✨ Allow more permissive extensibility for securityRules #5525
Conversation
k8s-ci-robot
added
kind/feature
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
size/L
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #5525 +/- ##
=======================================
Coverage 52.61% 52.61%
=======================================
Files 272 272
Lines 29485 29507 +22
=======================================
+ Hits 15513 15526 +13
- Misses 13165 13174 +9
Partials 807 807 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
k8s-ci-robot
added
release-note
Signed-off-by: Danil-Grigorev <[email protected]>
Danil-Grigorev
force-pushed
the
extend-security-rules
branch
from
bec7326 to
fbe11d7
Compare
| @@ -893,6 +893,20 @@ func (s SubnetSpec) IsIPv6Enabled() bool { | |||
| return false | |||
| } | |||
|
|
|||
| // GetSecurityRuleByDestination returns security group rule, which matches provided destination ports. | |||
| func (s SubnetSpec) GetSecurityRuleByDestination(ports string) *SecurityRule { | |||
| if s.SecurityGroup.SecurityRules == nil { | |||
There was a problem hiding this comment.
wrapping the below for loop in if s.SecurityGroup.SecurityRules != nil { is equivalent and allows us to remove the add'l return nil response (we don't need a specific nil return for this condition because the default return before exiting the function is nil)
| @@ -1020,9 +1020,18 @@ func (s *ClusterScope) SetControlPlaneSecurityRules() { | |||
| if !s.ControlPlaneEnabled() { | |||
| return | |||
| } | |||
| if s.ControlPlaneSubnet().SecurityGroup.SecurityRules == nil { | |||
|
|
|||
| subnet := s.ControlPlaneSubnet() | |||
There was a problem hiding this comment.
in this flow where are we adding any user-provided security rules? (for example if a user specifies TCP 9345)
or is that elsewhere and the purpose of this change is to filter out 22 and apiserver port if it's not included?
What type of PR is this?
/kind feature
What this PR does / why we need it:
This change improves UX while using
CAPZwithRKE2provider, by allowing to specify only additional security rules on theAzureClusterresource, and making existing security rule defaults forAPIServerandSSHport more permissive and based on destination port selection.Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close the issue(s) when PR gets merged):Fixes #5511
Special notes for your reviewer:
TODOs:
Release note: