Skip to content

Commit

Permalink
Merge pull request #4552 from vincepri/allow-esp-port
Browse files Browse the repository at this point in the history 
🌱 Allow ESP protocol to be set in IngressRules
  • Loading branch information
@k8s-ci-robot
k8s-ci-robot authored Oct 16, 2023
2 parents 5d1cb0f + 9528f42 commit a2e7360
Show file tree
Hide file tree
Showing 6 changed files with 46 additions and 13 deletions.
9 changes: 6 additions & 3 deletions api/v1beta2/network_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -590,14 +590,17 @@ var (

// SecurityGroupProtocolICMPv6 represents the ICMPv6 protocol in ingress rules.
SecurityGroupProtocolICMPv6 = SecurityGroupProtocol("58")

// SecurityGroupProtocolESP represents the ESP protocol in ingress rules.
SecurityGroupProtocolESP = SecurityGroupProtocol("50")
)

// IngressRule defines an AWS ingress rule for security groups.
type IngressRule struct {
// Description provides extended information about the ingress rule.
Description string `json:"description"`
// Protocol is the protocol for the ingress rule. Accepted values are "-1" (all), "4" (IP in IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
// +kubebuilder:validation:Enum="-1";"4";tcp;udp;icmp;"58"
// Protocol is the protocol for the ingress rule. Accepted values are "-1" (all), "4" (IP in IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
// +kubebuilder:validation:Enum="-1";"4";tcp;udp;icmp;"58";"50"
Protocol SecurityGroupProtocol `json:"protocol"`
// FromPort is the start of port range.
FromPort int64 `json:"fromPort"`
Expand Down Expand Up @@ -706,7 +709,7 @@ func (i *IngressRule) Equals(o *IngressRule) bool {
SecurityGroupProtocolICMP,
SecurityGroupProtocolICMPv6:
return i.FromPort == o.FromPort && i.ToPort == o.ToPort
case SecurityGroupProtocolAll, SecurityGroupProtocolIPinIP:
case SecurityGroupProtocolAll, SecurityGroupProtocolIPinIP, SecurityGroupProtocolESP:
// FromPort / ToPort are not applicable
}

Expand Down
14 changes: 10 additions & 4 deletions config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -386,14 +386,15 @@ spec:
protocol:
description: Protocol is the protocol for the ingress rule.
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
"udp", "icmp", and "58" (ICMPv6).
"udp", "icmp", and "58" (ICMPv6), "50" (ESP).
enum:
- "-1"
- "4"
- tcp
- udp
- icmp
- "58"
- "50"
type: string
sourceSecurityGroupIds:
description: The security group id to allow access from.
Expand Down Expand Up @@ -1525,14 +1526,16 @@ spec:
protocol:
description: Protocol is the protocol for the ingress
rule. Accepted values are "-1" (all), "4" (IP in
IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50"
(ESP).
enum:
- "-1"
- "4"
- tcp
- udp
- icmp
- "58"
- "50"
type: string
sourceSecurityGroupIds:
description: The security group id to allow access
Expand Down Expand Up @@ -1969,14 +1972,15 @@ spec:
protocol:
description: Protocol is the protocol for the ingress rule.
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
"udp", "icmp", and "58" (ICMPv6).
"udp", "icmp", and "58" (ICMPv6), "50" (ESP).
enum:
- "-1"
- "4"
- tcp
- udp
- icmp
- "58"
- "50"
type: string
sourceSecurityGroupIds:
description: The security group id to allow access from.
Expand Down Expand Up @@ -3121,14 +3125,16 @@ spec:
protocol:
description: Protocol is the protocol for the ingress
rule. Accepted values are "-1" (all), "4" (IP in
IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50"
(ESP).
enum:
- "-1"
- "4"
- tcp
- udp
- icmp
- "58"
- "50"
type: string
sourceSecurityGroupIds:
description: The security group id to allow access
Expand Down
10 changes: 7 additions & 3 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1057,14 +1057,15 @@ spec:
protocol:
description: Protocol is the protocol for the ingress rule.
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
"udp", "icmp", and "58" (ICMPv6).
"udp", "icmp", and "58" (ICMPv6), "50" (ESP).
enum:
- "-1"
- "4"
- tcp
- udp
- icmp
- "58"
- "50"
type: string
sourceSecurityGroupIds:
description: The security group id to allow access from.
Expand Down Expand Up @@ -1217,14 +1218,15 @@ spec:
protocol:
description: Protocol is the protocol for the ingress rule.
Accepted values are "-1" (all), "4" (IP in IP),"tcp",
"udp", "icmp", and "58" (ICMPv6).
"udp", "icmp", and "58" (ICMPv6), "50" (ESP).
enum:
- "-1"
- "4"
- tcp
- udp
- icmp
- "58"
- "50"
type: string
sourceSecurityGroupIds:
description: The security group id to allow access from.
Expand Down Expand Up @@ -2087,14 +2089,16 @@ spec:
protocol:
description: Protocol is the protocol for the ingress
rule. Accepted values are "-1" (all), "4" (IP in
IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50"
(ESP).
enum:
- "-1"
- "4"
- tcp
- udp
- icmp
- "58"
- "50"
type: string
sourceSecurityGroupIds:
description: The security group id to allow access
Expand Down
8 changes: 6 additions & 2 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -653,14 +653,16 @@ spec:
protocol:
description: Protocol is the protocol for the ingress
rule. Accepted values are "-1" (all), "4" (IP
in IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
in IP),"tcp", "udp", "icmp", and "58" (ICMPv6),
"50" (ESP).
enum:
- "-1"
- "4"
- tcp
- udp
- icmp
- "58"
- "50"
type: string
sourceSecurityGroupIds:
description: The security group id to allow access
Expand Down Expand Up @@ -820,14 +822,16 @@ spec:
protocol:
description: Protocol is the protocol for the ingress
rule. Accepted values are "-1" (all), "4" (IP
in IP),"tcp", "udp", "icmp", and "58" (ICMPv6).
in IP),"tcp", "udp", "icmp", and "58" (ICMPv6),
"50" (ESP).
enum:
- "-1"
- "4"
- tcp
- udp
- icmp
- "58"
- "50"
type: string
sourceSecurityGroupIds:
description: The security group id to allow access
Expand Down
4 changes: 3 additions & 1 deletion pkg/cloud/services/securitygroup/securitygroups.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -703,7 +703,9 @@ func ingressRuleToSDKType(scope scope.SGScope, i *infrav1.IngressRule) (res *ec2
FromPort: aws.Int64(i.FromPort),
ToPort: aws.Int64(i.ToPort),
}
case infrav1.SecurityGroupProtocolAll, infrav1.SecurityGroupProtocolIPinIP:
case infrav1.SecurityGroupProtocolIPinIP,
infrav1.SecurityGroupProtocolESP,
infrav1.SecurityGroupProtocolAll:
res = &ec2.IpPermission{
IpProtocol: aws.String(string(i.Protocol)),
}
Expand Down
14 changes: 14 additions & 0 deletions ...rastructure-aws/withoutclusterclass/e2e_test_templates/cluster-template-internal-elb.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,20 @@ spec:
controlPlaneLoadBalancer:
scheme: internal
network:
cni:
cniIngressRules:
- description: Allow ESP traffic from all nodes in the cluster
protocol: "50"
fromPort: -1
toPort: -1
- description: bgp (calico)
protocol: tcp
fromPort: 179
toPort: 179
- description: IP-in-IP (calico)
protocol: "4"
fromPort: -1
toPort: 65535
subnets:
- id: ${WL_PRIVATE_SUBNET_ID}
vpc:
Expand Down

0 comments on commit a2e7360

Please sign in to comment.