github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-25 04:33:26 +00:00
Code Issues Projects Releases Wiki Activity

set dest prefix and port for IPv6 sg rule

Browse Source
This commit is contained in:
Anish Ramasekar 2020-06-05 09:15:47 -07:00
parent d6b42f0049
commit aa8b2c122f
No known key found for this signature in database
GPG Key ID: 57E2FE676FC346A6
2 changed files with 40 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
staging/src/k8s.io/legacy-cloud-providers/azure/azure_loadbalancer.go
View File

@ -1158,6 +1158,8 @@ func (az *Cloud) reconcileSecurityGroup(clusterName string, service *v1.Service,
} }
expectedSecurityRules := []network.SecurityRule{} expectedSecurityRules := []network.SecurityRule{}
ipv6 := utilnet.IsIPv6String(service.Spec.ClusterIP)
if wantLb { if wantLb {
expectedSecurityRules = make([]network.SecurityRule, len(ports)*len(sourceAddressPrefixes)) expectedSecurityRules = make([]network.SecurityRule, len(ports)*len(sourceAddressPrefixes))
@ -1169,7 +1171,7 @@ func (az *Cloud) reconcileSecurityGroup(clusterName string, service *v1.Service,
for j := range sourceAddressPrefixes { for j := range sourceAddressPrefixes {
ix := i*len(sourceAddressPrefixes) + j ix := i*len(sourceAddressPrefixes) + j
securityRuleName := az.getSecurityRuleName(service, port, sourceAddressPrefixes[j]) securityRuleName := az.getSecurityRuleName(service, port, sourceAddressPrefixes[j])
expectedSecurityRules[ix] = network.SecurityRule{ securityRule := network.SecurityRule{
Name: to.StringPtr(securityRuleName), Name: to.StringPtr(securityRuleName),
SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{ SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
Protocol: *securityProto, Protocol: *securityProto,
@ -1181,6 +1183,13 @@ func (az *Cloud) reconcileSecurityGroup(clusterName string, service *v1.Service,
Direction: network.SecurityRuleDirectionInbound, Direction: network.SecurityRuleDirectionInbound,
}, },
} }
// For IPv6, the destination port needs to be node port and Destination Any as floating IPs
// not supported for IPv6
if ipv6 {
securityRule.SecurityRulePropertiesFormat.DestinationPortRange = to.StringPtr(strconv.Itoa(int(port.NodePort)))
securityRule.SecurityRulePropertiesFormat.DestinationAddressPrefix = to.StringPtr("*")
}
expectedSecurityRules[ix] = securityRule
} }
} }
} }

30
staging/src/k8s.io/legacy-cloud-providers/azure/azure_loadbalancer_test.go
View File

@ -1861,6 +1861,36 @@ func TestReconcileSecurityGroup(t *testing.T) {
}, },
}, },
}, },
{
desc: "reconcileSecurityGroup shall create sgs with correct destinationPrefix for IPv6",
service: getTestService("test1", v1.ProtocolTCP, nil, true, 80),
existingSgs: map[string]network.SecurityGroup{"nsg": {
Name: to.StringPtr("nsg"),
SecurityGroupPropertiesFormat: &network.SecurityGroupPropertiesFormat{},
}},
lbIP: to.StringPtr("fd00::eef0"),
wantLb: true,
expectedSg: &network.SecurityGroup{
Name: to.StringPtr("nsg"),
SecurityGroupPropertiesFormat: &network.SecurityGroupPropertiesFormat{
SecurityRules: &[]network.SecurityRule{
{
Name: to.StringPtr("atest1-TCP-80-Internet"),
SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
Protocol: network.SecurityRuleProtocol("Tcp"),
SourcePortRange: to.StringPtr("*"),
DestinationPortRange: to.StringPtr("10080"),
SourceAddressPrefix: to.StringPtr("Internet"),
DestinationAddressPrefix: to.StringPtr("*"),
Access: network.SecurityRuleAccess("Allow"),
Priority: to.Int32Ptr(500),
Direction: network.SecurityRuleDirection("Inbound"),
},
},
},
},
},
},
} }
for i, test := range testCases { for i, test := range testCases {