From 23f271b33a5e7f9b9d150b93a0d1c10378ee3846 Mon Sep 17 00:00:00 2001 From: Gauthier Delacroix <1533042+gdlx@users.noreply.github.com> Date: Mon, 23 Sep 2024 17:00:38 +0200 Subject: [PATCH] Add PrefixListsIDs field to IngressClassParams --- .../elbv2/v1beta1/ingressclassparams_types.go | 3 + apis/elbv2/v1beta1/zz_generated.deepcopy.go | 5 + .../elbv2.k8s.aws_ingressclassparams.yaml | 6 + docs/guide/ingress/ingress_class.md | 10 +- pkg/ingress/model_build_listener.go | 13 +- pkg/ingress/model_builder_test.go | 126 ++++++++++++++++++ 6 files changed, 160 insertions(+), 3 deletions(-) diff --git a/apis/elbv2/v1beta1/ingressclassparams_types.go b/apis/elbv2/v1beta1/ingressclassparams_types.go index 4fc921694..36eb8573d 100644 --- a/apis/elbv2/v1beta1/ingressclassparams_types.go +++ b/apis/elbv2/v1beta1/ingressclassparams_types.go @@ -156,6 +156,9 @@ type IngressClassParamsSpec struct { // MinimumLoadBalancerCapacity define the capacity reservation for LoadBalancers for all Ingress that belong to IngressClass with this IngressClassParams. // +optional MinimumLoadBalancerCapacity *MinimumLoadBalancerCapacity `json:"minimumLoadBalancerCapacity,omitempty"` + + // PrefixListsIDs defines the security group prefix lists for all Ingresses that belong to IngressClass with this IngressClassParams. + PrefixListsIDs []string `json:"PrefixListsIDs,omitempty"` } // +kubebuilder:object:root=true diff --git a/apis/elbv2/v1beta1/zz_generated.deepcopy.go b/apis/elbv2/v1beta1/zz_generated.deepcopy.go index 108289a52..1b291e3b9 100644 --- a/apis/elbv2/v1beta1/zz_generated.deepcopy.go +++ b/apis/elbv2/v1beta1/zz_generated.deepcopy.go @@ -174,6 +174,11 @@ func (in *IngressClassParamsSpec) DeepCopyInto(out *IngressClassParamsSpec) { *out = new(MinimumLoadBalancerCapacity) **out = **in } + if in.PrefixListsIDs != nil { + in, out := &in.PrefixListsIDs, &out.PrefixListsIDs + *out = make([]string, len(*in)) + copy(*out, *in) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressClassParamsSpec. diff --git a/config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml b/config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml index 7f65f28ad..369c4b93d 100644 --- a/config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml +++ b/config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml @@ -55,6 +55,12 @@ spec: spec: description: IngressClassParamsSpec defines the desired state of IngressClassParams properties: + PrefixListsIDs: + description: PrefixListsIDs defines the security group prefix lists + for all Ingresses that belong to IngressClass with this IngressClassParams. + items: + type: string + type: array certificateArn: description: CertificateArn specifies the ARN of the certificates for all Ingresses that belong to IngressClass with this IngressClassParams. diff --git a/docs/guide/ingress/ingress_class.md b/docs/guide/ingress/ingress_class.md index fd5d6ee95..a595bea5d 100644 --- a/docs/guide/ingress/ingress_class.md +++ b/docs/guide/ingress/ingress_class.md @@ -251,4 +251,12 @@ They may specify `capacityUnits`. If the field is specified, LBC will ignore the ##### spec.minimumLoadBalancerCapacity.capacityUnits -If `capacityUnits` is specified, it must be to valid positive value greater than 0. If set to 0, the LBC will reset the capacity reservation for the load balancer. \ No newline at end of file +If `capacityUnits` is specified, it must be to valid positive value greater than 0. If set to 0, the LBC will reset the capacity reservation for the load balancer. +#### spec.prefixListIDs + +`prefixListIDs` is an optional setting. + +Cluster administrators can use `prefixListIDs` field to specify the managed prefix lists that are allowed to access the load balancers that belong to this IngressClass. You can specify the list of prefix list IDs in the `spec.prefixListIDs` field. + +1. If `prefixListIDs` is set, the prefix lists defined will be applied to the load balancer that belong to this IngressClass. If you specify invalid prefix list IDs, the controller will fail to reconcile ingresses belonging to the particular ingress class. +2. If `prefixListIDs` un-specified, Ingresses with this IngressClass can continue to use `alb.ingress.kubernetes.io/security-group-prefix-lists` annotation to specify the load balancer prefix lists. diff --git a/pkg/ingress/model_build_listener.go b/pkg/ingress/model_build_listener.go index 80f848ba3..464096f4f 100644 --- a/pkg/ingress/model_build_listener.go +++ b/pkg/ingress/model_build_listener.go @@ -126,8 +126,7 @@ type listenPortConfig struct { func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context.Context, ing *ClassifiedIngress) (map[int32]listenPortConfig, error) { explicitTLSCertARNs := t.computeIngressExplicitTLSCertARNs(ctx, ing) explicitSSLPolicy := t.computeIngressExplicitSSLPolicy(ctx, ing) - var prefixListIDs []string - t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixSecurityGroupPrefixLists, &prefixListIDs, ing.Ing.Annotations) + prefixListIDs := t.computeIngressExplicitPrefixListIDs(ctx, ing) inboundCIDRv4s, inboundCIDRV6s, err := t.computeIngressExplicitInboundCIDRs(ctx, ing) if err != nil { return nil, err @@ -278,6 +277,16 @@ func (t *defaultModelBuildTask) computeIngressExplicitSSLPolicy(_ context.Contex return &rawSSLPolicy } +func (t *defaultModelBuildTask) computeIngressExplicitPrefixListIDs(_ context.Context, ing *ClassifiedIngress) []string { + if ing.IngClassConfig.IngClassParams != nil && len(ing.IngClassConfig.IngClassParams.Spec.PrefixListsIDs) != 0 { + return ing.IngClassConfig.IngClassParams.Spec.PrefixListsIDs + } + var prefixListIDs []string + t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixSecurityGroupPrefixLists, &prefixListIDs, ing.Ing.Annotations) + + return prefixListIDs +} + type MutualAuthenticationConfig struct { Port int32 `json:"port"` Mode string `json:"mode"` diff --git a/pkg/ingress/model_builder_test.go b/pkg/ingress/model_builder_test.go index c9040a4b3..7fd522b76 100644 --- a/pkg/ingress/model_builder_test.go +++ b/pkg/ingress/model_builder_test.go @@ -3396,6 +3396,132 @@ func Test_defaultModelBuilder_Build(t *testing.T) { } } } +}`, + }, + { + name: "Ingress - ingress with managed prefix list in IngressClassParam", + env: env{ + svcs: []*corev1.Service{ns_1_svc_1, ns_1_svc_2, ns_1_svc_3}, + }, + fields: fields{ + resolveViaDiscoveryCalls: []resolveViaDiscoveryCall{resolveViaDiscoveryCallForInternalLB}, + listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB}, + enableBackendSG: true, + }, + args: args{ + ingGroup: Group{ + ID: GroupID{Namespace: "ns-1", Name: "ing-1"}, + Members: []ClassifiedIngress{ + { + IngClassConfig: ClassConfiguration{ + IngClassParams: &v1beta1.IngressClassParams{ + Spec: v1beta1.IngressClassParamsSpec{ + PrefixListsIDs: []string{ + "pl-11111111", + "pl-22222222", + }, + }, + }, + }, + Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{ + Namespace: "ns-1", + Name: "ing-1", + Annotations: map[string]string{ + "alb.ingress.kubernetes.io/security-group-prefix-lists": "pl-00000000", + }, + }, + Spec: networking.IngressSpec{ + Rules: []networking.IngressRule{ + { + Host: "app-1.example.com", + IngressRuleValue: networking.IngressRuleValue{ + HTTP: &networking.HTTPIngressRuleValue{ + Paths: []networking.HTTPIngressPath{ + { + Path: "/svc-1", + Backend: networking.IngressBackend{ + Service: &networking.IngressServiceBackend{ + Name: ns_1_svc_1.Name, + Port: networking.ServiceBackendPort{ + Name: "http", + }, + }, + }, + }, + { + Path: "/svc-2", + Backend: networking.IngressBackend{ + Service: &networking.IngressServiceBackend{ + Name: ns_1_svc_2.Name, + Port: networking.ServiceBackendPort{ + Name: "http", + }, + }, + }, + }, + }, + }, + }, + }, + { + Host: "app-2.example.com", + IngressRuleValue: networking.IngressRuleValue{ + HTTP: &networking.HTTPIngressRuleValue{ + Paths: []networking.HTTPIngressPath{ + { + Path: "/svc-3", + Backend: networking.IngressBackend{ + Service: &networking.IngressServiceBackend{ + Name: ns_1_svc_3.Name, + Port: networking.ServiceBackendPort{ + Name: "https", + }, + }, + }, + }, + }, + }, + }, + }, + }, + }, + }, + }, + }, + }, + }, + wantStackPatch: ` +{ + "resources": { + "AWS::EC2::SecurityGroup": { + "ManagedLBSecurityGroup": { + "spec": { + "ingress": [ + { + "fromPort": 80, + "ipProtocol": "tcp", + "prefixLists": [ + { + "listID": "pl-11111111" + } + ], + "toPort": 80 + }, + { + "fromPort": 80, + "ipProtocol": "tcp", + "prefixLists": [ + { + "listID": "pl-22222222" + } + ], + "toPort": 80 + } + ] + } + } + } + } }`, }, {