kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2808 from alexandrst88/aws-sg-fix 

Add SG parameter into AWS cloud-config
This commit is contained in:
Chris Love 2017-07-06 14:20:14 -06:00 committed by GitHub
parent 20535248b4 6b81385584
commit f1f6507fa8
7 changed files with 32 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
docs/cluster_spec.md
View File

@ -193,4 +193,23 @@ spec:
image: busybox
```
### cloudConfig
If you are using aws as `cloudProvider`, you can disable authorization of ELB security group to Kubernetes Nodes security group. In other words, it will not add security group rule.
This can be usefull to avoid AWS limit: 50 rules per security group.
```yaml
spec:
cloudConfig:
disableSecurityGroupIngress: true
```
#### WARNING: this works only for Kubernetes version above 1.7.0.
For avoid to create security group per each elb, you can specify security group id, that will be assigned to your LoadBalancer. It must be security group id, not name. Also, security group must be empty, because Kubernetes will add rules per ports that are specified in service file.
This can be usefull to avoid AWS limits: 500 security groups per region and 50 rules per security group.
```yaml
spec:
cloudConfig:
elbSecurityGroup: sg-123445678
```

3
nodeup/pkg/model/cloudconfig.go
View File

@ -68,6 +68,9 @@ func (b *CloudConfigBuilder) Build(c *fi.ModelBuilderContext) error {
if cloudConfig.DisableSecurityGroupIngress != nil {
lines = append(lines, fmt.Sprintf("DisableSecurityGroupIngress = %t", *cloudConfig.DisableSecurityGroupIngress))
}
if cloudConfig.ElbSecurityGroup != nil {
lines = append(lines, "ElbSecurityGroup = "+*cloudConfig.ElbSecurityGroup)
}
case "vsphere":
vm_uuid, err := getVMUUID(b.Cluster.Spec.KubernetesVersion)
if err != nil {

3
pkg/apis/kops/componentconfig.go
View File

@ -700,7 +700,8 @@ type CloudConfiguration struct {
NodeTags *string `json:"nodeTags,omitempty"`
NodeInstancePrefix *string `json:"nodeInstancePrefix,omitempty"`
// AWS cloud-config options
DisableSecurityGroupIngress *bool `json:"disableSecurityGroupIngress,omitempty"`
DisableSecurityGroupIngress *bool `json:"disableSecurityGroupIngress,omitempty"`
ElbSecurityGroup *string `json:"elbSecurityGroup,omitempty"`
// vSphere cloud-config specs
VSphereUsername *string `json:"vSphereUsername,omitempty"`

3
pkg/apis/kops/v1alpha1/componentconfig.go
View File

@ -679,7 +679,8 @@ type CloudConfiguration struct {
NodeTags *string `json:"nodeTags,omitempty"`
NodeInstancePrefix *string `json:"nodeInstancePrefix,omitempty"`
// AWS cloud-config options
DisableSecurityGroupIngress *bool `json:"disableSecurityGroupIngress,omitempty"`
DisableSecurityGroupIngress *bool `json:"disableSecurityGroupIngress,omitempty"`
ElbSecurityGroup *string `json:"elbSecurityGroup,omitempty"`
// vSphere cloud-config specs
VSphereUsername *string `json:"vSphereUsername,omitempty"`

2
pkg/apis/kops/v1alpha1/zz_generated.conversion.go
View File

@ -361,6 +361,7 @@ func autoConvert_v1alpha1_CloudConfiguration_To_kops_CloudConfiguration(in *Clou
out.NodeTags = in.NodeTags
out.NodeInstancePrefix = in.NodeInstancePrefix
out.DisableSecurityGroupIngress = in.DisableSecurityGroupIngress
out.ElbSecurityGroup = in.ElbSecurityGroup
out.VSphereUsername = in.VSphereUsername
out.VSpherePassword = in.VSpherePassword
out.VSphereServer = in.VSphereServer
@ -381,6 +382,7 @@ func autoConvert_kops_CloudConfiguration_To_v1alpha1_CloudConfiguration(in *kops
out.NodeTags = in.NodeTags
out.NodeInstancePrefix = in.NodeInstancePrefix
out.DisableSecurityGroupIngress = in.DisableSecurityGroupIngress
out.ElbSecurityGroup = in.ElbSecurityGroup
out.VSphereUsername = in.VSphereUsername
out.VSpherePassword = in.VSpherePassword
out.VSphereServer = in.VSphereServer

3
pkg/apis/kops/v1alpha2/componentconfig.go
View File

@ -312,7 +312,8 @@ type CloudConfiguration struct {
NodeTags *string `json:"nodeTags,omitempty"`
NodeInstancePrefix *string `json:"nodeInstancePrefix,omitempty"`
// AWS cloud-config options
DisableSecurityGroupIngress *bool `json:"disableSecurityGroupIngress,omitempty"`
DisableSecurityGroupIngress *bool `json:"disableSecurityGroupIngress,omitempty"`
ElbSecurityGroup *string `json:"elbSecurityGroup,omitempty"`
// vSphere cloud-config specs
VSphereUsername *string `json:"vSphereUsername,omitempty"`

2
pkg/apis/kops/v1alpha2/zz_generated.conversion.go
View File

@ -389,6 +389,7 @@ func autoConvert_v1alpha2_CloudConfiguration_To_kops_CloudConfiguration(in *Clou
out.NodeTags = in.NodeTags
out.NodeInstancePrefix = in.NodeInstancePrefix
out.DisableSecurityGroupIngress = in.DisableSecurityGroupIngress
out.ElbSecurityGroup = in.ElbSecurityGroup
out.VSphereUsername = in.VSphereUsername
out.VSpherePassword = in.VSpherePassword
out.VSphereServer = in.VSphereServer
@ -409,6 +410,7 @@ func autoConvert_kops_CloudConfiguration_To_v1alpha2_CloudConfiguration(in *kops
out.NodeTags = in.NodeTags
out.NodeInstancePrefix = in.NodeInstancePrefix
out.DisableSecurityGroupIngress = in.DisableSecurityGroupIngress
out.ElbSecurityGroup = in.ElbSecurityGroup
out.VSphereUsername = in.VSphereUsername
out.VSpherePassword = in.VSpherePassword
out.VSphereServer = in.VSphereServer