github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 21:47:07 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #21399 from sky-uk/disable-ingress-sg

Browse Source 
Auto commit by PR queue bot
This commit is contained in:
k8s-merge-robot 2016-02-24 00:05:47 -08:00
commit 9c1d8bf99d
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/cloudprovider/providers/aws/aws.go
View File

@ -218,6 +218,15 @@ type AWSCloudConfig struct {
Zone string Zone string
KubernetesClusterTag string KubernetesClusterTag string
//The aws provider creates an inbound rule per load balancer on the node security
//group. However, this can run into the AWS security group rule limit of 50 if
//many LoadBalancers are created.
//
//This flag disables the automatic ingress creation. It requires that the user
//has setup a rule that allows inbound traffic on kubelet ports from the
//local VPC subnet (so load balancers can access it). E.g. 10.82.0.0/16 30000-32000.
DisableSecurityGroupIngress bool
} }
} }
@ -2066,6 +2075,10 @@ func findSecurityGroupForInstance(instance *ec2.Instance) *string {
// Open security group ingress rules on the instances so that the load balancer can talk to them // Open security group ingress rules on the instances so that the load balancer can talk to them
// Will also remove any security groups ingress rules for the load balancer that are _not_ needed for allInstances // Will also remove any security groups ingress rules for the load balancer that are _not_ needed for allInstances
func (s *AWSCloud) updateInstanceSecurityGroupsForLoadBalancer(lb *elb.LoadBalancerDescription, allInstances []*ec2.Instance) error { func (s *AWSCloud) updateInstanceSecurityGroupsForLoadBalancer(lb *elb.LoadBalancerDescription, allInstances []*ec2.Instance) error {
if s.cfg.Global.DisableSecurityGroupIngress {
return nil
}
// Determine the load balancer security group id // Determine the load balancer security group id
loadBalancerSecurityGroupId := "" loadBalancerSecurityGroupId := ""
for _, securityGroup := range lb.SecurityGroups { for _, securityGroup := range lb.SecurityGroups {