From 39f46806b797c716d3b37d7e5f86ada6a9cfd151 Mon Sep 17 00:00:00 2001 From: Andrew Garrett Date: Fri, 16 Feb 2018 22:00:22 +0000 Subject: [PATCH] Don't assume SG is for ELB; pass tags directly --- pkg/cloudprovider/providers/aws/aws.go | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/pkg/cloudprovider/providers/aws/aws.go b/pkg/cloudprovider/providers/aws/aws.go index 5e526a19627..a1145cc05a2 100644 --- a/pkg/cloudprovider/providers/aws/aws.go +++ b/pkg/cloudprovider/providers/aws/aws.go @@ -2814,8 +2814,9 @@ func (c *Cloud) removeSecurityGroupIngress(securityGroupID string, removePermiss // Makes sure the security group exists. // For multi-cluster isolation, name must be globally unique, for example derived from the service UUID. +// Additional tags can be specified // Returns the security group id or error -func (c *Cloud) ensureSecurityGroup(name string, description string, annotations map[string]string) (string, error) { +func (c *Cloud) ensureSecurityGroup(name string, description string, additionalTags map[string]string) (string, error) { groupID := "" attempt := 0 for { @@ -2881,7 +2882,7 @@ func (c *Cloud) ensureSecurityGroup(name string, description string, annotations return "", fmt.Errorf("created security group, but id was not returned: %s", name) } - err := c.tagging.createTags(c.ec2, groupID, ResourceLifecycleOwned, getLoadBalancerAdditionalTags(annotations)) + err := c.tagging.createTags(c.ec2, groupID, ResourceLifecycleOwned, additionalTags) if err != nil { // If we retry, ensureClusterTags will recover from this - it // will add the missing tags. We could delete the security @@ -3095,8 +3096,9 @@ func getPortSets(annotation string) (ports *portSets) { // buildELBSecurityGroupList returns list of SecurityGroups which should be // attached to ELB created by a service. List always consist of at least -// 1 member which is an SG created for this service or a SG from the Global config. Extra groups can be -// specified via annotation +// 1 member which is an SG created for this service or a SG from the Global config. +// Extra groups can be specified via annotation, as can extra tags for any +// new groups. func (c *Cloud) buildELBSecurityGroupList(serviceName types.NamespacedName, loadBalancerName string, annotations map[string]string) ([]string, error) { var err error var securityGroupID string @@ -3107,7 +3109,7 @@ func (c *Cloud) buildELBSecurityGroupList(serviceName types.NamespacedName, load // Create a security group for the load balancer sgName := "k8s-elb-" + loadBalancerName sgDescription := fmt.Sprintf("Security group for Kubernetes ELB %s (%v)", loadBalancerName, serviceName) - securityGroupID, err = c.ensureSecurityGroup(sgName, sgDescription, annotations) + securityGroupID, err = c.ensureSecurityGroup(sgName, sgDescription, getLoadBalancerAdditionalTags(annotations)) if err != nil { glog.Errorf("Error creating load balancer security group: %q", err) return nil, err