Skip to content

WIP:✨ feat: all disabling the allow all sources for some security groups #5087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
+206 −65
Open

WIP:✨ feat: all disabling the allow all sources for some security groups #5087

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ab3a129
wip: replacing ALL sources
richardcase Aug 6, 2024
eaf61bb
wip: replacing ALL sources
richardcase Aug 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions api/v1beta1/awscluster_conversion.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,10 @@ func (src *AWSCluster) ConvertTo(dstRaw conversion.Hub) error {
}
}

// if len(restored.Spec.NetworkSpec.NodePortServicesAllowedCidrs) > 0 {
// dst.Spec.NetworkSpec.NodePortServicesAllowedCidrs = restored.Spec.NetworkSpec.NodePortServicesAllowedCidrs
// }

// Restore SubnetSpec.ResourceID, SubnetSpec.ParentZoneName, and SubnetSpec.ZoneType fields, if any.
for _, subnet := range restored.Spec.NetworkSpec.Subnets {
for i, dstSubnet := range dst.Spec.NetworkSpec.Subnets {
Expand Down
1 change: 1 addition & 0 deletions api/v1beta1/zz_generated.conversion.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions api/v1beta2/awscluster_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,6 +252,12 @@ type AWSLoadBalancerSpec struct {
// PreserveClientIP lets the user control if preservation of client ips must be retained or not.
// If this is enabled 6443 will be opened to 0.0.0.0/0.
PreserveClientIP bool `json:"preserveClientIP,omitempty"`

// DefaultAllowedSourceCidrs is a list of allowed cidr blocks to allow as the source in the inbound rules for
// the api server security group. If not supplied then it defaults to 0.0.0.0/0 for an IPv4 vpc or ::/o for
// a IPv6 vpc. This is ignored if IngressRules are explicitly supplied.
// +optional
DefaultAllowedSourceCidrs []string `json:"defaultAllowedSourceCidrs,omitempty"`
}

// AdditionalListenerSpec defines the desired state of an
Expand Down
16 changes: 16 additions & 0 deletions api/v1beta2/awscluster_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,6 +298,22 @@ func (r *AWSCluster) validateNetwork() field.ErrorList {
}
}

// if len(r.Spec.NetworkSpec.NodePortServicesAllowedCidrs) > 0 {
// sourceCidrsField := field.NewPath("spec", "network", "vpc", "nodePortServicesAllowedCidrs")
// _, ok := r.Spec.NetworkSpec.SecurityGroupOverrides[SecurityGroupNode]
// if ok {
// allErrs = append(allErrs, field.Invalid(sourceCidrsField, r.Spec.NetworkSpec.NodePortServicesAllowedCidrs, fmt.Sprintf("awscluster.spec.network.nodePortServicesAllowedCidrs cannot be supplied when using a %s security group override", SecurityGroupNode)))
// }

// for i, cidr := range r.Spec.NetworkSpec.NodePortServicesAllowedCidrs {
// if _, _, err := net.ParseCIDR(cidr); err != nil {
// allErrs = append(allErrs,
// field.Invalid(field.NewPath("spec", "network", "vpc", fmt.Sprintf("nodePortServicesAllowedCidrs[%d]", i)), cidr, "must be a valid CIDR block"),
// )
// }
// }
// }

return allErrs
}

Expand Down
2 changes: 1 addition & 1 deletion api/v1beta2/awscluster_webhook_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -699,7 +699,7 @@ func TestAWSClusterValidateCreate(t *testing.T) {
}

func TestAWSClusterValidateUpdate(t *testing.T) {
var tests = []struct {
tests := []struct {
name string
oldCluster *AWSCluster
newCluster *AWSCluster
Expand Down
6 changes: 2 additions & 4 deletions api/v1beta2/network_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,10 +204,8 @@ type TargetGroupHealthCheckAdditionalSpec struct {
// TargetGroupAttribute defines attribute key values for V2 Load Balancer Attributes.
type TargetGroupAttribute string

var (
// TargetGroupAttributeEnablePreserveClientIP defines the attribute key for enabling preserve client IP.
TargetGroupAttributeEnablePreserveClientIP = "preserve_client_ip.enabled"
)
// TargetGroupAttributeEnablePreserveClientIP defines the attribute key for enabling preserve client IP.
var TargetGroupAttributeEnablePreserveClientIP = "preserve_client_ip.enabled"

// LoadBalancerAttribute defines a set of attributes for a V2 load balancer.
type LoadBalancerAttribute string
Expand Down
5 changes: 5 additions & 0 deletions api/v1beta2/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 16 additions & 0 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1079,6 +1079,14 @@ spec:

Defaults to false.
type: boolean
defaultAllowedSourceCidrs:
description: |-
DefaultAllowedSourceCidrs is a list of allowed cidr blocks to allow as the source in the inbound rules for
the api server security group. If not supplied then it defaults to 0.0.0.0/0 for an IPv4 vpc or ::/o for
a IPv6 vpc. This is ignored if IngressRules are explicitly supplied.
items:
type: string
type: array
disableHostsRewrite:
description: |-
DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts
Expand Down Expand Up @@ -1886,6 +1894,14 @@ spec:

Defaults to false.
type: boolean
defaultAllowedSourceCidrs:
description: |-
DefaultAllowedSourceCidrs is a list of allowed cidr blocks to allow as the source in the inbound rules for
the api server security group. If not supplied then it defaults to 0.0.0.0/0 for an IPv4 vpc or ::/o for
a IPv6 vpc. This is ignored if IngressRules are explicitly supplied.
items:
type: string
type: array
disableHostsRewrite:
description: |-
DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts
Expand Down
16 changes: 16 additions & 0 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -671,6 +671,14 @@ spec:

Defaults to false.
type: boolean
defaultAllowedSourceCidrs:
description: |-
DefaultAllowedSourceCidrs is a list of allowed cidr blocks to allow as the source in the inbound rules for
the api server security group. If not supplied then it defaults to 0.0.0.0/0 for an IPv4 vpc or ::/o for
a IPv6 vpc. This is ignored if IngressRules are explicitly supplied.
items:
type: string
type: array
disableHostsRewrite:
description: |-
DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts
Expand Down Expand Up @@ -1487,6 +1495,14 @@ spec:

Defaults to false.
type: boolean
defaultAllowedSourceCidrs:
description: |-
DefaultAllowedSourceCidrs is a list of allowed cidr blocks to allow as the source in the inbound rules for
the api server security group. If not supplied then it defaults to 0.0.0.0/0 for an IPv4 vpc or ::/o for
a IPv6 vpc. This is ignored if IngressRules are explicitly supplied.
items:
type: string
type: array
disableHostsRewrite:
description: |-
DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts
Expand Down
22 changes: 20 additions & 2 deletions controlplane/eks/api/v1beta2/awsmanagedcontrolplane_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,8 +63,10 @@ func (r *AWSManagedControlPlane) SetupWebhookWithManager(mgr ctrl.Manager) error
// +kubebuilder:webhook:verbs=create;update,path=/validate-controlplane-cluster-x-k8s-io-v1beta2-awsmanagedcontrolplane,mutating=false,failurePolicy=fail,matchPolicy=Equivalent,groups=controlplane.cluster.x-k8s.io,resources=awsmanagedcontrolplanes,versions=v1beta2,name=validation.awsmanagedcontrolplanes.controlplane.cluster.x-k8s.io,sideEffects=None,admissionReviewVersions=v1;v1beta1
// +kubebuilder:webhook:verbs=create;update,path=/mutate-controlplane-cluster-x-k8s-io-v1beta2-awsmanagedcontrolplane,mutating=true,failurePolicy=fail,matchPolicy=Equivalent,groups=controlplane.cluster.x-k8s.io,resources=awsmanagedcontrolplanes,versions=v1beta2,name=default.awsmanagedcontrolplanes.controlplane.cluster.x-k8s.io,sideEffects=None,admissionReviewVersions=v1;v1beta1

var _ webhook.Defaulter = &AWSManagedControlPlane{}
var _ webhook.Validator = &AWSManagedControlPlane{}
var (
_ webhook.Defaulter = &AWSManagedControlPlane{}
_ webhook.Validator = &AWSManagedControlPlane{}
)

func parseEKSVersion(raw string) (*version.Version, error) {
v, err := version.ParseGeneric(raw)
Expand Down Expand Up @@ -474,6 +476,22 @@ func (r *AWSManagedControlPlane) validateNetwork() field.ErrorList {
allErrs = append(allErrs, field.Invalid(ipamPoolField, r.Spec.NetworkSpec.VPC.IPv6.IPAMPool, "ipamPool must have either id or name"))
}

// if len(r.Spec.NetworkSpec.NodePortServicesAllowedCidrs) > 0 {
// sourceCidrsField := field.NewPath("spec", "network", "vpc", "nodePortServicesAllowedCidrs")
// _, ok := r.Spec.NetworkSpec.SecurityGroupOverrides[infrav1.SecurityGroupNode]
// if ok {
// allErrs = append(allErrs, field.Invalid(sourceCidrsField, r.Spec.NetworkSpec.NodePortServicesAllowedCidrs, fmt.Sprintf("awscluster.spec.network.nodePortServicesAllowedCidrs cannot be supplied when using a %s security group override", infrav1.SecurityGroupNode)))
// }

// for i, cidr := range r.Spec.NetworkSpec.NodePortServicesAllowedCidrs {
// if _, _, err := net.ParseCIDR(cidr); err != nil {
// allErrs = append(allErrs,
// field.Invalid(field.NewPath("spec", "network", "vpc", fmt.Sprintf("nodePortServicesAllowedCidrs[%d]", i)), cidr, "must be a valid CIDR block"),
// )
// }
// }
// }

return allErrs
}

Expand Down
26 changes: 26 additions & 0 deletions pkg/cloud/defaults.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
/*
Copyright 2024 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package cloud

const (
// TemporaryResourceID is the name used temporarily when creating AWS resources.
TemporaryResourceID = "temporary-resource-id"
// AnyIPv4CidrBlock is the CIDR block to match all IPv4 addresses.
AnyIPv4CidrBlock = "0.0.0.0/0"
// AnyIPv6CidrBlock is the CIDR block to match all IPv6 addresses.
AnyIPv6CidrBlock = "::/0"
)
24 changes: 24 additions & 0 deletions pkg/cloud/scope/cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,30 @@
return s.AWSCluster.Spec.ControlPlaneEndpoint
}

// // NodePortServicesAllowedCidrs returns the cidr blocks to be used as the allowed sources in the node port services
// // security group rule. Defaults to 0.0.0.0/0.
// func (s *ClusterScope) NodePortServicesAllowedCidrs() []string {
// if len(s.AWSCluster.Spec.NetworkSpec.NodePortServicesAllowedCidrs) > 0 {
// return s.AWSCluster.Spec.NetworkSpec.NodePortServicesAllowedCidrs
// }

// return []string{cloud.AnyIPv4CidrBlock}
// }

Check failure on line 236 in pkg/cloud/scope/cluster.go

View workflow job for this annotation

GitHub Actions / lint 

Comment should end in a period (godot)

// DefaultAllowedAPIServerSources returns the cidr blocks to be used as the default allowed sources in the api server
// security group inbound rule. Defaults to 0.0.0.0/0 or ::/0

Check failure on line 239 in pkg/cloud/scope/cluster.go

View workflow job for this annotation

GitHub Actions / lint 

Comment should end in a period (godot)
func (s *ClusterScope) DefaultAllowedAPIServerSources(ipv6 bool) []string {
if s.AWSCluster.Spec.ControlPlaneLoadBalancer == nil || len(s.AWSCluster.Spec.ControlPlaneLoadBalancer.DefaultAllowedSourceCidrs) == 0 {
if ipv6 {
return []string{cloud.AnyIPv6CidrBlock}
} else {

Check failure on line 244 in pkg/cloud/scope/cluster.go

View workflow job for this annotation

GitHub Actions / lint 

indent-error-flow: if block ends with a return statement, so drop this else and outdent its block (revive)
return []string{cloud.AnyIPv4CidrBlock}
}
}

return s.AWSCluster.Spec.ControlPlaneLoadBalancer.DefaultAllowedSourceCidrs
}

// Bucket returns the cluster bucket configuration.
func (s *ClusterScope) Bucket() *infrav1.S3Bucket {
return s.AWSCluster.Spec.S3Bucket
Expand Down
23 changes: 20 additions & 3 deletions pkg/cloud/scope/managedcontrolplane.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,9 +43,7 @@
"sigs.k8s.io/cluster-api/util/patch"
)

var (
scheme = runtime.NewScheme()
)
var scheme = runtime.NewScheme()

func init() {
_ = amazoncni.AddToScheme(scheme)
Expand Down Expand Up @@ -235,6 +233,25 @@
return s.ControlPlane.Spec.NetworkSpec.SecurityGroupOverrides
}

// // NodePortServicesAllowedCidrs returns the cidr blocks to be used as the allowed sources in the node port services
// // security group rule. Defaults to 0.0.0.0/0.
// func (s *ManagedControlPlaneScope) NodePortServicesAllowedCidrs() []string {
// if len(s.ControlPlane.Spec.NetworkSpec.NodePortServicesAllowedCidrs) > 0 {
// return s.ControlPlane.Spec.NetworkSpec.NodePortServicesAllowedCidrs
// }

// return []string{cloud.AnyIPv4CidrBlock}
// }

Check failure on line 244 in pkg/cloud/scope/managedcontrolplane.go

View workflow job for this annotation

GitHub Actions / lint 

Comment should end in a period (godot)

// DefaultAllowedAPIServerSources returns the cidr blocks to be used as the default allowed sources in the api server
// security group inbound rule. Defaults to 0.0.0.0/0

Check failure on line 247 in pkg/cloud/scope/managedcontrolplane.go

View workflow job for this annotation

GitHub Actions / lint 

Comment should end in a period (godot)
func (s *ManagedControlPlaneScope) DefaultAllowedAPIServerSources(ipv6 bool) []string {
if ipv6 {
return []string{cloud.AnyIPv6CidrBlock}
}
return []string{cloud.AnyIPv4CidrBlock}
}

// Name returns the CAPI cluster name.
func (s *ManagedControlPlaneScope) Name() string {
return s.Cluster.Name
Expand Down
4 changes: 4 additions & 0 deletions pkg/cloud/scope/sg.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,4 +62,8 @@ type SGScope interface {

// NodePortIngressRuleCidrBlocks returns the CIDR blocks for the node NodePort ingress rules.
NodePortIngressRuleCidrBlocks() []string

// DefaultAllowedAPIServerSources returns the cidr blocks to be used as the default allowed sources in the api server
// security group inbound rule. Defaults to 0.0.0.0/0 for IPv4 and the equivalent for IPV6.
DefaultAllowedAPIServerSources(ipv6 bool) []string
}
9 changes: 0 additions & 9 deletions pkg/cloud/services/interfaces.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,15 +27,6 @@ import (
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/scope"
)

const (
// TemporaryResourceID is the name used temporarily when creating AWS resources.
TemporaryResourceID = "temporary-resource-id"
// AnyIPv4CidrBlock is the CIDR block to match all IPv4 addresses.
AnyIPv4CidrBlock = "0.0.0.0/0"
// AnyIPv6CidrBlock is the CIDR block to match all IPv6 addresses.
AnyIPv6CidrBlock = "::/0"
)

// ASGInterface encapsulates the methods exposed to the machinepool
// actuator.
type ASGInterface interface {
Expand Down
4 changes: 2 additions & 2 deletions pkg/cloud/services/network/carriergateways.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,10 @@ import (
"github.com/pkg/errors"

infrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/awserrors"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/converters"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/filter"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/wait"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/tags"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/record"
Expand Down Expand Up @@ -113,7 +113,7 @@ func (s *Service) createCarrierGateway() (*ec2.CarrierGateway, error) {
ig, err := s.EC2Client.CreateCarrierGatewayWithContext(context.TODO(), &ec2.CreateCarrierGatewayInput{
VpcId: aws.String(s.scope.VPC().ID),
TagSpecifications: []*ec2.TagSpecification{
tags.BuildParamsToTagSpecification(ec2.ResourceTypeCarrierGateway, s.getGatewayTagParams(services.TemporaryResourceID)),
tags.BuildParamsToTagSpecification(ec2.ResourceTypeCarrierGateway, s.getGatewayTagParams(cloud.TemporaryResourceID)),
},
})
if err != nil {
Expand Down
4 changes: 2 additions & 2 deletions pkg/cloud/services/network/egress_only_gateways.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,10 @@ import (
"github.com/pkg/errors"

infrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/awserrors"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/converters"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/filter"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/wait"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/tags"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/record"
Expand Down Expand Up @@ -120,7 +120,7 @@ func (s *Service) deleteEgressOnlyInternetGateways() error {
func (s *Service) createEgressOnlyInternetGateway() (*ec2.EgressOnlyInternetGateway, error) {
ig, err := s.EC2Client.CreateEgressOnlyInternetGatewayWithContext(context.TODO(), &ec2.CreateEgressOnlyInternetGatewayInput{
TagSpecifications: []*ec2.TagSpecification{
tags.BuildParamsToTagSpecification(ec2.ResourceTypeEgressOnlyInternetGateway, s.getEgressOnlyGatewayTagParams(services.TemporaryResourceID)),
tags.BuildParamsToTagSpecification(ec2.ResourceTypeEgressOnlyInternetGateway, s.getEgressOnlyGatewayTagParams(cloud.TemporaryResourceID)),
},
VpcId: aws.String(s.scope.VPC().ID),
})
Expand Down
4 changes: 2 additions & 2 deletions pkg/cloud/services/network/gateways.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,10 @@ import (
"github.com/pkg/errors"

infrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/awserrors"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/converters"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/filter"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/wait"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/tags"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/record"
Expand Down Expand Up @@ -123,7 +123,7 @@ func (s *Service) deleteInternetGateways() error {
func (s *Service) createInternetGateway() (*ec2.InternetGateway, error) {
ig, err := s.EC2Client.CreateInternetGatewayWithContext(context.TODO(), &ec2.CreateInternetGatewayInput{
TagSpecifications: []*ec2.TagSpecification{
tags.BuildParamsToTagSpecification(ec2.ResourceTypeInternetGateway, s.getGatewayTagParams(services.TemporaryResourceID)),
tags.BuildParamsToTagSpecification(ec2.ResourceTypeInternetGateway, s.getGatewayTagParams(cloud.TemporaryResourceID)),
},
})
if err != nil {
Expand Down
4 changes: 2 additions & 2 deletions pkg/cloud/services/network/natgateways.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,10 @@ import (
kerrors "k8s.io/apimachinery/pkg/util/errors"

infrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/awserrors"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/converters"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/filter"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/wait"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/tags"
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/record"
Expand Down Expand Up @@ -271,7 +271,7 @@ func (s *Service) createNatGateway(subnetID, ip string) (*ec2.NatGateway, error)
if out, err = s.EC2Client.CreateNatGatewayWithContext(context.TODO(), &ec2.CreateNatGatewayInput{
SubnetId: aws.String(subnetID),
AllocationId: aws.String(ip),
TagSpecifications: []*ec2.TagSpecification{tags.BuildParamsToTagSpecification(ec2.ResourceTypeNatgateway, s.getNatGatewayTagParams(services.TemporaryResourceID))},
TagSpecifications: []*ec2.TagSpecification{tags.BuildParamsToTagSpecification(ec2.ResourceTypeNatgateway, s.getNatGatewayTagParams(cloud.TemporaryResourceID))},
}); err != nil {
return false, err
}
Expand Down
Loading
Loading