github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-23 03:41:45 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #49805 from nbutton23/nbutton-fix-elb-sg-bug

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 49805, 50052)

We never want to modify the globally defined SG for ELBs

**What this PR does / why we need it**:
Fixes a bug where creating or updating an ELB will modify a globally defined security group

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50105

**Special notes for your reviewer**:

**Release note**:

```release-note
fixes a bug around using the Global config ElbSecurityGroup where Kuberentes would modify the passed in Security Group.
```
This commit is contained in:
Kubernetes Submit Queue 2017-08-05 12:32:59 -07:00 committed by GitHub
commit 207a95a076
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
pkg/cloudprovider/providers/aws/aws.go
View File

@ -2101,6 +2101,11 @@ func isEqualUserGroupPair(l, r *ec2.UserIdGroupPair, compareGroupUserIDs bool) b
// Returns true if and only if changes were made
// The security group must already exist
func (c *Cloud) setSecurityGroupIngress(securityGroupID string, permissions IPPermissionSet) (bool, error) {
// We do not want to make changes to the Global defined SG
if securityGroupID == c.cfg.Global.ElbSecurityGroup {
return false, nil
}
group, err := c.findSecurityGroup(securityGroupID)
if err != nil {
glog.Warningf("Error retrieving security group %q", err)
@ -2171,6 +2176,11 @@ func (c *Cloud) setSecurityGroupIngress(securityGroupID string, permissions IPPe
// Returns true if and only if changes were made
// The security group must already exist
func (c *Cloud) addSecurityGroupIngress(securityGroupID string, addPermissions []*ec2.IpPermission) (bool, error) {
// We do not want to make changes to the Global defined SG
if securityGroupID == c.cfg.Global.ElbSecurityGroup {
return false, nil
}
group, err := c.findSecurityGroup(securityGroupID)
if err != nil {
glog.Warningf("Error retrieving security group: %q", err)
@ -2227,6 +2237,11 @@ func (c *Cloud) addSecurityGroupIngress(securityGroupID string, addPermissions [
// Returns true if and only if changes were made
// If the security group no longer exists, will return (false, nil)
func (c *Cloud) removeSecurityGroupIngress(securityGroupID string, removePermissions []*ec2.IpPermission) (bool, error) {
// We do not want to make changes to the Global defined SG
if securityGroupID == c.cfg.Global.ElbSecurityGroup {
return false, nil
}
group, err := c.findSecurityGroup(securityGroupID)
if err != nil {
glog.Warningf("Error retrieving security group: %q", err)
@ -2554,7 +2569,7 @@ func getPortSets(annotation string) (ports *portSets) {
// buildELBSecurityGroupList returns list of SecurityGroups which should be
// attached to ELB created by a service. List always consist of at least
// 1 member which is an SG created for this service. Extra groups can be
// 1 member which is an SG created for this service or a SG from the Global config. Extra groups can be
// specified via annotation
func (c *Cloud) buildELBSecurityGroupList(serviceName types.NamespacedName, loadBalancerName, annotation string) ([]string, error) {
var err error