Skip to content

Commit fee6232

Browse files
kishorjkishorj
authored
Add default tags to backend SG (#2425)
* Add default tags to backend SG * update controller configurations doc
1 parent d6f4a60 commit fee6232

File tree

5 files changed

+92
-13
lines changed

5 files changed

+92
-13
lines changed

‎docs/deploy/configurations.md

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,23 +66,28 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
6666
6767
|Flag | Type | Default | Description |
6868
|---------------------------------------|---------------------------------|-----------------|-------------|
69+
|aws-api-endpoints | AWS API Endpoints Config | | AWS API endpoints mapping, format: serviceID1=URL1,serviceID2=URL2 |
6970
|aws-api-throttle | AWS Throttle Config | [default value](#default-throttle-config ) | throttle settings for AWS APIs, format: serviceID1:operationRegex1=rate:burst,serviceID2:operationRegex2=rate:burst |
7071
|aws-max-retries | int | 10 | Maximum retries for AWS APIs |
7172
|aws-region | string | [instance metadata](#instance-metadata) | AWS Region for the kubernetes cluster |
7273
|aws-vpc-id | string | [instance metadata](#instance-metadata) | AWS VPC ID for the Kubernetes cluster |
73-
|aws-api-endpoints | AWS API Endpoints Config | | AWS API endpoints mapping, format: serviceID1=URL1,serviceID2=URL2 |
74+
|backend-security-group | string | | Backend security group id to use for the ingress rules on the worker node SG|
7475
|cluster-name | string | | Kubernetes cluster name|
75-
|default-tags | stringMap | | AWS Tags that will be applied to all AWS resources managed by this controller. Specified Tags takes highest priority |
7676
|default-ssl-policy | string | ELBSecurityPolicy-2016-08 | Default SSL Policy that will be applied to all Ingresses or Services that do not have the SSL Policy annotation |
77+
|default-tags | stringMap | | AWS Tags that will be applied to all AWS resources managed by this controller. Specified Tags takes highest priority |
7778
|[disable-ingress-class-annotation](#disable-ingress-class-annotation) | boolean | false | Disable new usage of the `kubernetes.io/ingress.class` annotation |
7879
|[disable-ingress-group-name-annotation](#disable-ingress-group-name-annotation) | boolean | false | Disallow new use of the `alb.ingress.kubernetes.io/group.name` annotation |
80+
|disable-restricted-sg-rules | boolean | false | Disable the usage of restricted security group rules |
81+
|enable-backend-security-group | boolean | true | Enable sharing of security groups for backend traffic |
82+
|enable-endpoint-slices | boolean | false | Use EndpointSlices instead of Endpoints for pod endpoint and TargetGroupBinding resolution for load balancers with IP targets. |
7983
|enable-leader-election | boolean | true | Enable leader election for the load balancer controller manager. Enabling this will ensure there is only one active controller manager |
8084
|enable-pod-readiness-gate-inject | boolean | true | If enabled, targetHealth readiness gate will get injected to the pod spec for the matching endpoint pods |
8185
|enable-shield | boolean | true | Enable Shield addon for ALB |
8286
|enable-waf | boolean | true | Enable WAF addon for ALB |
8387
|enable-wafv2 | boolean | true | Enable WAF V2 addon for ALB |
8488
|external-managed-tags | stringList | | AWS Tag keys that will be managed externally. Specified Tags are ignored during reconciliation |
8589
|[feature-gates](#feature-gates) | stringMap | | A set of key=value pairs to enable or disable features |
90+
|health-probe-bind-addr | string | :61779 | The address the health probes binds to |
8691
|ingress-class | string | alb | Name of the ingress class this controller satisfies |
8792
|ingress-max-concurrent-reconciles | int | 3 | Maximum number of concurrently running reconcile loops for ingress |
8893
|kubeconfig | string | in-cluster config | Path to the kubeconfig file containing authorization and API server information |
@@ -94,7 +99,6 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
9499
|sync-period | duration | 1h0m0s | Period at which the controller forces the repopulation of its local object stores|
95100
|targetgroupbinding-max-concurrent-reconciles | int | 3 | Maximum number of concurrently running reconcile loops for targetGroupBinding |
96101
|targetgroupbinding-max-exponential-backoff-delay | duration | 16m40s | Maximum duration of exponential backoff for targetGroupBinding reconcile failures |
97-
|enable-endpoint-slices | boolean | false | Use EndpointSlices instead of Endpoints for pod endpoint and TargetGroupBinding resolution for load balancers with IP targets. |
98102
|watch-namespace | string | | Namespace the controller watches for updates to Kubernetes objects, If empty, all namespaces are watched. |
99103
|webhook-bind-port | int | 9443 | The TCP port the Webhook server binds to |
100104
|webhook-cert-dir | string | /tmp/k8s-webhook-server/serving-certs | The directory that contains the server key and certificate |

‎main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ func main() {
108108
tgbResManager := targetgroupbinding.NewDefaultResourceManager(mgr.GetClient(), cloud.ELBV2(), cloud.EC2(),
109109
podInfoRepo, sgManager, sgReconciler, cloud.VpcID(), controllerCFG.ClusterName, mgr.GetEventRecorderFor("targetGroupBinding"), ctrl.Log, controllerCFG.EnableEndpointSlices, controllerCFG.DisableRestrictedSGRules, vpcInfoProvider)
110110
backendSGProvider := networking.NewBackendSGProvider(controllerCFG.ClusterName, controllerCFG.BackendSecurityGroup,
111-
cloud.VpcID(), cloud.EC2(), mgr.GetClient(), ctrl.Log.WithName("backend-sg-provider"))
111+
cloud.VpcID(), cloud.EC2(), mgr.GetClient(), controllerCFG.DefaultTags, ctrl.Log.WithName("backend-sg-provider"))
112112
ingGroupReconciler := ingress.NewGroupReconciler(cloud, mgr.GetClient(), mgr.GetEventRecorderFor("ingress"),
113113
finalizerManager, sgManager, sgReconciler, subnetResolver,
114114
controllerCFG, backendSGProvider, ctrl.Log.WithName("controllers").WithName("ingress"))

‎pkg/config/controller_config.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ const (
3636
var (
3737
trackingTagKeys = sets.NewString(
3838
"elbv2.k8s.aws/cluster",
39+
"elbv2.k8s.aws/resource",
3940
"ingress.k8s.aws/stack",
4041
"ingress.k8s.aws/resource",
4142
"service.k8s.aws/stack",

‎pkg/networking/backend_sg_provider.go

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,21 @@ import (
55
"crypto/sha256"
66
"encoding/hex"
77
"fmt"
8+
"regexp"
9+
"sort"
10+
"strings"
11+
"sync"
12+
"time"
13+
814
awssdk "github.com/aws/aws-sdk-go/aws"
915
"github.com/aws/aws-sdk-go/aws/awserr"
1016
ec2sdk "github.com/aws/aws-sdk-go/service/ec2"
1117
"github.com/go-logr/logr"
1218
"github.com/pkg/errors"
1319
networking "k8s.io/api/networking/v1"
14-
"regexp"
1520
"sigs.k8s.io/aws-load-balancer-controller/pkg/aws/services"
1621
"sigs.k8s.io/aws-load-balancer-controller/pkg/runtime"
1722
"sigs.k8s.io/controller-runtime/pkg/client"
18-
"strings"
19-
"sync"
20-
"time"
2123
)
2224

2325
const (
@@ -45,11 +47,12 @@ type BackendSGProvider interface {
4547

4648
// NewBackendSGProvider constructs a new defaultBackendSGProvider
4749
func NewBackendSGProvider(clusterName string, backendSG string, vpcID string,
48-
ec2Client services.EC2, k8sClient client.Client, logger logr.Logger) *defaultBackendSGProvider {
50+
ec2Client services.EC2, k8sClient client.Client, defaultTags map[string]string, logger logr.Logger) *defaultBackendSGProvider {
4951
return &defaultBackendSGProvider{
5052
vpcID: vpcID,
5153
clusterName: clusterName,
5254
backendSG: backendSG,
55+
defaultTags: defaultTags,
5356
ec2Client: ec2Client,
5457
k8sClient: k8sClient,
5558
logger: logger,
@@ -69,6 +72,7 @@ type defaultBackendSGProvider struct {
6972

7073
backendSG string
7174
autoGeneratedSG string
75+
defaultTags map[string]string
7276
ec2Client services.EC2
7377
k8sClient client.Client
7478
logger logr.Logger
@@ -135,10 +139,20 @@ func (p *defaultBackendSGProvider) allocateBackendSG(ctx context.Context) error
135139
}
136140

137141
func (p *defaultBackendSGProvider) buildBackendSGTags(_ context.Context) []*ec2sdk.TagSpecification {
142+
var defaultTags []*ec2sdk.Tag
143+
for key, val := range p.defaultTags {
144+
defaultTags = append(defaultTags, &ec2sdk.Tag{
145+
Key: awssdk.String(key),
146+
Value: awssdk.String(val),
147+
})
148+
}
149+
sort.Slice(defaultTags, func(i, j int) bool {
150+
return awssdk.StringValue(defaultTags[i].Key) < awssdk.StringValue(defaultTags[j].Key)
151+
})
138152
return []*ec2sdk.TagSpecification{
139153
{
140154
ResourceType: awssdk.String(resourceTypeSecurityGroup),
141-
Tags: []*ec2sdk.Tag{
155+
Tags: append(defaultTags, []*ec2sdk.Tag{
142156
{
143157
Key: awssdk.String(tagKeyK8sCluster),
144158
Value: awssdk.String(p.clusterName),
@@ -147,7 +161,7 @@ func (p *defaultBackendSGProvider) buildBackendSGTags(_ context.Context) []*ec2s
147161
Key: awssdk.String(tagKeyResource),
148162
Value: awssdk.String(tagValueBackend),
149163
},
150-
},
164+
}...),
151165
},
152166
}
153167
}

‎pkg/networking/backend_sg_provider_test.go

Lines changed: 62 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ func Test_defaultBackendSGProvider_Get(t *testing.T) {
3636
}
3737
type fields struct {
3838
backendSG string
39+
defaultTags map[string]string
3940
describeSGCalls []describeSecurityGroupsAsListCall
4041
createSGCalls []createSecurityGroupWithContexCall
4142
}
@@ -125,6 +126,64 @@ func Test_defaultBackendSGProvider_Get(t *testing.T) {
125126
},
126127
want: "sg-newauto",
127128
},
129+
{
130+
name: "backend sg enabled, auto-gen new SG with additional defaultTags",
131+
fields: fields{
132+
describeSGCalls: []describeSecurityGroupsAsListCall{
133+
{
134+
req: &ec2sdk.DescribeSecurityGroupsInput{
135+
Filters: defaultEC2Filters,
136+
},
137+
err: awserr.New("InvalidGroup.NotFound", "", nil),
138+
},
139+
},
140+
createSGCalls: []createSecurityGroupWithContexCall{
141+
{
142+
req: &ec2sdk.CreateSecurityGroupInput{
143+
Description: awssdk.String(sgDescription),
144+
GroupName: awssdk.String("k8s-traffic-testCluster-411a1bcdb1"),
145+
TagSpecifications: []*ec2sdk.TagSpecification{
146+
{
147+
ResourceType: awssdk.String("security-group"),
148+
Tags: []*ec2sdk.Tag{
149+
{
150+
Key: awssdk.String("KubernetesCluster"),
151+
Value: awssdk.String(defaultClusterName),
152+
},
153+
{
154+
Key: awssdk.String("defaultTag"),
155+
Value: awssdk.String("specified"),
156+
},
157+
{
158+
Key: awssdk.String("zzzKey"),
159+
Value: awssdk.String("value"),
160+
},
161+
{
162+
Key: awssdk.String("elbv2.k8s.aws/cluster"),
163+
Value: awssdk.String(defaultClusterName),
164+
},
165+
{
166+
Key: awssdk.String("elbv2.k8s.aws/resource"),
167+
Value: awssdk.String("backend-sg"),
168+
},
169+
},
170+
},
171+
},
172+
VpcId: awssdk.String(defaultVPCID),
173+
},
174+
resp: &ec2sdk.CreateSecurityGroupOutput{
175+
GroupId: awssdk.String("sg-newauto"),
176+
},
177+
},
178+
},
179+
defaultTags: map[string]string{
180+
"zzzKey": "value",
181+
"KubernetesCluster": defaultClusterName,
182+
"defaultTag": "specified",
183+
},
184+
},
185+
want: "sg-newauto",
186+
},
128187
{
129188
name: "describe SG call returns error",
130189
fields: fields{
@@ -193,7 +252,7 @@ func Test_defaultBackendSGProvider_Get(t *testing.T) {
193252
}
194253
k8sClient := mock_client.NewMockClient(ctrl)
195254
sgProvider := NewBackendSGProvider(defaultClusterName, tt.fields.backendSG,
196-
defaultVPCID, ec2Client, k8sClient, &log.NullLogger{})
255+
defaultVPCID, ec2Client, k8sClient, tt.fields.defaultTags, &log.NullLogger{})
197256

198257
got, err := sgProvider.Get(context.Background())
199258
if tt.wantErr != nil {
@@ -222,6 +281,7 @@ func Test_defaultBackendSGProvider_Release(t *testing.T) {
222281
type fields struct {
223282
autogenSG string
224283
backendSG string
284+
defaultTags map[string]string
225285
listIngressCalls []listIngressCall
226286
deleteSGCalls []deleteSecurityGroupWithContextCall
227287
}
@@ -365,7 +425,7 @@ func Test_defaultBackendSGProvider_Release(t *testing.T) {
365425
ec2Client := services.NewMockEC2(ctrl)
366426
k8sClient := mock_client.NewMockClient(ctrl)
367427
sgProvider := NewBackendSGProvider(defaultClusterName, tt.fields.backendSG,
368-
defaultVPCID, ec2Client, k8sClient, &log.NullLogger{})
428+
defaultVPCID, ec2Client, k8sClient, tt.fields.defaultTags, &log.NullLogger{})
369429
if len(tt.fields.autogenSG) > 0 {
370430
sgProvider.backendSG = ""
371431
sgProvider.autoGeneratedSG = tt.fields.autogenSG

0 commit comments

Comments
 (0)