+
// If `managedInbound` is `true`, defaults to the value of the controller's
59+
// `--enable-backend-security-group` flag. Otherwise, defaults to `false`.
60+
// +optional
61+
ManagedBackend *bool `json:"managedBackend,omitempty"`
62+
63+
// ManagedInbound specifies that the controller will create a security group allowing traffic from
64+
// `inboundCIDRs` to the `listen-ports`.
65+
// Exactly one of this, `ids`, or `tags` must be specified.
66+
// +optional
67+
ManagedInbound bool `json:"managedInbound,omitempty"`
68+
69+
// Tags specifies security groups in the load balancer's VPC where each
70+
// tag specified in the map key contains one of the values in the corresponding
71+
// value list.
72+
// Exactly one of this, `ids`, or `managedInbound` must be specified.
73+
// +optional
74+
Tags map[string][]string `json:"tags,omitempty"`
75+
}
76+
4477
// SubnetID specifies a subnet ID.
4578
// +kubebuilder:validation:Pattern=subnet-[0-9a-f]+
4679
type SubnetID string
@@ -100,9 +133,14 @@ type IngressClassParamsSpec struct {
100133
Scheme *LoadBalancerScheme `json:"scheme,omitempty"`
101134

102135
// InboundCIDRs specifies the CIDRs that are allowed to access the Ingresses that belong to IngressClass with this IngressClassParams.
136+
// If this and `securityGroups` are both specified, `securityGroups.managed` must be `true`.
103137
// +optional
104138
InboundCIDRs []string `json:"inboundCIDRs,omitempty"`
105139

140+
// SecurityGroups defines the security groups to attach to all Ingresses that belong to IngressClass with this IngressClassParams.
141+
// +optional
142+
SecurityGroups *SecurityGroupSelector `json:"securityGroups,omitempty"`
143+
106144
// SSLPolicy specifies the SSL Policy for all Ingresses that belong to IngressClass with this IngressClassParams.
107145
// +optional
108146
SSLPolicy string `json:"sslPolicy,omitEmpty"`

‎apis/elbv2/v1beta1/zz_generated.deepcopy.go

Lines changed: 45 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ spec:
6464
inboundCIDRs:
6565
description: InboundCIDRs specifies the CIDRs that are allowed to
6666
access the Ingresses that belong to IngressClass with this IngressClassParams.
67+
If this and `securityGroups` are both specified, `securityGroups.managed`
68+
must be `true`.
6769
items:
6870
type: string
6971
type: array
@@ -146,6 +148,43 @@ spec:
146148
- internal
147149
- internet-facing
148150
type: string
151+
securityGroups:
152+
description: SecurityGroups defines the security groups to attach
153+
to all Ingresses that belong to IngressClass with this IngressClassParams.
154+
properties:
155+
ids:
156+
description: IDs specify the resource IDs of security groups.
157+
Exactly one of this, `managedInbound`, or `tags` must be specified.
158+
items:
159+
description: SecurityGroupID specifies a security group ID.
160+
pattern: sg-[0-9a-f]+
161+
type: string
162+
minItems: 1
163+
type: array
164+
managedBackend:
165+
description: ManagedBackend specifies that the controller will
166+
create and include a security group for traffic between the
167+
load balancer and its targets. If `managedInbound` is `true`,
168+
defaults to the value of the controller's `--enable-backend-security-group`
169+
flag. Otherwise, defaults to `false`.
170+
type: boolean
171+
managedInbound:
172+
description: ManagedInbound specifies that the controller will
173+
create a security group allowing traffic from `inboundCIDRs`
174+
to the `listen-ports`. Exactly one of this, `ids`, or `tags`
175+
must be specified.
176+
type: boolean
177+
tags:
178+
additionalProperties:
179+
items:
180+
type: string
181+
type: array
182+
description: Tags specifies security groups in the load balancer's
183+
VPC where each tag specified in the map key contains one of
184+
the values in the corresponding value list. Exactly one of this,
185+
`ids`, or `managedInbound` must be specified.
186+
type: object
187+
type: object
149188
sslPolicy:
150189
description: SSLPolicy specifies the SSL Policy for all Ingresses
151190
that belong to IngressClass with this IngressClassParams.

‎docs/guide/ingress/ingress_class.md

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,38 @@ Cluster administrators can use the `scheme` field to restrict the scheme for all
140140
Cluster administrators can use the optional `inboundCIDRs` field to specify the CIDRs that are allowed to access the load balancers that belong to this IngressClass.
141141
If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/inbound-cidrs` annotation.
142142

143+
#### spec.securityGroups
144+
145+
Cluster administrators can use the optional `securityGroups` field to specify the security groups for the load balancers that belong to this IngressClass.
146+
If the field is specified, they must specify one of `ids`, `managedInbound`, or `tags`.
147+
If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/security-groups`
148+
and `alb.ingress.kubernetes.io/manage-backend-security-group-rules` annotations.
149+
150+
##### spec.securityGroups.ids
151+
152+
If `ids` is specified, it must be a set of at least one resource ID of a security group in the VPC.
153+
154+
##### spec.securityGroups.managedInbound
155+
156+
If `managedInbound` is `true`, LBC will create a security group allowing traffic from `spec.inboundCIDRs` to the `listen-ports`.
157+
158+
##### spec.securityGroups.managedBackend
159+
160+
If `managedBackend` is `true`, LBC will create and include a security group for traffic between the load balancer and its targets.
161+
162+
If `managedInbound` is `true`, defaults to the value of the controller's `--enable-backend-security-group` flag. Otherwise, defaults to `false`.
163+
164+
##### spec.securityGroups.tags
165+
166+
If `tags` is specified, it is a map of tag filters. The filters will match security groups in the VPC for which
167+
each listed tag key is present and has one of the corresponding tag values.
168+
169+
Security groups with the cluster tag for another cluster and which do not have a cluster tag
170+
for this cluster will be excluded.
171+
172+
If any matching security group has a cluster tag for this cluster, then security groups without
173+
a cluster tag will be excluded.
174+
143175
#### spec.sslPolicy
144176

145177
Cluster administrators can use the optional `sslPolicy` field to specify the SSL policy for the load balancers that belong to this IngressClass.
@@ -148,7 +180,8 @@ If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/ssl-po
148180
#### spec.subnets
149181

150182
Cluster administrators can use the optional `subnets` field to specify the subnets for the load balancers that belong to this IngressClass.
151-
They may specify either `ids` or `tags`. If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/subnets annotation` annotation.
183+
If the field is specified, they must specify either `ids` or `tags`.
184+
If the field is specified, LBC will ignore the `alb.ingress.kubernetes.io/subnets` annotation.
152185

153186
##### spec.subnets.ids
154187

@@ -159,7 +192,8 @@ If `ids` is specified, it must be a set of at least one resource ID of a subnet
159192
If `tags` is specified, it is a map of tag filters. The filters will match subnets in the VPC for which
160193
each listed tag key is present and has one of the corresponding tag values.
161194

162-
Unless the `SubnetsClusterTagCheck` feature gate is disabled, subnets without a cluster tag and with the cluster tag for another cluster will be excluded.
195+
Unless the `SubnetsClusterTagCheck` feature gate is disabled, subnets with the cluster tag for another
196+
cluster and which do not have a cluster tag for this cluster will be excluded.
163197

164198
Within any given availability zone, subnets with a cluster tag will be chosen over subnets without, then the subnet with the lowest-sorting resource ID will be chosen.
165199

‎helm/aws-load-balancer-controller/crds/crds.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,8 @@ spec:
6363
inboundCIDRs:
6464
description: InboundCIDRs specifies the CIDRs that are allowed to
6565
access the Ingresses that belong to IngressClass with this IngressClassParams.
66+
If this and `securityGroups` are both specified, `securityGroups.managed`
67+
must be `true`.
6668
items:
6769
type: string
6870
type: array
@@ -145,6 +147,43 @@ spec:
145147
- internal
146148
- internet-facing
147149
type: string
150+
securityGroups:
151+
description: SecurityGroups defines the security groups to attach
152+
to all Ingresses that belong to IngressClass with this IngressClassParams.
153+
properties:
154+
ids:
155+
description: IDs specify the resource IDs of security groups.
156+
Exactly one of this, `managedInbound`, or `tags` must be specified.
157+
items:
158+
description: SecurityGroupID specifies a security group ID.
159+
pattern: sg-[0-9a-f]+
160+
type: string
161+
minItems: 1
162+
type: array
163+
managedBackend:
164+
description: ManagedBackend specifies that the controller will
165+
create and include a security group for traffic between the
166+
load balancer and its targets. If `managedInbound` is `true`,
167+
defaults to the value of the controller's `--enable-backend-security-group`
168+
flag. Otherwise, defaults to `false`.
169+
type: boolean
170+
managedInbound:
171+
description: ManagedInbound specifies that the controller will
172+
create a security group allowing traffic from `inboundCIDRs`
173+
to the `listen-ports`. Exactly one of this, `ids`, or `tags`
174+
must be specified.
175+
type: boolean
176+
tags:
177+
additionalProperties:
178+
items:
179+
type: string
180+
type: array
181+
description: Tags specifies security groups in the load balancer's
182+
VPC where each tag specified in the map key contains one of
183+
the values in the corresponding value list. Exactly one of this,
184+
`ids`, or `managedInbound` must be specified.
185+
type: object
186+
type: object
148187
sslPolicy:
149188
description: SSLPolicy specifies the SSL Policy for all Ingresses
150189
that belong to IngressClass with this IngressClassParams.

0 commit comments

Comments
 (0)