Skip to content

Commit 21bef26

Browse files
Pacho20Pacho20
committed
ibmcloud: add support for multiple security groups
Instead of attaching a single security group to VSIs, allow specifying multiple security groups. Signed-off-by: Patrik Fodor <[email protected]>
1 parent 1d12770 commit 21bef26

File tree

8 files changed

+35
-46
lines changed

8 files changed

+35
-46
lines changed

‎src/cloud-api-adaptor/install/overlays/ibmcloud/kustomization.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ configMapGenerator:
2727
- IBMCLOUD_PODVM_INSTANCE_PROFILE_LIST="" #optional, comma separated list
2828
- IBMCLOUD_ZONE="" #set
2929
- IBMCLOUD_VPC_SUBNET_ID="" #set
30-
- IBMCLOUD_VPC_SG_ID="" #set
30+
- IBMCLOUD_SECURITY_GROUP_IDS="" #optional, comma separated list
3131
- IBMCLOUD_VPC_ID="" #set
3232
- CRI_RUNTIME_ENDPOINT="/run/cri-runtime/containerd.sock"
3333
- DISABLECVM="true" # Set to false to enable confidential VM

‎src/cloud-api-adaptor/test/provisioner/ibmcloud/provision_common.go‎

Lines changed: 1 addition & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -154,16 +154,6 @@ func createVPC() error {
154154
}
155155
}
156156

157-
sgoptions := &vpcv1.GetVPCDefaultSecurityGroupOptions{}
158-
sgoptions.SetID(IBMCloudProps.VpcID)
159-
defaultSG, _, err := IBMCloudProps.VPC.GetVPCDefaultSecurityGroup(sgoptions)
160-
if err != nil {
161-
return err
162-
}
163-
164-
IBMCloudProps.SecurityGroupID = *defaultSG.ID
165-
log.Infof("Got VPC default SecurityGroupID %s.", IBMCloudProps.SecurityGroupID)
166-
167157
return nil
168158
}
169159

@@ -967,7 +957,7 @@ func (p *IBMCloudProvisioner) GetProperties(ctx context.Context, cfg *envconf.Co
967957
"IBMCLOUD_PODVM_INSTANCE_PROFILE_NAME": IBMCloudProps.InstanceProfile,
968958
"IBMCLOUD_ZONE": IBMCloudProps.Zone,
969959
"IBMCLOUD_VPC_SUBNET_ID": IBMCloudProps.SubnetID,
970-
"IBMCLOUD_VPC_SG_ID": IBMCloudProps.SecurityGroupID,
960+
"IBMCLOUD_SECURITY_GROUP_IDS": IBMCloudProps.SecurityGroupIDs,
971961
"IBMCLOUD_VPC_ID": IBMCloudProps.VpcID,
972962
"CRI_RUNTIME_ENDPOINT": "/run/cri-runtime/containerd.sock",
973963
"IBMCLOUD_API_KEY": IBMCloudProps.ApiKey,
@@ -982,18 +972,3 @@ func (p *IBMCloudProvisioner) GetProperties(ctx context.Context, cfg *envconf.Co
982972
"TAGS": IBMCloudProps.Tags,
983973
}
984974
}
985-
986-
func (p *IBMCloudProvisioner) GetVPCDefaultSecurityGroupID(vpcID string) (string, error) {
987-
if len(IBMCloudProps.SecurityGroupID) > 0 {
988-
return IBMCloudProps.SecurityGroupID, nil
989-
}
990-
991-
options := &vpcv1.GetVPCDefaultSecurityGroupOptions{}
992-
options.SetID(vpcID)
993-
defaultSG, _, err := IBMCloudProps.VPC.GetVPCDefaultSecurityGroup(options)
994-
if err != nil {
995-
return "", err
996-
}
997-
998-
return *defaultSG.ID, nil
999-
}

‎src/cloud-api-adaptor/test/provisioner/ibmcloud/provision_ibmcloud.properties‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,8 @@ PUBLIC_GATEWAY_NAME=""
4242
VPC_SUBNET_NAME=""
4343
# optional, existing subnet id if using existing VPC and cluster for testing
4444
VPC_SUBNET_ID=""
45-
# optional, existing security group id if using existing VPC and cluster for testing
46-
VPC_SECURITY_GROUP_ID=""
45+
# optional, a list of security group IDs if you need additional ones besides the default
46+
IBMCLOUD_SECURITY_GROUP_IDS=""
4747
# optional, it'll be set as ${CLUSTER_NAME}-vpc if not provided
4848
VPC_NAME=""
4949
# optional, existing VPC id if using existing VPC and cluster for testing

‎src/cloud-api-adaptor/test/provisioner/ibmcloud/provision_initializer.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ type IBMCloudProperties struct {
2828
CosApiKey string
2929
CosInstanceID string
3030
CosServiceURL string
31-
SecurityGroupID string
31+
SecurityGroupIDs string
3232
IamServiceURL string
3333
IksServiceURL string
3434
InitData string
@@ -97,7 +97,7 @@ func InitIBMCloudProperties(properties map[string]string) error {
9797
Zone: properties["ZONE"],
9898
SshKeyID: properties["SSH_KEY_ID"],
9999
SubnetID: properties["VPC_SUBNET_ID"],
100-
SecurityGroupID: properties["VPC_SECURITY_GROUP_ID"],
100+
SecurityGroupIDs: properties["IBMCLOUD_SECURITY_GROUP_IDS"],
101101
VpcID: properties["VPC_ID"],
102102
TunnelType: properties["TUNNEL_TYPE"],
103103
VxlanPort: properties["VXLAN_PORT"],
@@ -200,8 +200,8 @@ func InitIBMCloudProperties(properties map[string]string) error {
200200
if len(IBMCloudProps.SubnetID) <= 0 {
201201
log.Info("[warning] VPC_SUBNET_ID was not set.")
202202
}
203-
if len(IBMCloudProps.SecurityGroupID) <= 0 {
204-
log.Info("[warning] VPC_SECURITY_GROUP_ID was not set.")
203+
if len(IBMCloudProps.SecurityGroupIDs) <= 0 {
204+
log.Info("IBMCLOUD_SECURITY_GROUP_IDS was not set.")
205205
}
206206
if len(IBMCloudProps.VpcID) <= 0 {
207207
log.Info("[warning] VPC_ID was not set.")

‎src/cloud-api-adaptor/test/provisioner/ibmcloud/provision_kustomize.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ func isKustomizeConfigMapKey(key string) bool {
4949
return true
5050
case "IBMCLOUD_VPC_SUBNET_ID":
5151
return true
52-
case "IBMCLOUD_VPC_SG_ID":
52+
case "IBMCLOUD_SECURITY_GROUP_IDS":
5353
return true
5454
case "IBMCLOUD_VPC_ID":
5555
return true

‎src/cloud-providers/ibmcloud/manager.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ func (_ *Manager) ParseCmd(flags *flag.FlagSet) {
2929
reg.StringWithEnv(&ibmcloudVPCConfig.ProfileName, "profile-name", "", "IBMCLOUD_PODVM_INSTANCE_PROFILE_NAME", "Default instance profile name to be used for the Pod VMs")
3030
reg.StringWithEnv(&ibmcloudVPCConfig.ZoneName, "zone-name", "", "IBMCLOUD_ZONE", "Zone name")
3131
reg.StringWithEnv(&ibmcloudVPCConfig.PrimarySubnetID, "primary-subnet-id", "", "IBMCLOUD_VPC_SUBNET_ID", "Primary subnet ID")
32-
reg.StringWithEnv(&ibmcloudVPCConfig.PrimarySecurityGroupID, "primary-security-group-id", "", "IBMCLOUD_VPC_SG_ID", "Primary security group ID")
3332
reg.StringWithEnv(&ibmcloudVPCConfig.KeyID, "key-id", "", "IBMCLOUD_SSH_KEY_ID", "SSH Key ID")
3433
reg.StringWithEnv(&ibmcloudVPCConfig.VpcID, "vpc-id", "", "IBMCLOUD_VPC_ID", "VPC ID")
3534
reg.StringWithEnv(&ibmcloudVPCConfig.ClusterID, "cluster-id", "", "IBMCLOUD_CLUSTER_ID", "Cluster ID")
@@ -45,6 +44,7 @@ func (_ *Manager) ParseCmd(flags *flag.FlagSet) {
4544
reg.CustomTypeWithEnv(&ibmcloudVPCConfig.InstanceProfiles, "profile-list", "", "IBMCLOUD_PODVM_INSTANCE_PROFILE_LIST", "List of instance profile names to be used for the Pod VMs, comma separated")
4645
reg.CustomTypeWithEnv(&ibmcloudVPCConfig.Images, "image-id", "", "IBMCLOUD_PODVM_IMAGE_ID", "List of Image IDs, comma separated")
4746
reg.CustomTypeWithEnv(&ibmcloudVPCConfig.Tags, "tags", "", "IBMCLOUD_TAGS", "List of tags to attach to the Pod VMs, comma separated")
47+
reg.CustomTypeWithEnv(&ibmcloudVPCConfig.SecurityGroupIds, "security-group-ids", "", "IBMCLOUD_SECURITY_GROUP_IDS", "List of Security Group IDs to be used for the Pod VM, comma separated")
4848
}
4949

5050
func (_ *Manager) LoadEnv() {

‎src/cloud-providers/ibmcloud/provider.go‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -151,13 +151,11 @@ func NewProvider(config *Config) (provider.Provider, error) {
151151
return nil, err
152152
}
153153

154-
if config.PrimarySecurityGroupID == "" {
155-
sgID, err := fetchClusterSG(clusterV2, config.ClusterID)
156-
if err != nil {
157-
return nil, err
158-
}
159-
config.PrimarySecurityGroupID = sgID
154+
sgID, err := fetchClusterSG(clusterV2, config.ClusterID)
155+
if err != nil {
156+
return nil, err
160157
}
158+
config.SecurityGroupIds = append(config.SecurityGroupIds, sgID)
161159

162160
provider := &ibmcloudVPCProvider{
163161
vpc: vpcV1,
@@ -253,6 +251,13 @@ func (p *ibmcloudVPCProvider) getAttachTagOptions(vpcInstanceCRN *string) (*glob
253251

254252
func (p *ibmcloudVPCProvider) getInstancePrototype(instanceName, userData, instanceProfile, imageId string) *vpcv1.InstancePrototype {
255253

254+
securityGroups := make([]vpcv1.SecurityGroupIdentityIntf, 0, len(p.serviceConfig.SecurityGroupIds))
255+
for i := range p.serviceConfig.SecurityGroupIds {
256+
securityGroups = append(securityGroups, &vpcv1.SecurityGroupIdentityByID{
257+
ID: &p.serviceConfig.SecurityGroupIds[i],
258+
})
259+
}
260+
256261
prototype := &vpcv1.InstancePrototype{
257262
Name: &instanceName,
258263
Image: &vpcv1.ImageIdentity{ID: &imageId},
@@ -262,10 +267,8 @@ func (p *ibmcloudVPCProvider) getInstancePrototype(instanceName, userData, insta
262267
Keys: []vpcv1.KeyIdentityIntf{},
263268
VPC: &vpcv1.VPCIdentity{ID: &p.serviceConfig.VpcID},
264269
PrimaryNetworkInterface: &vpcv1.NetworkInterfacePrototype{
265-
Subnet: &vpcv1.SubnetIdentity{ID: &p.serviceConfig.PrimarySubnetID},
266-
SecurityGroups: []vpcv1.SecurityGroupIdentityIntf{
267-
&vpcv1.SecurityGroupIdentityByID{ID: &p.serviceConfig.PrimarySecurityGroupID},
268-
},
270+
Subnet: &vpcv1.SubnetIdentity{ID: &p.serviceConfig.PrimarySubnetID},
271+
SecurityGroups: securityGroups,
269272
},
270273
MetadataService: &vpcv1.InstanceMetadataServicePrototype{
271274
Enabled: core.BoolPtr(true),

‎src/cloud-providers/ibmcloud/types.go‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,17 @@ func (i *tags) Set(value string) error {
7070
return nil
7171
}
7272

73+
type securityGroupIds []string
74+
75+
func (i *securityGroupIds) String() string {
76+
return strings.Join(*i, ", ")
77+
}
78+
79+
func (i *securityGroupIds) Set(value string) error {
80+
*i = append(*i, toList(value, ",")...)
81+
return nil
82+
}
83+
7384
type Config struct {
7485
ApiKey string
7586
IAMProfileID string
@@ -81,7 +92,7 @@ type Config struct {
8192
ZoneName string
8293
Images Images
8394
PrimarySubnetID string
84-
PrimarySecurityGroupID string
95+
SecurityGroupIds securityGroupIds
8596
SecondarySubnetID string
8697
SecondarySecurityGroupID string
8798
KeyID string

0 commit comments

Comments
 (0)