From 0ea7e55f25a3c30b4590d2d166c1e05d2d02d192 Mon Sep 17 00:00:00 2001 From: zadjadr Date: Thu, 10 Aug 2023 20:53:39 +0200 Subject: [PATCH] Add missing security groups for cilium etcd --- pkg/model/openstackmodel/firewall.go | 42 ++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/pkg/model/openstackmodel/firewall.go b/pkg/model/openstackmodel/firewall.go index 7892c82020..1c34460b77 100644 --- a/pkg/model/openstackmodel/firewall.go +++ b/pkg/model/openstackmodel/firewall.go @@ -149,6 +149,8 @@ func (b *FirewallModelBuilder) addSSHRules(c *fi.CloudupModelBuilderContext, sgM func (b *FirewallModelBuilder) addETCDRules(c *fi.CloudupModelBuilderContext, sgMap map[string]*openstacktasks.SecurityGroup) error { masterName := b.SecurityGroupName(kops.InstanceGroupRoleControlPlane) masterSG := sgMap[masterName] + nodeName := b.SecurityGroupName(kops.InstanceGroupRoleNode) + nodeSG := sgMap[nodeName] // ETCD Peer Discovery etcdRule := &openstacktasks.SecurityGroupRule{ @@ -170,6 +172,46 @@ func (b *FirewallModelBuilder) addETCDRules(c *fi.CloudupModelBuilderContext, sg b.addDirectionalGroupRule(c, masterSG, masterSG, etcdRule) b.addDirectionalGroupRule(c, masterSG, masterSG, etcdPeerRule) + if b.Cluster.Spec.Networking.Cilium != nil && b.Cluster.Spec.Networking.Cilium.EtcdManaged { + etcdCiliumPeerRule := &openstacktasks.SecurityGroupRule{ + Lifecycle: b.Lifecycle, + Direction: s(string(rules.DirIngress)), + Protocol: s(string(rules.ProtocolTCP)), + EtherType: s(IPV4), + PortRangeMin: i(2382), + PortRangeMax: i(2382), + } + etcdCiliumGRPCRule := &openstacktasks.SecurityGroupRule{ + Lifecycle: b.Lifecycle, + Direction: s(string(rules.DirIngress)), + Protocol: s(string(rules.ProtocolTCP)), + EtherType: s(IPV4), + PortRangeMin: i(wellknownports.EtcdCiliumGRPC), + PortRangeMax: i(wellknownports.EtcdCiliumGRPC), + } + etcdCiliumQuarantinedClient := &openstacktasks.SecurityGroupRule{ + Lifecycle: b.Lifecycle, + Direction: s(string(rules.DirIngress)), + Protocol: s(string(rules.ProtocolTCP)), + EtherType: s(IPV4), + PortRangeMin: i(wellknownports.EtcdCiliumQuarantinedClientPort), + PortRangeMax: i(wellknownports.EtcdCiliumQuarantinedClientPort), + } + etcdCiliumClientRule := &openstacktasks.SecurityGroupRule{ + Lifecycle: b.Lifecycle, + Direction: s(string(rules.DirIngress)), + Protocol: s(string(rules.ProtocolTCP)), + EtherType: s(IPV4), + PortRangeMin: i(wellknownports.EtcdCiliumClientPort), + PortRangeMax: i(wellknownports.EtcdCiliumClientPort), + } + b.addDirectionalGroupRule(c, masterSG, masterSG, etcdCiliumPeerRule) + b.addDirectionalGroupRule(c, masterSG, masterSG, etcdCiliumGRPCRule) + b.addDirectionalGroupRule(c, masterSG, masterSG, etcdCiliumClientRule) + b.addDirectionalGroupRule(c, masterSG, masterSG, etcdCiliumQuarantinedClient) + b.addDirectionalGroupRule(c, nodeSG, masterSG, etcdCiliumClientRule) + } + for _, portRange := range wellknownports.ETCDPortRanges() { etcdMgmrRule := &openstacktasks.SecurityGroupRule{ Lifecycle: b.Lifecycle,