Skip to content

Commit 685788c

Browse files
zac-nixonzac-nixon
authored
Merge pull request #4142 from zac-nixon/znixon/gw-sg-creation
[feat: gw api] Security Group discovery and management
2 parents 182791c + 5c1f930 commit 685788c

37 files changed

+1902
-206
lines changed

‎apis/gateway/v1beta1/loadbalancerconfig_types.go

+22-4
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ type ListenerAttribute struct {
4444
Value string `json:"value"`
4545
}
4646

47-
// Tag defines a AWS Tag on resources.
48-
type LoadBalancerTag struct {
47+
// AWSTag defines a AWS Tag on resources.
48+
type AWSTag struct {
4949
// The key of the tag.
5050
Key string `json:"key"`
5151

@@ -183,10 +183,16 @@ type LoadBalancerConfigurationSpec struct {
183183
// +optional
184184
EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic *string `json:"enforceSecurityGroupInboundRulesOnPrivateLinkTraffic,omitempty"`
185185

186-
// customerOwnedIpv4Pool is the ID of the customer-owned address for Application Load Balancers on Outposts pool.
186+
// customerOwnedIpv4Pool [Application LoadBalancer]
187+
// is the ID of the customer-owned address for Application Load Balancers on Outposts pool.
187188
// +optional
188189
CustomerOwnedIpv4Pool *string `json:"customerOwnedIpv4Pool,omitempty"`
189190

191+
// IPv4IPAMPoolId [Application LoadBalancer]
192+
// defines the IPAM pool ID used for IPv4 Addresses on the ALB.
193+
// +optional
194+
IPv4IPAMPoolId *string `json:"ipv4IPAMPoolId,omitempty"`
195+
190196
// loadBalancerSubnets is an optional list of subnet configurations to be used in the LB
191197
// This value takes precedence over loadBalancerSubnetsSelector if both are selected.
192198
// +optional
@@ -224,7 +230,19 @@ type LoadBalancerConfigurationSpec struct {
224230

225231
// Tags defines list of Tags on LB.
226232
// +optional
227-
Tags []LoadBalancerTag `json:"tags,omitempty"`
233+
Tags []AWSTag `json:"tags,omitempty"`
234+
235+
// EnableICMP [Network LoadBalancer]
236+
// enables the creation of security group rules to the managed security group
237+
// to allow explicit ICMP traffic for Path MTU discovery for IPv4 and dual-stack VPCs
238+
// +optional
239+
EnableICMP bool `json:"enableICMP,omitempty"`
240+
241+
// ManageBackendSecurityGroupRules [Application / Network LoadBalancer]
242+
// specifies whether you want the controller to configure security group rules on Node/Pod for traffic access
243+
// when you specify securityGroups
244+
// +optional
245+
ManageBackendSecurityGroupRules bool `json:"manageBackendSecurityGroupRules,omitempty"`
228246
}
229247

230248
// TODO -- these can be used to set what generation the gateway is currently on to track progress on reconcile.

‎apis/gateway/v1beta1/zz_generated.deepcopy.go

+21-16
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/gateway/gateway-crds.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,16 @@ spec:
4545
LoadBalancerConfiguration
4646
properties:
4747
customerOwnedIpv4Pool:
48-
description: customerOwnedIpv4Pool is the ID of the customer-owned
49-
address for Application Load Balancers on Outposts pool.
48+
description: |-
49+
customerOwnedIpv4Pool [Application LoadBalancer]
50+
is the ID of the customer-owned address for Application Load Balancers on Outposts pool.
5051
type: string
52+
enableICMP:
53+
description: |-
54+
EnableICMP [Network LoadBalancer]
55+
enables the creation of security group rules to the managed security group
56+
to allow explicit ICMP traffic for Path MTU discovery for IPv4 and dual-stack VPCs
57+
type: boolean
5158
enforceSecurityGroupInboundRulesOnPrivateLinkTraffic:
5259
description: enforceSecurityGroupInboundRulesOnPrivateLinkTraffic
5360
Indicates whether to evaluate inbound security group rules for traffic
@@ -61,6 +68,11 @@ spec:
6168
- dualstack
6269
- dualstack-without-public-ipv4
6370
type: string
71+
ipv4IPAMPoolId:
72+
description: |-
73+
IPv4IPAMPoolId [Application LoadBalancer]
74+
defines the IPAM pool ID used for IPv4 Addresses on the ALB.
75+
type: string
6476
listenerConfigurations:
6577
description: listenerConfigurations is an optional list of configurations
6678
for each listener on LB
@@ -212,6 +224,12 @@ spec:
212224
tag specified in the map key contains one of the values in the corresponding
213225
value list.
214226
type: object
227+
manageBackendSecurityGroupRules:
228+
description: |-
229+
ManageBackendSecurityGroupRules [Application / Network LoadBalancer]
230+
specifies whether you want the controller to configure security group rules on Node/Pod for traffic access
231+
when you specify securityGroups
232+
type: boolean
215233
scheme:
216234
description: scheme defines the type of LB to provision. If unspecified,
217235
it will be automatically inferred.
@@ -240,7 +258,7 @@ spec:
240258
tags:
241259
description: Tags defines list of Tags on LB.
242260
items:
243-
description: Tag defines a AWS Tag on resources.
261+
description: AWSTag defines a AWS Tag on resources.
244262
properties:
245263
key:
246264
description: The key of the tag.

‎config/crd/gateway/gateway.k8s.aws_loadbalancerconfigurations.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,16 @@ spec:
4646
LoadBalancerConfiguration
4747
properties:
4848
customerOwnedIpv4Pool:
49-
description: customerOwnedIpv4Pool is the ID of the customer-owned
50-
address for Application Load Balancers on Outposts pool.
49+
description: |-
50+
customerOwnedIpv4Pool [Application LoadBalancer]
51+
is the ID of the customer-owned address for Application Load Balancers on Outposts pool.
5152
type: string
53+
enableICMP:
54+
description: |-
55+
EnableICMP [Network LoadBalancer]
56+
enables the creation of security group rules to the managed security group
57+
to allow explicit ICMP traffic for Path MTU discovery for IPv4 and dual-stack VPCs
58+
type: boolean
5259
enforceSecurityGroupInboundRulesOnPrivateLinkTraffic:
5360
description: enforceSecurityGroupInboundRulesOnPrivateLinkTraffic
5461
Indicates whether to evaluate inbound security group rules for traffic
@@ -62,6 +69,11 @@ spec:
6269
- dualstack
6370
- dualstack-without-public-ipv4
6471
type: string
72+
ipv4IPAMPoolId:
73+
description: |-
74+
IPv4IPAMPoolId [Application LoadBalancer]
75+
defines the IPAM pool ID used for IPv4 Addresses on the ALB.
76+
type: string
6577
listenerConfigurations:
6678
description: listenerConfigurations is an optional list of configurations
6779
for each listener on LB
@@ -213,6 +225,12 @@ spec:
213225
tag specified in the map key contains one of the values in the corresponding
214226
value list.
215227
type: object
228+
manageBackendSecurityGroupRules:
229+
description: |-
230+
ManageBackendSecurityGroupRules [Application / Network LoadBalancer]
231+
specifies whether you want the controller to configure security group rules on Node/Pod for traffic access
232+
when you specify securityGroups
233+
type: boolean
216234
scheme:
217235
description: scheme defines the type of LB to provision. If unspecified,
218236
it will be automatically inferred.
@@ -241,7 +259,7 @@ spec:
241259
tags:
242260
description: Tags defines list of Tags on LB.
243261
items:
244-
description: Tag defines a AWS Tag on resources.
262+
description: AWSTag defines a AWS Tag on resources.
245263
properties:
246264
key:
247265
description: The key of the tag.

‎controllers/gateway/gateway_controller.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
elbv2model "sigs.k8s.io/aws-load-balancer-controller/pkg/model/elbv2"
2828
"sigs.k8s.io/aws-load-balancer-controller/pkg/networking"
2929
"sigs.k8s.io/aws-load-balancer-controller/pkg/runtime"
30+
"sigs.k8s.io/aws-load-balancer-controller/pkg/shared_constants"
3031
ctrl "sigs.k8s.io/controller-runtime"
3132
"sigs.k8s.io/controller-runtime/pkg/client"
3233
"sigs.k8s.io/controller-runtime/pkg/controller"
@@ -47,19 +48,19 @@ var _ Reconciler = &gatewayReconciler{}
4748

4849
// NewNLBGatewayReconciler constructs a gateway reconciler to handle specifically for NLB gateways
4950
func NewNLBGatewayReconciler(routeLoader routeutils.Loader, cloud services.Cloud, k8sClient client.Client, eventRecorder record.EventRecorder, controllerConfig config.ControllerConfig, finalizerManager k8s.FinalizerManager, networkingSGReconciler networking.SecurityGroupReconciler, networkingSGManager networking.SecurityGroupManager, elbv2TaggingManager elbv2deploy.TaggingManager, subnetResolver networking.SubnetsResolver, vpcInfoProvider networking.VPCInfoProvider, backendSGProvider networking.BackendSGProvider, sgResolver networking.SecurityGroupResolver, logger logr.Logger, metricsCollector lbcmetrics.MetricCollector, reconcileCounters *metricsutil.ReconcileCounters) Reconciler {
50-
return newGatewayReconciler(constants.NLBGatewayController, elbv2model.LoadBalancerTypeNetwork, controllerConfig.NLBGatewayMaxConcurrentReconciles, constants.NLBGatewayTagPrefix, constants.NLBGatewayFinalizer, routeLoader, routeutils.L4RouteFilter, cloud, k8sClient, eventRecorder, controllerConfig, finalizerManager, networkingSGReconciler, networkingSGManager, elbv2TaggingManager, subnetResolver, vpcInfoProvider, backendSGProvider, sgResolver, logger, metricsCollector, reconcileCounters.IncrementNLBGateway)
51+
return newGatewayReconciler(constants.NLBGatewayController, elbv2model.LoadBalancerTypeNetwork, controllerConfig.NLBGatewayMaxConcurrentReconciles, constants.NLBGatewayTagPrefix, shared_constants.NLBGatewayFinalizer, routeLoader, routeutils.L4RouteFilter, cloud, k8sClient, eventRecorder, controllerConfig, finalizerManager, networkingSGReconciler, networkingSGManager, elbv2TaggingManager, subnetResolver, vpcInfoProvider, backendSGProvider, sgResolver, logger, metricsCollector, reconcileCounters.IncrementNLBGateway)
5152
}
5253

5354
// NewALBGatewayReconciler constructs a gateway reconciler to handle specifically for ALB gateways
5455
func NewALBGatewayReconciler(routeLoader routeutils.Loader, cloud services.Cloud, k8sClient client.Client, eventRecorder record.EventRecorder, controllerConfig config.ControllerConfig, finalizerManager k8s.FinalizerManager, networkingSGReconciler networking.SecurityGroupReconciler, networkingSGManager networking.SecurityGroupManager, elbv2TaggingManager elbv2deploy.TaggingManager, subnetResolver networking.SubnetsResolver, vpcInfoProvider networking.VPCInfoProvider, backendSGProvider networking.BackendSGProvider, sgResolver networking.SecurityGroupResolver, logger logr.Logger, metricsCollector lbcmetrics.MetricCollector, reconcileCounters *metricsutil.ReconcileCounters) Reconciler {
55-
return newGatewayReconciler(constants.ALBGatewayController, elbv2model.LoadBalancerTypeApplication, controllerConfig.ALBGatewayMaxConcurrentReconciles, constants.ALBGatewayTagPrefix, constants.ALBGatewayFinalizer, routeLoader, routeutils.L7RouteFilter, cloud, k8sClient, eventRecorder, controllerConfig, finalizerManager, networkingSGReconciler, networkingSGManager, elbv2TaggingManager, subnetResolver, vpcInfoProvider, backendSGProvider, sgResolver, logger, metricsCollector, reconcileCounters.IncrementALBGateway)
56+
return newGatewayReconciler(constants.ALBGatewayController, elbv2model.LoadBalancerTypeApplication, controllerConfig.ALBGatewayMaxConcurrentReconciles, constants.ALBGatewayTagPrefix, shared_constants.ALBGatewayFinalizer, routeLoader, routeutils.L7RouteFilter, cloud, k8sClient, eventRecorder, controllerConfig, finalizerManager, networkingSGReconciler, networkingSGManager, elbv2TaggingManager, subnetResolver, vpcInfoProvider, backendSGProvider, sgResolver, logger, metricsCollector, reconcileCounters.IncrementALBGateway)
5657
}
5758

5859
// newGatewayReconciler constructs a reconciler that responds to gateway object changes
5960
func newGatewayReconciler(controllerName string, lbType elbv2model.LoadBalancerType, maxConcurrentReconciles int, gatewayTagPrefix string, finalizer string, routeLoader routeutils.Loader, routeFilter routeutils.LoadRouteFilter, cloud services.Cloud, k8sClient client.Client, eventRecorder record.EventRecorder, controllerConfig config.ControllerConfig, finalizerManager k8s.FinalizerManager, networkingSGReconciler networking.SecurityGroupReconciler, networkingSGManager networking.SecurityGroupManager, elbv2TaggingManager elbv2deploy.TaggingManager, subnetResolver networking.SubnetsResolver, vpcInfoProvider networking.VPCInfoProvider, backendSGProvider networking.BackendSGProvider, sgResolver networking.SecurityGroupResolver, logger logr.Logger, metricsCollector lbcmetrics.MetricCollector, reconcileTracker func(namespaceName types.NamespacedName)) Reconciler {
6061

6162
trackingProvider := tracking.NewDefaultProvider(gatewayTagPrefix, controllerConfig.ClusterName)
62-
modelBuilder := gatewaymodel.NewModelBuilder(subnetResolver, vpcInfoProvider, cloud.VpcID(), lbType, trackingProvider, elbv2TaggingManager, cloud.EC2(), controllerConfig.FeatureGates, controllerConfig.ClusterName, controllerConfig.DefaultTags, sets.New(controllerConfig.ExternalManagedTags...), controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, controllerConfig.DefaultLoadBalancerScheme, backendSGProvider, sgResolver, controllerConfig.EnableBackendSecurityGroup, controllerConfig.DisableRestrictedSGRules, logger)
63+
modelBuilder := gatewaymodel.NewModelBuilder(subnetResolver, vpcInfoProvider, cloud.VpcID(), lbType, trackingProvider, elbv2TaggingManager, controllerConfig, cloud.EC2(), controllerConfig.FeatureGates, controllerConfig.ClusterName, controllerConfig.DefaultTags, sets.New(controllerConfig.ExternalManagedTags...), controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, controllerConfig.DefaultLoadBalancerScheme, backendSGProvider, sgResolver, controllerConfig.EnableBackendSecurityGroup, controllerConfig.DisableRestrictedSGRules, logger)
6364

6465
stackMarshaller := deploy.NewDefaultStackMarshaller()
6566
stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler, elbv2TaggingManager, controllerConfig, gatewayTagPrefix, logger, metricsCollector, controllerName)

‎controllers/service/service_controller.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package service
33
import (
44
"context"
55
"fmt"
6+
"sigs.k8s.io/aws-load-balancer-controller/pkg/shared_constants"
67

78
"sigs.k8s.io/controller-runtime/pkg/reconcile"
89

@@ -33,7 +34,6 @@ import (
3334
)
3435

3536
const (
36-
serviceFinalizer = "service.k8s.aws/resources"
3737
serviceTagPrefix = "service.k8s.aws"
3838
serviceAnnotationPrefix = "service.beta.kubernetes.io"
3939
controllerName = "service"
@@ -47,7 +47,7 @@ func NewServiceReconciler(cloud services.Cloud, k8sClient client.Client, eventRe
4747

4848
annotationParser := annotations.NewSuffixAnnotationParser(serviceAnnotationPrefix)
4949
trackingProvider := tracking.NewDefaultProvider(serviceTagPrefix, controllerConfig.ClusterName)
50-
serviceUtils := service.NewServiceUtils(annotationParser, serviceFinalizer, controllerConfig.ServiceConfig.LoadBalancerClass, controllerConfig.FeatureGates)
50+
serviceUtils := service.NewServiceUtils(annotationParser, shared_constants.ServiceFinalizer, controllerConfig.ServiceConfig.LoadBalancerClass, controllerConfig.FeatureGates)
5151
modelBuilder := service.NewDefaultModelBuilder(annotationParser, subnetsResolver, vpcInfoProvider, cloud.VpcID(), trackingProvider,
5252
elbv2TaggingManager, cloud.EC2(), controllerConfig.FeatureGates, controllerConfig.ClusterName, controllerConfig.DefaultTags, controllerConfig.ExternalManagedTags,
5353
controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, controllerConfig.DefaultLoadBalancerScheme, controllerConfig.FeatureGates.Enabled(config.EnableIPTargetType), serviceUtils,
@@ -170,7 +170,7 @@ func (r *serviceReconciler) reconcileLoadBalancerResources(ctx context.Context,
170170

171171
var err error
172172
addFinalizersFn := func() {
173-
err = r.finalizerManager.AddFinalizers(ctx, svc, serviceFinalizer)
173+
err = r.finalizerManager.AddFinalizers(ctx, svc, shared_constants.ServiceFinalizer)
174174
}
175175
r.metricsCollector.ObserveControllerReconcileLatency(controllerName, "add_finalizers", addFinalizersFn)
176176
if err != nil {
@@ -214,7 +214,7 @@ func (r *serviceReconciler) reconcileLoadBalancerResources(ctx context.Context,
214214
}
215215

216216
func (r *serviceReconciler) cleanupLoadBalancerResources(ctx context.Context, svc *corev1.Service, stack core.Stack) error {
217-
if k8s.HasFinalizer(svc, serviceFinalizer) {
217+
if k8s.HasFinalizer(svc, shared_constants.ServiceFinalizer) {
218218
err := r.deployModel(ctx, svc, stack)
219219
if err != nil {
220220
return err
@@ -226,7 +226,7 @@ func (r *serviceReconciler) cleanupLoadBalancerResources(ctx context.Context, sv
226226
r.eventRecorder.Event(svc, corev1.EventTypeWarning, k8s.ServiceEventReasonFailedCleanupStatus, fmt.Sprintf("Failed update status due to %v", err))
227227
return err
228228
}
229-
if err := r.finalizerManager.RemoveFinalizers(ctx, svc, serviceFinalizer); err != nil {
229+
if err := r.finalizerManager.RemoveFinalizers(ctx, svc, shared_constants.ServiceFinalizer); err != nil {
230230
r.eventRecorder.Event(svc, corev1.EventTypeWarning, k8s.ServiceEventReasonFailedRemoveFinalizer, fmt.Sprintf("Failed remove finalizer due to %v", err))
231231
return err
232232
}

0 commit comments

Comments
 (0)