github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-05 18:24:07 +00:00
Code Issues Projects Releases Wiki Activity

Add support of specifying service tags for Azure cloud provider

Browse Source
This commit is contained in:
Pengfei Ni 2018-03-21 16:51:40 +08:00
parent ad432fa6bd
commit 7d9d571659
1 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
pkg/cloudprovider/providers/azure/azure_loadbalancer.go
View File

@ -69,6 +69,10 @@ const (
// ServiceAnnotationLoadBalancerResourceGroup is the annotation used on the service // ServiceAnnotationLoadBalancerResourceGroup is the annotation used on the service
// to specify the resource group of load balancer objects that are not in the same resource group as the cluster. // to specify the resource group of load balancer objects that are not in the same resource group as the cluster.
ServiceAnnotationLoadBalancerResourceGroup = "service.beta.kubernetes.io/azure-load-balancer-resource-group" ServiceAnnotationLoadBalancerResourceGroup = "service.beta.kubernetes.io/azure-load-balancer-resource-group"
// ServiceAnnotationAllowedServiceTag is the annotation used on the service
// to specify a list of allowed service tags separated by comma
ServiceAnnotationAllowedServiceTag = "service.beta.kubernetes.io/azure-allowed-service-tags"
) )
// GetLoadBalancer returns whether the specified load balancer exists, and // GetLoadBalancer returns whether the specified load balancer exists, and
@ -838,8 +842,9 @@ func (az *Cloud) reconcileSecurityGroup(clusterName string, service *v1.Service,
if err != nil { if err != nil {
return nil, err return nil, err
} }
serviceTags := getServiceTags(service)
var sourceAddressPrefixes []string var sourceAddressPrefixes []string
if sourceRanges == nil || serviceapi.IsAllowAll(sourceRanges) { if (sourceRanges == nil || serviceapi.IsAllowAll(sourceRanges)) && len(serviceTags) == 0 {
if !requiresInternalLoadBalancer(service) { if !requiresInternalLoadBalancer(service) {
sourceAddressPrefixes = []string{"Internet"} sourceAddressPrefixes = []string{"Internet"}
} }
@ -847,6 +852,9 @@ func (az *Cloud) reconcileSecurityGroup(clusterName string, service *v1.Service,
for _, ip := range sourceRanges { for _, ip := range sourceRanges {
sourceAddressPrefixes = append(sourceAddressPrefixes, ip.String()) sourceAddressPrefixes = append(sourceAddressPrefixes, ip.String())
} }
for _, serviceTag := range serviceTags {
sourceAddressPrefixes = append(sourceAddressPrefixes, serviceTag)
}
} }
expectedSecurityRules := []network.SecurityRule{} expectedSecurityRules := []network.SecurityRule{}
@ -1319,3 +1327,11 @@ func useSharedSecurityRule(service *v1.Service) bool {
return false return false
} }
func getServiceTags(service *v1.Service) []string {
if serviceTags, found := service.Annotations[ServiceAnnotationAllowedServiceTag]; found {
return strings.Split(strings.TrimSpace(serviceTags), ",")
}
return nil
}