Skip to content

Commit 0c5d225

Browse files
aswinsuryanaswinsuryan
committed
NE-2387: IngressController AWS NLB Security Group Selection
Allows administrators to specify custom security groups for IngressControllers using AWS Network Load Balancers. Introduce under the `IngressControllerLBSecurityGroupsAWS` FeatureGate. Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
1 parent 02e2c3d commit 0c5d225

19 files changed

Lines changed: 3761 additions & 0 deletions

‎features.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@
6767
| HyperShiftOnlyDynamicResourceAllocation| <span style="background-color: #519450">Enabled</span> | | <span style="background-color: #519450">Enabled</span> | | <span style="background-color: #519450">Enabled</span> | | <span style="background-color: #519450">Enabled</span> | |
6868
| ImageModeStatusReporting| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
6969
| IngressControllerDynamicConfigurationManager| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
70+
| IngressControllerLBSecurityGroupsAWS| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
7071
| IngressControllerMultipleHAProxyVersions| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
7172
| IrreconcilableMachineConfig| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
7273
| KMSEncryption| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |

‎features/features.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -998,6 +998,14 @@ var (
998998
enable(inDefault(), inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).
999999
mustRegister()
10001000

1001+
FeatureGateIngressControllerLBSecurityGroupsAWS = newFeatureGate("IngressControllerLBSecurityGroupsAWS").
1002+
reportProblemsToJiraComponent("Routing").
1003+
contactPerson("miciah").
1004+
productScope(ocpSpecific).
1005+
enhancementPR("https://github.com/openshift/enhancements/pull/2037").
1006+
enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).
1007+
mustRegister()
1008+
10011009
FeatureGateTLSAdherence = newFeatureGate("TLSAdherence").
10021010
reportProblemsToJiraComponent("HPCASE / TLS Adherence").
10031011
contactPerson("joelanford").

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/v1/types_ingresscontroller.go‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -899,6 +899,33 @@ type AWSNetworkLoadBalancerParameters struct {
899899
// +kubebuilder:validation:MaxItems=10
900900
EIPAllocations []EIPAllocation `json:"eipAllocations"`
901901

902+
// securityGroups is a list of security group IDs to attach to the
903+
// Network Load Balancer. When specified, these security groups replace
904+
// the managed security group that the Cloud Controller Manager would
905+
// otherwise create automatically. The user is responsible for
906+
// configuring the ingress and egress rules on the specified security
907+
// groups.
908+
//
909+
// The specified security groups must exist in the same VPC as the
910+
// cluster and must allow the necessary traffic for the
911+
// IngressController to function.
912+
//
913+
// When this field is omitted, behavior depends on the
914+
// NLBSecurityGroupMode setting in the CCM cloud-config: if set to
915+
// Managed, the Cloud Controller Manager automatically creates and
916+
// manages a security group for the NLB; if set to Disabled or
917+
// unset, no security group is attached to the NLB.
918+
//
919+
// Each security group ID must be unique. A maximum of 5 security
920+
// groups can be specified.
921+
//
922+
// +optional
923+
// +listType=atomic
924+
// +kubebuilder:validation:MaxItems=5
925+
// +kubebuilder:validation:XValidation:rule=`self.all(x, self.exists_one(y, x == y))`,message="securityGroups cannot contain duplicates"
926+
// +openshift:enable:FeatureGate=IngressControllerLBSecurityGroupsAWS
927+
SecurityGroups []SecurityGroupID `json:"securityGroups,omitempty"`
928+
902929
// protocol specifies whether the Network Load Balancer uses PROXY
903930
// protocol to forward connections to the IngressController.
904931
//
@@ -930,6 +957,15 @@ type AWSNetworkLoadBalancerParameters struct {
930957
Protocol NLBProtocol `json:"protocol,omitempty"`
931958
}
932959

960+
// SecurityGroupID is an AWS EC2 security group ID.
961+
// Values must begin with `sg-` followed by 8 or 17 hexadecimal
962+
// characters.
963+
//
964+
// +kubebuilder:validation:MinLength=11
965+
// +kubebuilder:validation:MaxLength=20
966+
// +kubebuilder:validation:XValidation:rule=`self.startsWith('sg-') && self.substring(3).matches('^[0-9a-fA-F]{8}$|^[0-9a-fA-F]{17}$')`,message="securityGroups must be 'sg-' followed by 8 or 17 hexadecimal characters"
967+
type SecurityGroupID string
968+
933969
// NLBProtocol specifies whether the AWS Network Load Balancer uses
934970
// PROXY protocol to forward connections to the IngressController.
935971
// +kubebuilder:validation:Enum=TCP;PROXY

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -544,6 +544,45 @@ spec:
544544
- TCP
545545
- PROXY
546546
type: string
547+
securityGroups:
548+
description: |-
549+
securityGroups is a list of security group IDs to attach to the
550+
Network Load Balancer. When specified, these security groups replace
551+
the managed security group that the Cloud Controller Manager would
552+
otherwise create automatically. The user is responsible for
553+
configuring the ingress and egress rules on the specified security
554+
groups.
555+
556+
The specified security groups must exist in the same VPC as the
557+
cluster and must allow the necessary traffic for the
558+
IngressController to function.
559+
560+
When this field is omitted, behavior depends on the
561+
NLBSecurityGroupMode setting in the CCM cloud-config: if set to
562+
Managed, the Cloud Controller Manager automatically creates and
563+
manages a security group for the NLB; if set to Disabled or
564+
unset, no security group is attached to the NLB.
565+
566+
Each security group ID must be unique. A maximum of 5 security
567+
groups can be specified.
568+
items:
569+
description: |-
570+
SecurityGroupID is an AWS EC2 security group ID.
571+
Values must begin with `sg-` followed by 8 or 17 hexadecimal
572+
characters.
573+
maxLength: 20
574+
minLength: 11
575+
type: string
576+
x-kubernetes-validations:
577+
- message: securityGroups must be 'sg-' followed
578+
by 8 or 17 hexadecimal characters
579+
rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-fA-F]{8}$|^[0-9a-fA-F]{17}$')
580+
maxItems: 5
581+
type: array
582+
x-kubernetes-list-type: atomic
583+
x-kubernetes-validations:
584+
- message: securityGroups cannot contain duplicates
585+
rule: self.all(x, self.exists_one(y, x == y))
547586
subnets:
548587
description: |-
549588
subnets specifies the subnets to which the load balancer will
@@ -2902,6 +2941,45 @@ spec:
29022941
- TCP
29032942
- PROXY
29042943
type: string
2944+
securityGroups:
2945+
description: |-
2946+
securityGroups is a list of security group IDs to attach to the
2947+
Network Load Balancer. When specified, these security groups replace
2948+
the managed security group that the Cloud Controller Manager would
2949+
otherwise create automatically. The user is responsible for
2950+
configuring the ingress and egress rules on the specified security
2951+
groups.
2952+
2953+
The specified security groups must exist in the same VPC as the
2954+
cluster and must allow the necessary traffic for the
2955+
IngressController to function.
2956+
2957+
When this field is omitted, behavior depends on the
2958+
NLBSecurityGroupMode setting in the CCM cloud-config: if set to
2959+
Managed, the Cloud Controller Manager automatically creates and
2960+
manages a security group for the NLB; if set to Disabled or
2961+
unset, no security group is attached to the NLB.
2962+
2963+
Each security group ID must be unique. A maximum of 5 security
2964+
groups can be specified.
2965+
items:
2966+
description: |-
2967+
SecurityGroupID is an AWS EC2 security group ID.
2968+
Values must begin with `sg-` followed by 8 or 17 hexadecimal
2969+
characters.
2970+
maxLength: 20
2971+
minLength: 11
2972+
type: string
2973+
x-kubernetes-validations:
2974+
- message: securityGroups must be 'sg-' followed
2975+
by 8 or 17 hexadecimal characters
2976+
rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-fA-F]{8}$|^[0-9a-fA-F]{17}$')
2977+
maxItems: 5
2978+
type: array
2979+
x-kubernetes-list-type: atomic
2980+
x-kubernetes-validations:
2981+
- message: securityGroups cannot contain duplicates
2982+
rule: self.all(x, self.exists_one(y, x == y))
29052983
subnets:
29062984
description: |-
29072985
subnets specifies the subnets to which the load balancer will

0 commit comments

Comments
 (0)