From b7813b15a1b8c40f0b034982b91bf13251127bb9 Mon Sep 17 00:00:00 2001 From: Pengfei Ni Date: Wed, 21 Mar 2018 17:06:22 +0800 Subject: [PATCH] Add verification of supported service tags --- .../providers/azure/azure_loadbalancer.go | 30 ++++++++++++++++--- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/pkg/cloudprovider/providers/azure/azure_loadbalancer.go b/pkg/cloudprovider/providers/azure/azure_loadbalancer.go index 4a0f614e499..a6c0911e57b 100644 --- a/pkg/cloudprovider/providers/azure/azure_loadbalancer.go +++ b/pkg/cloudprovider/providers/azure/azure_loadbalancer.go @@ -75,6 +75,13 @@ const ( ServiceAnnotationAllowedServiceTag = "service.beta.kubernetes.io/azure-allowed-service-tags" ) +var ( + // supportedServiceTags holds a list of supported service tags on Azure. + // Refer https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#service-tags for more information. + supportedServiceTags = sets.NewString("VirtualNetwork", "VIRTUAL_NETWORK", "AzureLoadBalancer", "AZURE_LOADBALANCER", + "Internet", "INTERNET", "AzureTrafficManager", "Storage", "Sql") +) + // GetLoadBalancer returns whether the specified load balancer exists, and // if so, what its status is. func (az *Cloud) GetLoadBalancer(ctx context.Context, clusterName string, service *v1.Service) (status *v1.LoadBalancerStatus, exists bool, err error) { @@ -842,7 +849,10 @@ func (az *Cloud) reconcileSecurityGroup(clusterName string, service *v1.Service, if err != nil { return nil, err } - serviceTags := getServiceTags(service) + serviceTags, err := getServiceTags(service) + if err != nil { + return nil, err + } var sourceAddressPrefixes []string if (sourceRanges == nil || serviceapi.IsAllowAll(sourceRanges)) && len(serviceTags) == 0 { if !requiresInternalLoadBalancer(service) { @@ -1328,10 +1338,22 @@ func useSharedSecurityRule(service *v1.Service) bool { return false } -func getServiceTags(service *v1.Service) []string { +func getServiceTags(service *v1.Service) ([]string, error) { if serviceTags, found := service.Annotations[ServiceAnnotationAllowedServiceTag]; found { - return strings.Split(strings.TrimSpace(serviceTags), ",") + tags := strings.Split(strings.TrimSpace(serviceTags), ",") + for _, tag := range tags { + // Storage and Sql service tags support setting regions with suffix ".Region" + if strings.HasPrefix(tag, "Storage.") || strings.HasPrefix(tag, "Sql.") { + continue + } + + if !supportedServiceTags.Has(tag) { + return nil, fmt.Errorf("only %q are allowed in service tags", supportedServiceTags.List()) + } + } + + return tags, nil } - return nil + return nil, nil }