Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Additional ingress rules for control plane #4228

Merged
merged 1 commit into from
May 25, 2023
Merged

Additional ingress rules for control plane #4228

merged 1 commit into from
May 25, 2023

Conversation

alexander-demicev
Copy link
Contributor

@alexander-demicev alexander-demicev commented Apr 20, 2023 •
edited
Loading

What type of PR is this?
/kind feature

What this PR does / why we need it:

This PR introduces the ability to specify additional ingress rules for the control plane.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #392

Special notes for your reviewer:

Checklist:

  • squashed commits
  • includes documentation
  • adds unit tests
  • adds or updates e2e tests

Release note:

Additional ingress rules for the control plane can be specified in the API

@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Apr 20, 2023
@k8s-ci-robot k8s-ci-robot added needs-priority size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Apr 20, 2023
@alexander-demicev
Copy link
Contributor Author

/test pull-cluster-api-provider-aws-e2e

@k8s-triage-robot
Copy link

Unknown CLA label state. Rechecking for CLA labels.

Send feedback to sig-contributor-experience at kubernetes/community.

/check-cla
/easycla

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Apr 20, 2023
@AverageMarcus
Copy link
Member

/test pull-cluster-api-provider-aws-e2e

@richardcase
Copy link
Member

@alexander-demicev - the MD remediation test failure isn't related to this change, its generally failing.

richardcase
richardcase reviewed Apr 28, 2023
View reviewed changes
Copy link
Member

@richardcase richardcase left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @alexander-demicev 🙇 This is looking good to me. A couple of very minor points:

  • Might be nice to add coverage of this to the e2e tests
  • Do you think it would be worth adding something to the docs?
  • Could you squash the commits?

@richardcase
Copy link
Member

/test ?

@k8s-ci-robot
Copy link
Contributor

@richardcase: The following commands are available to trigger required jobs:

  • /test pull-cluster-api-provider-aws-build
  • /test pull-cluster-api-provider-aws-test
  • /test pull-cluster-api-provider-aws-verify

The following commands are available to trigger optional jobs:

  • /test pull-cluster-api-provider-aws-apidiff-main
  • /test pull-cluster-api-provider-aws-e2e
  • /test pull-cluster-api-provider-aws-e2e-blocking
  • /test pull-cluster-api-provider-aws-e2e-clusterclass
  • /test pull-cluster-api-provider-aws-e2e-conformance
  • /test pull-cluster-api-provider-aws-e2e-conformance-with-ci-artifacts
  • /test pull-cluster-api-provider-aws-e2e-eks
  • /test pull-cluster-api-provider-aws-e2e-eks-gc
  • /test pull-cluster-api-provider-aws-e2e-eks-testing

Use /test all to run the following jobs that were automatically triggered:

  • pull-cluster-api-provider-aws-apidiff-main
  • pull-cluster-api-provider-aws-build
  • pull-cluster-api-provider-aws-test
  • pull-cluster-api-provider-aws-verify

In response to this:

/test ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@richardcase
Copy link
Member

Also, just checking the EKS side as there is some shared code here:

/test pull-cluster-api-provider-aws-e2e-eks

@alexander-demicev
Copy link
Contributor Author

/test pull-cluster-api-provider-aws-e2e-eks
/test pull-cluster-api-provider-aws-e2e

mjura
mjura approved these changes May 12, 2023
View reviewed changes
Copy link

@mjura mjura left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI test are failing, but it looks good to me

furkatgofurov7
furkatgofurov7 reviewed May 12, 2023
View reviewed changes
Copy link
Member

@furkatgofurov7 furkatgofurov7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Few nits, overall looks good

api/v1beta2/awscluster_webhook.go Outdated Show resolved Hide resolved
api/v1beta2/awscluster_webhook_test.go Outdated Show resolved Hide resolved
@richardcase
Copy link
Member

/test pull-cluster-api-provider-aws-e2e

@alexander-demicev
Copy link
Contributor Author

/test pull-cluster-api-provider-aws-e2e

@alexander-demicev
Copy link
Contributor Author

please take a look again, I addressed all comments and a added note to the docs

@richardcase
Copy link
Member

/test pull-cluster-api-provider-aws-e2e-eks

@richardcase
Copy link
Member

richardcase commented May 16, 2023 •
edited
Loading

@alexander-demicev - it would be good to have an e2e test to cover this new feature. We could do it as part of this PR or as a follow-up. wdyt?

Would you be able to squash your commits?

Apart from that i think this is ready to go, great work 👍

@alexander-demicev
Copy link
Contributor Author

@richardcase done

@richardcase
Copy link
Member

Lets do the e2e as follow-up

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 16, 2023
@richardcase
Copy link
Member

For final approval: @Skarlso @Ankitasw

Skarlso
Skarlso reviewed May 24, 2023
View reviewed changes
api/v1beta2/network_types.go Outdated
Protocol SecurityGroupProtocol `json:"protocol"`
FromPort int64 `json:"fromPort"`
ToPort int64 `json:"toPort"`
// Description is a description of the ingress rule.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// Description is a description of the ingress rule.
// Description provides extended information about the ingress rule.

@alexander-demicev alexander-demicev mentioned this pull request May 24, 2023
Closed
Ankitasw
Ankitasw reviewed May 24, 2023
View reviewed changes
pkg/cloud/services/securitygroup/securitygroups.go
@@ -519,6 +519,20 @@ func (s *Service) getSecurityGroupIngressRules(role infrav1.SecurityGroupRole) (
if s.scope.Bastion().Enabled {
rules = append(rules, s.defaultSSHIngressRule(s.scope.SecurityGroups()[infrav1.SecurityGroupBastion].ID))
}
if s.scope.ControlPlaneLoadBalancer() != nil {
Copy link
Member

@Ankitasw Ankitasw May 24, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please add this field in any of the existing E2E tests manifest? It would be good to test this in E2E CI to be always sure that this feature works fine.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nvm, we can take it as a follow up. I just saw @richardcase 's comment 🙂
overall LGTM.

@Ankitasw
Copy link
Member

/lgtm

@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 24, 2023
@Ankitasw
Copy link
Member

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Ankitasw

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 25, 2023
@Skarlso
Copy link
Contributor

Skarlso commented May 25, 2023

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 25, 2023
@k8s-ci-robot k8s-ci-robot merged commit 8aa6461 into kubernetes-sigs:main May 25, 2023
@alexander-demicev alexander-demicev mentioned this pull request Jun 26, 2023
Merged
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Skarlso Skarlso Skarlso left review comments

@Ankitasw Ankitasw Ankitasw left review comments

@mjura mjura mjura approved these changes

@AverageMarcus AverageMarcus Awaiting requested review from AverageMarcus

@richardcase richardcase Awaiting requested review from richardcase

@furkatgofurov7 furkatgofurov7 Awaiting requested review from furkatgofurov7

Assignees

@Skarlso Skarlso

@richardcase richardcase

@Ankitasw Ankitasw

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Ability to customize security group rules
9 participants
@alexander-demicev @k8s-triage-robot @AverageMarcus @richardcase @k8s-ci-robot @Ankitasw @Skarlso @mjura @furkatgofurov7