Skip to content

Commit e648ccf

Browse files
aswinsuryanaswinsuryan
committed
NE-2387: Restrict security group IDs to lowercase hex
Restrict SecurityGroupID validation to lowercase hexadecimal characters only, matching AWS's actual format. Add format details to the securityGroups field godoc per review feedback. Signed-off-by: Aswin Suryanarayanan <asuryana@redhat.com>
1 parent f5647fd commit e648ccf

9 files changed

Lines changed: 106 additions & 59 deletions

File tree

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/openapi.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30619,7 +30619,7 @@
3061930619
]
3062030620
},
3062130621
"securityGroups": {
30622-
"description": "securityGroups is a list of security group IDs to attach to the Network Load Balancer. When specified, these security groups replace the managed security group that the Cloud Controller Manager would otherwise create automatically. The user is responsible for configuring the ingress and egress rules on the specified security groups.\n\nThe specified security groups must exist in the same VPC as the cluster and must allow the necessary traffic for the IngressController to function.\n\nWhen this field is omitted, the Cloud Controller Manager automatically creates and manages a security group for the NLB.\n\nEach security group ID must be unique. At least 1 and at most 5 security groups can be specified.",
30622+
"description": "securityGroups is a list of security group IDs to attach to the Network Load Balancer. When specified, these security groups replace the managed security group that the Cloud Controller Manager would otherwise create automatically. The user is responsible for configuring the ingress and egress rules on the specified security groups.\n\nThe specified security groups must exist in the same VPC as the cluster and must allow the necessary traffic for the IngressController to function.\n\nWhen this field is omitted, the Cloud Controller Manager automatically creates and manages a security group for the NLB.\n\nEach security group ID must be unique and must begin with \"sg-\" followed by 8 or 17 lowercase hexadecimal characters (e.g. \"sg-abcd1234\" or \"sg-abcd1234abcd12345\"). At least 1 and at most 5 security groups can be specified.",
3062330623
"type": "array",
3062430624
"items": {
3062530625
"type": "string",

‎operator/v1/tests/ingresscontrollers.operator.openshift.io/IngressControllerLBSecurityGroupsAWS.yaml‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ tests:
140140
securityGroups:
141141
- xx-1234567890abcdef0
142142
type: LoadBalancerService
143-
expectedError: "securityGroups must be 'sg-' followed by 8 or 17 hexadecimal characters"
143+
expectedError: "securityGroups must be 'sg-' followed by 8 or 17 lowercase hexadecimal characters"
144144
- name: Should not allow security group ID with non-hexadecimal characters.
145145
initial: |
146146
apiVersion: operator.openshift.io/v1
@@ -160,7 +160,7 @@ tests:
160160
securityGroups:
161161
- sg-1234567890abcdexz
162162
type: LoadBalancerService
163-
expectedError: "securityGroups must be 'sg-' followed by 8 or 17 hexadecimal characters"
163+
expectedError: "securityGroups must be 'sg-' followed by 8 or 17 lowercase hexadecimal characters"
164164
- name: Should not allow security group ID with wrong length hex part (not 8 or 17).
165165
initial: |
166166
apiVersion: operator.openshift.io/v1
@@ -180,7 +180,27 @@ tests:
180180
securityGroups:
181181
- sg-1234567890abc
182182
type: LoadBalancerService
183-
expectedError: "securityGroups must be 'sg-' followed by 8 or 17 hexadecimal characters"
183+
expectedError: "securityGroups must be 'sg-' followed by 8 or 17 lowercase hexadecimal characters"
184+
- name: Should not allow security group ID with uppercase hexadecimal characters.
185+
initial: |
186+
apiVersion: operator.openshift.io/v1
187+
kind: IngressController
188+
metadata:
189+
name: sgtestnlb
190+
namespace: openshift-ingress-operator
191+
spec:
192+
endpointPublishingStrategy:
193+
loadBalancer:
194+
scope: External
195+
providerParameters:
196+
type: AWS
197+
aws:
198+
type: NLB
199+
networkLoadBalancer:
200+
securityGroups:
201+
- sg-1234567890ABCDEF0
202+
type: LoadBalancerService
203+
expectedError: "securityGroups must be 'sg-' followed by 8 or 17 lowercase hexadecimal characters"
184204
- name: Should allow exactly 5 security groups.
185205
initial: |
186206
apiVersion: operator.openshift.io/v1

‎operator/v1/types_ingresscontroller.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -938,8 +938,10 @@ type AWSNetworkLoadBalancerParameters struct {
938938
// When this field is omitted, the Cloud Controller Manager
939939
// automatically creates and manages a security group for the NLB.
940940
//
941-
// Each security group ID must be unique. At least 1 and at most 5
942-
// security groups can be specified.
941+
// Each security group ID must be unique and must begin with "sg-"
942+
// followed by 8 or 17 lowercase hexadecimal characters
943+
// (e.g. "sg-abcd1234" or "sg-abcd1234abcd12345"). At least 1 and
944+
// at most 5 security groups can be specified.
943945
//
944946
// +optional
945947
// +listType=atomic
@@ -981,12 +983,13 @@ type AWSNetworkLoadBalancerParameters struct {
981983
}
982984

983985
// SecurityGroupID is an AWS EC2 security group ID.
984-
// Values must begin with `sg-` followed by 8 or 17 hexadecimal
985-
// characters.
986+
// Values must begin with "sg-" followed by 8 or 17 lowercase
987+
// hexadecimal characters (e.g. "sg-abcd1234" or
988+
// "sg-abcd1234abcd12345").
986989
//
987990
// +kubebuilder:validation:MinLength=11
988991
// +kubebuilder:validation:MaxLength=20
989-
// +kubebuilder:validation:XValidation:rule=`self.startsWith('sg-') && self.substring(3).matches('^[0-9a-fA-F]{8}$|^[0-9a-fA-F]{17}$')`,message="securityGroups must be 'sg-' followed by 8 or 17 hexadecimal characters"
992+
// +kubebuilder:validation:XValidation:rule=`self.startsWith('sg-') && self.substring(3).matches('^[0-9a-f]{8}$|^[0-9a-f]{17}$')`,message="securityGroups must be 'sg-' followed by 8 or 17 lowercase hexadecimal characters"
990993
type SecurityGroupID string
991994

992995
// NLBProtocol specifies whether the AWS Network Load Balancer uses

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml‎

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -560,20 +560,23 @@ spec:
560560
When this field is omitted, the Cloud Controller Manager
561561
automatically creates and manages a security group for the NLB.
562562
563-
Each security group ID must be unique. At least 1 and at most 5
564-
security groups can be specified.
563+
Each security group ID must be unique and must begin with "sg-"
564+
followed by 8 or 17 lowercase hexadecimal characters
565+
(e.g. "sg-abcd1234" or "sg-abcd1234abcd12345"). At least 1 and
566+
at most 5 security groups can be specified.
565567
items:
566568
description: |-
567569
SecurityGroupID is an AWS EC2 security group ID.
568-
Values must begin with `sg-` followed by 8 or 17 hexadecimal
569-
characters.
570+
Values must begin with "sg-" followed by 8 or 17 lowercase
571+
hexadecimal characters (e.g. "sg-abcd1234" or
572+
"sg-abcd1234abcd12345").
570573
maxLength: 20
571574
minLength: 11
572575
type: string
573576
x-kubernetes-validations:
574577
- message: securityGroups must be 'sg-' followed
575-
by 8 or 17 hexadecimal characters
576-
rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-fA-F]{8}$|^[0-9a-fA-F]{17}$')
578+
by 8 or 17 lowercase hexadecimal characters
579+
rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-f]{8}$|^[0-9a-f]{17}$')
577580
maxItems: 5
578581
minItems: 1
579582
type: array
@@ -2995,20 +2998,23 @@ spec:
29952998
When this field is omitted, the Cloud Controller Manager
29962999
automatically creates and manages a security group for the NLB.
29973000
2998-
Each security group ID must be unique. At least 1 and at most 5
2999-
security groups can be specified.
3001+
Each security group ID must be unique and must begin with "sg-"
3002+
followed by 8 or 17 lowercase hexadecimal characters
3003+
(e.g. "sg-abcd1234" or "sg-abcd1234abcd12345"). At least 1 and
3004+
at most 5 security groups can be specified.
30003005
items:
30013006
description: |-
30023007
SecurityGroupID is an AWS EC2 security group ID.
3003-
Values must begin with `sg-` followed by 8 or 17 hexadecimal
3004-
characters.
3008+
Values must begin with "sg-" followed by 8 or 17 lowercase
3009+
hexadecimal characters (e.g. "sg-abcd1234" or
3010+
"sg-abcd1234abcd12345").
30053011
maxLength: 20
30063012
minLength: 11
30073013
type: string
30083014
x-kubernetes-validations:
30093015
- message: securityGroups must be 'sg-' followed
3010-
by 8 or 17 hexadecimal characters
3011-
rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-fA-F]{8}$|^[0-9a-fA-F]{17}$')
3016+
by 8 or 17 lowercase hexadecimal characters
3017+
rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-f]{8}$|^[0-9a-f]{17}$')
30123018
maxItems: 5
30133019
minItems: 1
30143020
type: array

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml‎

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -560,20 +560,23 @@ spec:
560560
When this field is omitted, the Cloud Controller Manager
561561
automatically creates and manages a security group for the NLB.
562562
563-
Each security group ID must be unique. At least 1 and at most 5
564-
security groups can be specified.
563+
Each security group ID must be unique and must begin with "sg-"
564+
followed by 8 or 17 lowercase hexadecimal characters
565+
(e.g. "sg-abcd1234" or "sg-abcd1234abcd12345"). At least 1 and
566+
at most 5 security groups can be specified.
565567
items:
566568
description: |-
567569
SecurityGroupID is an AWS EC2 security group ID.
568-
Values must begin with `sg-` followed by 8 or 17 hexadecimal
569-
characters.
570+
Values must begin with "sg-" followed by 8 or 17 lowercase
571+
hexadecimal characters (e.g. "sg-abcd1234" or
572+
"sg-abcd1234abcd12345").
570573
maxLength: 20
571574
minLength: 11
572575
type: string
573576
x-kubernetes-validations:
574577
- message: securityGroups must be 'sg-' followed
575-
by 8 or 17 hexadecimal characters
576-
rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-fA-F]{8}$|^[0-9a-fA-F]{17}$')
578+
by 8 or 17 lowercase hexadecimal characters
579+
rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-f]{8}$|^[0-9a-f]{17}$')
577580
maxItems: 5
578581
minItems: 1
579582
type: array
@@ -2995,20 +2998,23 @@ spec:
29952998
When this field is omitted, the Cloud Controller Manager
29962999
automatically creates and manages a security group for the NLB.
29973000
2998-
Each security group ID must be unique. At least 1 and at most 5
2999-
security groups can be specified.
3001+
Each security group ID must be unique and must begin with "sg-"
3002+
followed by 8 or 17 lowercase hexadecimal characters
3003+
(e.g. "sg-abcd1234" or "sg-abcd1234abcd12345"). At least 1 and
3004+
at most 5 security groups can be specified.
30003005
items:
30013006
description: |-
30023007
SecurityGroupID is an AWS EC2 security group ID.
3003-
Values must begin with `sg-` followed by 8 or 17 hexadecimal
3004-
characters.
3008+
Values must begin with "sg-" followed by 8 or 17 lowercase
3009+
hexadecimal characters (e.g. "sg-abcd1234" or
3010+
"sg-abcd1234abcd12345").
30053011
maxLength: 20
30063012
minLength: 11
30073013
type: string
30083014
x-kubernetes-validations:
30093015
- message: securityGroups must be 'sg-' followed
3010-
by 8 or 17 hexadecimal characters
3011-
rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-fA-F]{8}$|^[0-9a-fA-F]{17}$')
3016+
by 8 or 17 lowercase hexadecimal characters
3017+
rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-f]{8}$|^[0-9a-f]{17}$')
30123018
maxItems: 5
30133019
minItems: 1
30143020
type: array

0 commit comments

Comments
 (0)