Skip to content

Commit fc1ce6b

Browse files
richardcaserichardcase
committed
wip: replacing ALL sources
Signed-off-by: Richard Case <[email protected]>
1 parent be85c72 commit fc1ce6b

File tree

9 files changed

+73
-2
lines changed

9 files changed

+73
-2
lines changed

‎api/v1beta1/zz_generated.conversion.go

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_types.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,12 @@ type AWSLoadBalancerSpec struct {
252252
// PreserveClientIP lets the user control if preservation of client ips must be retained or not.
253253
// If this is enabled 6443 will be opened to 0.0.0.0/0.
254254
PreserveClientIP bool `json:"preserveClientIP,omitempty"`
255+
256+
// DefaultAllowedSourceCidrs is a list of allowed cidr blocks to allow as the source in the inbound rules for
257+
// the api server security group. If not supplied then it defaults to 0.0.0.0/0 for an IPv4 vpc or ::/o for
258+
// a IPv6 vpc. This is ignored if IngressRules are explicitly supplied.
259+
// +optional
260+
DefaultAllowedSourceCidrs []string `json:"defaultAllowedSourceCidrs,omitempty"`
255261
}
256262

257263
// AdditionalListenerSpec defines the desired state of an

‎api/v1beta2/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1083,6 +1083,14 @@ spec:
10831083
10841084
Defaults to false.
10851085
type: boolean
1086+
defaultAllowedSourceCidrs:
1087+
description: |-
1088+
DefaultAllowedSourceCidrs is a list of allowed cidr blocks to allow as the source in the inbound rules for
1089+
the api server security group. If not supplied then it defaults to 0.0.0.0/0 for an IPv4 vpc or ::/o for
1090+
a IPv6 vpc. This is ignored if IngressRules are explicitly supplied.
1091+
items:
1092+
type: string
1093+
type: array
10861094
disableHostsRewrite:
10871095
description: |-
10881096
DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts
@@ -1908,6 +1916,14 @@ spec:
19081916
19091917
Defaults to false.
19101918
type: boolean
1919+
defaultAllowedSourceCidrs:
1920+
description: |-
1921+
DefaultAllowedSourceCidrs is a list of allowed cidr blocks to allow as the source in the inbound rules for
1922+
the api server security group. If not supplied then it defaults to 0.0.0.0/0 for an IPv4 vpc or ::/o for
1923+
a IPv6 vpc. This is ignored if IngressRules are explicitly supplied.
1924+
items:
1925+
type: string
1926+
type: array
19111927
disableHostsRewrite:
19121928
description: |-
19131929
DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -675,6 +675,14 @@ spec:
675675
676676
Defaults to false.
677677
type: boolean
678+
defaultAllowedSourceCidrs:
679+
description: |-
680+
DefaultAllowedSourceCidrs is a list of allowed cidr blocks to allow as the source in the inbound rules for
681+
the api server security group. If not supplied then it defaults to 0.0.0.0/0 for an IPv4 vpc or ::/o for
682+
a IPv6 vpc. This is ignored if IngressRules are explicitly supplied.
683+
items:
684+
type: string
685+
type: array
678686
disableHostsRewrite:
679687
description: |-
680688
DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts
@@ -1509,6 +1517,14 @@ spec:
15091517
15101518
Defaults to false.
15111519
type: boolean
1520+
defaultAllowedSourceCidrs:
1521+
description: |-
1522+
DefaultAllowedSourceCidrs is a list of allowed cidr blocks to allow as the source in the inbound rules for
1523+
the api server security group. If not supplied then it defaults to 0.0.0.0/0 for an IPv4 vpc or ::/o for
1524+
a IPv6 vpc. This is ignored if IngressRules are explicitly supplied.
1525+
items:
1526+
type: string
1527+
type: array
15121528
disableHostsRewrite:
15131529
description: |-
15141530
DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts

‎pkg/cloud/scope/cluster.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,20 @@ func (s *ClusterScope) NodePortServicesAllowedCidrs() []string {
235235
return []string{cloud.AnyIPv4CidrBlock}
236236
}
237237

238+
// DefaultAllowedAPIServerSources returns the cidr blocks to be used as the default allowed sources in the api server
239+
// security group inbound rule. Defaults to 0.0.0.0/0 or ::/0
240+
func (s *ClusterScope) DefaultAllowedAPIServerSources(ipv6 bool) []string {
241+
if s.AWSCluster.Spec.ControlPlaneLoadBalancer == nil || len(s.AWSCluster.Spec.ControlPlaneLoadBalancer.DefaultAllowedSourceCidrs) == 0 {
242+
if ipv6 {
243+
return []string{cloud.AnyIPv6CidrBlock}
244+
} else {
245+
return []string{cloud.AnyIPv4CidrBlock}
246+
}
247+
}
248+
249+
return s.AWSCluster.Spec.ControlPlaneLoadBalancer.DefaultAllowedSourceCidrs
250+
}
251+
238252
// Bucket returns the cluster bucket configuration.
239253
func (s *ClusterScope) Bucket() *infrav1.S3Bucket {
240254
return s.AWSCluster.Spec.S3Bucket

‎pkg/cloud/scope/managedcontrolplane.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,15 @@ func (s *ManagedControlPlaneScope) NodePortServicesAllowedCidrs() []string {
243243
return []string{cloud.AnyIPv4CidrBlock}
244244
}
245245

246+
// DefaultAllowedAPIServerSources returns the cidr blocks to be used as the default allowed sources in the api server
247+
// security group inbound rule. Defaults to 0.0.0.0/0
248+
func (s *ManagedControlPlaneScope) DefaultAllowedAPIServerSources(ipv6 bool) []string {
249+
if ipv6 {
250+
return []string{cloud.AnyIPv6CidrBlock}
251+
}
252+
return []string{cloud.AnyIPv4CidrBlock}
253+
}
254+
246255
// Name returns the CAPI cluster name.
247256
func (s *ManagedControlPlaneScope) Name() string {
248257
return s.Cluster.Name

‎pkg/cloud/scope/sg.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,4 +63,8 @@ type SGScope interface {
6363
// NodePortServicesAllowedCidrs returns the cidr blocks to be used as the allowed sources in the node port services
6464
// security group rule. Defaults to 0.0.0.0/0
6565
NodePortServicesAllowedCidrs() []string
66+
67+
// DefaultAllowedAPIServerSources returns the cidr blocks to be used as the default allowed sources in the api server
68+
// security group inbound rule. Defaults to 0.0.0.0/0 for IPv4 and the equivalent for IPV6.
69+
DefaultAllowedAPIServerSources(ipv6 bool) []string
6670
}

‎pkg/cloud/services/securitygroup/securitygroups.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -974,7 +974,7 @@ func (s *Service) getIngressRuleToAllowAnyIPInTheAPIServer() infrav1.IngressRule
974974
Protocol: infrav1.SecurityGroupProtocolTCP,
975975
FromPort: int64(s.scope.APIServerPort()),
976976
ToPort: int64(s.scope.APIServerPort()),
977-
IPv6CidrBlocks: []string{cloud.AnyIPv6CidrBlock},
977+
IPv6CidrBlocks: s.scope.DefaultAllowedAPIServerSources(true),
978978
},
979979
}
980980
}
@@ -985,7 +985,7 @@ func (s *Service) getIngressRuleToAllowAnyIPInTheAPIServer() infrav1.IngressRule
985985
Protocol: infrav1.SecurityGroupProtocolTCP,
986986
FromPort: int64(s.scope.APIServerPort()),
987987
ToPort: int64(s.scope.APIServerPort()),
988-
CidrBlocks: []string{cloud.AnyIPv4CidrBlock},
988+
CidrBlocks: s.scope.DefaultAllowedAPIServerSources(false),
989989
},
990990
}
991991
}

0 commit comments

Comments
 (0)