Skip to content

Commit 0c8edfa

Browse files
aswinsuryanaswinsuryan
committed
NE-2387: IngressController AWS NLB Security Group Selection
Allows administrators to specify custom security groups for IngressControllers using AWS Network Load Balancers. Introduce under the `IngressControllerLBSecurityGroupsAWS` FeatureGate. Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
1 parent 02e2c3d commit 0c8edfa

17 files changed

Lines changed: 3604 additions & 0 deletions

‎features.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@
6767
| HyperShiftOnlyDynamicResourceAllocation| <span style="background-color: #519450">Enabled</span> | | <span style="background-color: #519450">Enabled</span> | | <span style="background-color: #519450">Enabled</span> | | <span style="background-color: #519450">Enabled</span> | |
6868
| ImageModeStatusReporting| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
6969
| IngressControllerDynamicConfigurationManager| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
70+
| IngressControllerLBSecurityGroupsAWS| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
7071
| IngressControllerMultipleHAProxyVersions| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
7172
| IrreconcilableMachineConfig| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |
7273
| KMSEncryption| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> |

‎features/features.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -998,6 +998,14 @@ var (
998998
enable(inDefault(), inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).
999999
mustRegister()
10001000

1001+
FeatureGateIngressControllerLBSecurityGroupsAWS = newFeatureGate("IngressControllerLBSecurityGroupsAWS").
1002+
reportProblemsToJiraComponent("Routing").
1003+
contactPerson("miciah").
1004+
productScope(ocpSpecific).
1005+
enhancementPR("https://github.com/openshift/enhancements/pull/2037").
1006+
enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).
1007+
mustRegister()
1008+
10011009
FeatureGateTLSAdherence = newFeatureGate("TLSAdherence").
10021010
reportProblemsToJiraComponent("HPCASE / TLS Adherence").
10031011
contactPerson("joelanford").

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/v1/types_ingresscontroller.go‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -899,6 +899,31 @@ type AWSNetworkLoadBalancerParameters struct {
899899
// +kubebuilder:validation:MaxItems=10
900900
EIPAllocations []EIPAllocation `json:"eipAllocations"`
901901

902+
// securityGroups is a list of security group IDs to attach to the
903+
// Network Load Balancer. When specified, these security groups replace
904+
// the managed security group that the Cloud Controller Manager would
905+
// otherwise create automatically. The user is responsible for
906+
// configuring the ingress and egress rules on the specified security
907+
// groups.
908+
//
909+
// The specified security groups must exist in the same VPC as the
910+
// cluster and must allow the necessary traffic for the
911+
// IngressController to function.
912+
//
913+
// When this field is omitted and NLBSecurityGroupMode is set to
914+
// Managed in the CCM cloud-config, the Cloud Controller Manager
915+
// automatically creates and manages a security group for the NLB.
916+
//
917+
// Each security group ID must be unique. A maximum of 5 security
918+
// groups can be specified.
919+
//
920+
// +optional
921+
// +listType=atomic
922+
// +kubebuilder:validation:MaxItems=5
923+
// +kubebuilder:validation:XValidation:rule=`self.all(x, self.exists_one(y, x == y))`,message="securityGroups cannot contain duplicates"
924+
// +openshift:enable:FeatureGate=IngressControllerLBSecurityGroupsAWS
925+
SecurityGroups []SecurityGroupID `json:"securityGroups,omitempty"`
926+
902927
// protocol specifies whether the Network Load Balancer uses PROXY
903928
// protocol to forward connections to the IngressController.
904929
//
@@ -930,6 +955,16 @@ type AWSNetworkLoadBalancerParameters struct {
930955
Protocol NLBProtocol `json:"protocol,omitempty"`
931956
}
932957

958+
// SecurityGroupID is an AWS EC2 security group ID.
959+
// Values must begin with `sg-` followed by between 8 and 17 hexadecimal
960+
// characters.
961+
//
962+
// +kubebuilder:validation:MinLength=11
963+
// +kubebuilder:validation:MaxLength=20
964+
// +kubebuilder:validation:XValidation:rule=`self.startsWith('sg-')`,message="securityGroups must start with 'sg-'"
965+
// +kubebuilder:validation:XValidation:rule=`self.split("-", 2)[1].matches('^[0-9a-fA-F]{8,17}$')`,message="securityGroups must be 'sg-' followed by 8 to 17 hexadecimal characters"
966+
type SecurityGroupID string
967+
933968
// NLBProtocol specifies whether the AWS Network Load Balancer uses
934969
// PROXY protocol to forward connections to the IngressController.
935970
// +kubebuilder:validation:Enum=TCP;PROXY

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -544,6 +544,45 @@ spec:
544544
- TCP
545545
- PROXY
546546
type: string
547+
securityGroups:
548+
description: |-
549+
securityGroups is a list of security group IDs to attach to the
550+
Network Load Balancer. When specified, these security groups replace
551+
the managed security group that the Cloud Controller Manager would
552+
otherwise create automatically. The user is responsible for
553+
configuring the ingress and egress rules on the specified security
554+
groups.
555+
556+
The specified security groups must exist in the same VPC as the
557+
cluster and must allow the necessary traffic for the
558+
IngressController to function.
559+
560+
When this field is omitted and NLBSecurityGroupMode is set to
561+
Managed in the CCM cloud-config, the Cloud Controller Manager
562+
automatically creates and manages a security group for the NLB.
563+
564+
Each security group ID must be unique. A maximum of 5 security
565+
groups can be specified.
566+
items:
567+
description: |-
568+
SecurityGroupID is an AWS EC2 security group ID.
569+
Values must begin with `sg-` followed by between 8 and 17 hexadecimal
570+
characters.
571+
maxLength: 20
572+
minLength: 11
573+
type: string
574+
x-kubernetes-validations:
575+
- message: securityGroups must start with 'sg-'
576+
rule: self.startsWith('sg-')
577+
- message: securityGroups must be 'sg-' followed
578+
by 8 to 17 hexadecimal characters
579+
rule: self.split("-", 2)[1].matches('^[0-9a-fA-F]{8,17}$')
580+
maxItems: 5
581+
type: array
582+
x-kubernetes-list-type: atomic
583+
x-kubernetes-validations:
584+
- message: securityGroups cannot contain duplicates
585+
rule: self.all(x, self.exists_one(y, x == y))
547586
subnets:
548587
description: |-
549588
subnets specifies the subnets to which the load balancer will
@@ -2902,6 +2941,45 @@ spec:
29022941
- TCP
29032942
- PROXY
29042943
type: string
2944+
securityGroups:
2945+
description: |-
2946+
securityGroups is a list of security group IDs to attach to the
2947+
Network Load Balancer. When specified, these security groups replace
2948+
the managed security group that the Cloud Controller Manager would
2949+
otherwise create automatically. The user is responsible for
2950+
configuring the ingress and egress rules on the specified security
2951+
groups.
2952+
2953+
The specified security groups must exist in the same VPC as the
2954+
cluster and must allow the necessary traffic for the
2955+
IngressController to function.
2956+
2957+
When this field is omitted and NLBSecurityGroupMode is set to
2958+
Managed in the CCM cloud-config, the Cloud Controller Manager
2959+
automatically creates and manages a security group for the NLB.
2960+
2961+
Each security group ID must be unique. A maximum of 5 security
2962+
groups can be specified.
2963+
items:
2964+
description: |-
2965+
SecurityGroupID is an AWS EC2 security group ID.
2966+
Values must begin with `sg-` followed by between 8 and 17 hexadecimal
2967+
characters.
2968+
maxLength: 20
2969+
minLength: 11
2970+
type: string
2971+
x-kubernetes-validations:
2972+
- message: securityGroups must start with 'sg-'
2973+
rule: self.startsWith('sg-')
2974+
- message: securityGroups must be 'sg-' followed
2975+
by 8 to 17 hexadecimal characters
2976+
rule: self.split("-", 2)[1].matches('^[0-9a-fA-F]{8,17}$')
2977+
maxItems: 5
2978+
type: array
2979+
x-kubernetes-list-type: atomic
2980+
x-kubernetes-validations:
2981+
- message: securityGroups cannot contain duplicates
2982+
rule: self.all(x, self.exists_one(y, x == y))
29052983
subnets:
29062984
description: |-
29072985
subnets specifies the subnets to which the load balancer will

‎operator/v1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/v1/zz_generated.featuregated-crd-manifests.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,7 @@ ingresscontrollers.operator.openshift.io:
179179
Category: ""
180180
FeatureGates:
181181
- IngressControllerDynamicConfigurationManager
182+
- IngressControllerLBSecurityGroupsAWS
182183
- TLSGroupPreferences
183184
FilenameOperatorName: ingress
184185
FilenameOperatorOrdering: "00"

0 commit comments

Comments
 (0)