feat: Specify Managed Prefix List for access control #3584

yo-ga · 2024-02-18T08:58:41Z

Issue

Resolves Feature Request: Specify Managed Prefix Lists for access control #2167

Description

Add new annotations for Managed Prefix List
Combine the IP addresses and Managed Prefix Lists
- User can add IP addresses and Managed Prefix Lists at the same time

Checklist

Added tests that cover your change (if possible)
Added/modified documentation as required (such as the README.md, or the docs directory)
Manually tested
Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

Backfilled missing tests for code in same general area 🎉
Refactored something and made the world a better place 🌟

linux-foundation-easycla · 2024-02-18T08:58:47Z

The committers listed above are authorized under a signed CLA.

✅ login: yo-ga / name: Yoga Yu (8bdd72e, 1f35253, d9ff3ee, dd587fc, 51c5998, b8f72a7, 1853b99, 415f98e, 66afd13)

k8s-ci-robot · 2024-02-18T08:58:49Z

Welcome @yo-ga!

It looks like this is your first PR to kubernetes-sigs/aws-load-balancer-controller 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/aws-load-balancer-controller has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2024-02-18T08:58:50Z

Hi @yo-ga. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

oliviassss · 2024-03-13T22:58:18Z

docs/guide/service/annotations.md

+
+    !!!example
+        ```
+        service.beta.kubernetes.io/aws-load-balancer-security-group-prefix-lists: pl-00000000


nit: maybe give an example with multiple lists

Thanks for the suggestion. Updated in 66afd13

oliviassss · 2024-03-13T23:05:35Z

pkg/service/model_build_managed_sg.go

@@ -113,6 +129,9 @@ func (t *defaultModelBuildTask) buildCIDRsFromSourceRanges(_ context.Context, ip
 		}
 	}
 	if len(cidrs) == 0 {
+		if prefixListsConfigured {


just for my understanding - why we allow an empty cidr, if prefixLists is configured?

If the user just wants to allow the traffic only from the prefix list, the controller needs to skip the unlimited CIDR settings (0.0.0.0/0 or ::/0)

oliviassss · 2024-03-13T23:06:29Z

pkg/service/model_build_managed_sg_test.go

+				svc: &corev1.Service{
+					ObjectMeta: metav1.ObjectMeta{
+						Annotations: map[string]string{
+							"service.beta.kubernetes.io/aws-load-balancer-security-group-prefix-lists": "pl-xxxxx",


nit: can we test against multiple lists too?

The test is added in 51c5998

oliviassss · 2024-03-13T23:07:11Z

@yo-ga, sorry for late response, and thanks for your contribution. I left some comments.

yo-ga · 2024-03-14T14:44:59Z

Hi @oliviassss , kindly confirm the change and the reply

oliviassss · 2024-03-14T16:37:46Z

/ok-to-test

yo-ga · 2024-03-15T14:59:46Z

Hi @oliviassss, the test seems well.

oliviassss · 2024-03-15T16:40:36Z

/lgtm
/assign @M00nF1sh

ignatenkobrain · 2024-04-11T17:13:37Z

@M00nF1sh can you check / approve / merge please?

yo-ga · 2024-04-17T12:40:48Z

@oliviassss @M00nF1sh Any news?

bohuslav-broza · 2024-04-24T13:34:44Z

@M00nF1sh hello, any update on this? Thank you

M00nF1sh

/lgtm
/approve
Thanks for making this change, it looks good to me.

k8s-ci-robot · 2024-04-24T17:06:57Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: M00nF1sh, yo-ga

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [M00nF1sh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

yo-ga · 2024-04-25T17:42:44Z

Hi @M00nF1sh , one more thing to ask, when will the feature be released?

dcodix · 2024-05-16T17:17:00Z

Hi @oliviassss and @M00nF1sh , same question as @yo-ga , is there an estimation on when will this be released?

dcodix · 2024-05-20T21:55:07Z

I just tested v2.8.0 and it seems to be working. Thanks!

yo-ga added 3 commits February 16, 2024 23:55

feat: new annotation

8bdd72e

feat: new ec2model

1f35253

feat: prefix list implement

b8f72a7

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 18, 2024

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 18, 2024

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Feb 18, 2024

k8s-ci-robot requested review from kishorj and oliviassss February 18, 2024 08:59

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Feb 18, 2024

chore: annotation docs

415f98e

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Feb 18, 2024

yo-ga marked this pull request as ready for review February 18, 2024 13:02

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 18, 2024

k8s-ci-robot requested review from johngmyers and M00nF1sh February 18, 2024 13:03

feat: add ingress unit test

1853b99

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Feb 21, 2024

feat: add service unit test

d9ff3ee

oliviassss reviewed Mar 13, 2024

View reviewed changes

yo-ga added 2 commits March 14, 2024 22:25

chore: update example

66afd13

chore: multiple pl test

51c5998

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 14, 2024

k8s-ci-robot assigned M00nF1sh and oliviassss Mar 15, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 15, 2024

oliviassss added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Mar 15, 2024

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 5, 2024

Merge branch 'main' into feat/2167

dd587fc

k8s-ci-robot removed lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Apr 5, 2024

M00nF1sh approved these changes Apr 24, 2024

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 24, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 24, 2024

k8s-ci-robot merged commit 7d34a0d into kubernetes-sigs:main Apr 24, 2024

wweiwei-li mentioned this pull request May 17, 2024

aws-load-balancer-controller: v2.8.0 aws/eks-charts#1105

Merged

yo-ga deleted the feat/2167 branch May 27, 2024 23:04

feat: Specify Managed Prefix List for access control #3584

feat: Specify Managed Prefix List for access control #3584

Uh oh!

Conversation

yo-ga commented Feb 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

Description

Checklist

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

Uh oh!

linux-foundation-easycla bot commented Feb 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Feb 18, 2024

Uh oh!

k8s-ci-robot commented Feb 18, 2024

Uh oh!

oliviassss Mar 13, 2024

Choose a reason for hiding this comment

Uh oh!

yo-ga Mar 14, 2024

Choose a reason for hiding this comment

Uh oh!

oliviassss Mar 13, 2024

Choose a reason for hiding this comment

Uh oh!

yo-ga Mar 14, 2024

Choose a reason for hiding this comment

Uh oh!

oliviassss Mar 13, 2024

Choose a reason for hiding this comment

Uh oh!

yo-ga Mar 14, 2024

Choose a reason for hiding this comment

Uh oh!

oliviassss commented Mar 13, 2024

Uh oh!

yo-ga commented Mar 14, 2024

Uh oh!

oliviassss commented Mar 14, 2024

Uh oh!

yo-ga commented Mar 15, 2024

Uh oh!

oliviassss commented Mar 15, 2024

Uh oh!

ignatenkobrain commented Apr 11, 2024

Uh oh!

yo-ga commented Apr 17, 2024

Uh oh!

bohuslav-broza commented Apr 24, 2024

Uh oh!

M00nF1sh left a comment

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Apr 24, 2024

Uh oh!

yo-ga commented Apr 25, 2024

Uh oh!

dcodix commented May 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dcodix commented May 20, 2024

Uh oh!

Uh oh!

yo-ga commented Feb 18, 2024 •

edited

Loading

linux-foundation-easycla bot commented Feb 18, 2024 •

edited

Loading

dcodix commented May 16, 2024 •

edited

Loading