Skip to content

Commit 6a2dfee

Browse files
phuhung273phuhung273
authored
Add --default-load-balancer-scheme command line flag (#3908)
* ingress * service * service test syntax only * ingress model_builder_test * service model_builder_test * refactor param name * rename doc * remove uneeded replace change * rename tests
1 parent 283ebee commit 6a2dfee

9 files changed

+377
-88
lines changed

‎controllers/ingress/group_controller.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ func NewGroupReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorder
5959
annotationParser, subnetsResolver,
6060
authConfigBuilder, enhancedBackendBuilder, trackingProvider, elbv2TaggingManager, controllerConfig.FeatureGates,
6161
cloud.VpcID(), controllerConfig.ClusterName, controllerConfig.DefaultTags, controllerConfig.ExternalManagedTags,
62-
controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, backendSGProvider, sgResolver,
62+
controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, controllerConfig.DefaultLoadBalancerScheme, backendSGProvider, sgResolver,
6363
controllerConfig.EnableBackendSecurityGroup, controllerConfig.DisableRestrictedSGRules, controllerConfig.IngressConfig.AllowedCertificateAuthorityARNs, controllerConfig.FeatureGates.Enabled(config.EnableIPTargetType), logger)
6464
stackMarshaller := deploy.NewDefaultStackMarshaller()
6565
stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler, elbv2TaggingManager,

‎controllers/service/service_controller.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ func NewServiceReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorde
4545
serviceUtils := service.NewServiceUtils(annotationParser, serviceFinalizer, controllerConfig.ServiceConfig.LoadBalancerClass, controllerConfig.FeatureGates)
4646
modelBuilder := service.NewDefaultModelBuilder(annotationParser, subnetsResolver, vpcInfoProvider, cloud.VpcID(), trackingProvider,
4747
elbv2TaggingManager, cloud.EC2(), controllerConfig.FeatureGates, controllerConfig.ClusterName, controllerConfig.DefaultTags, controllerConfig.ExternalManagedTags,
48-
controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, controllerConfig.FeatureGates.Enabled(config.EnableIPTargetType), serviceUtils,
48+
controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, controllerConfig.DefaultLoadBalancerScheme, controllerConfig.FeatureGates.Enabled(config.EnableIPTargetType), serviceUtils,
4949
backendSGProvider, sgResolver, controllerConfig.EnableBackendSecurityGroup, controllerConfig.DisableRestrictedSGRules, logger)
5050
stackMarshaller := deploy.NewDefaultStackMarshaller()
5151
stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler, elbv2TaggingManager, controllerConfig, serviceTagPrefix, logger)

‎docs/deploy/configurations.md

+1
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ Currently, you can set only 1 namespace to watch in this flag. See [this Kuberne
7979
| default-ssl-policy | string | ELBSecurityPolicy-2016-08 | Default SSL Policy that will be applied to all Ingresses or Services that do not have the SSL Policy annotation |
8080
| default-tags | stringMap | | AWS Tags that will be applied to all AWS resources managed by this controller. Specified Tags takes highest priority |
8181
| default-target-type | string | instance | Default target type for Ingresses and Services - ip, instance |
82+
| default-load-balancer-scheme | string | internal | Default scheme for ELBs - internal, internet-facing |
8283
| [disable-ingress-class-annotation](#disable-ingress-class-annotation) | boolean | false | Disable new usage of the `kubernetes.io/ingress.class` annotation |
8384
| [disable-ingress-group-name-annotation](#disable-ingress-group-name-annotation) | boolean | false | Disallow new use of the `alb.ingress.kubernetes.io/group.name` annotation |
8485
| disable-restricted-sg-rules | boolean | false | Disable the usage of restricted security group rules |

‎pkg/config/controller_config.go

+18
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ const (
1717
flagK8sClusterName = "cluster-name"
1818
flagDefaultTags = "default-tags"
1919
flagDefaultTargetType = "default-target-type"
20+
flagDefaultLoadBalancerScheme = "default-load-balancer-scheme"
2021
flagExternalManagedTags = "external-managed-tags"
2122
flagServiceTargetENISGTags = "service-target-eni-security-group-tags"
2223
flagServiceMaxConcurrentReconciles = "service-max-concurrent-reconciles"
@@ -72,6 +73,9 @@ type ControllerConfig struct {
7273
// Default target type for Ingress and Service objects
7374
DefaultTargetType string
7475

76+
// Default scheme for ELB
77+
DefaultLoadBalancerScheme string
78+
7579
// List of Tag keys on AWS resources that will be managed externally.
7680
ExternalManagedTags []string
7781

@@ -114,6 +118,8 @@ func (cfg *ControllerConfig) BindFlags(fs *pflag.FlagSet) {
114118
"Default AWS Tags that will be applied to all AWS resources managed by this controller")
115119
fs.StringVar(&cfg.DefaultTargetType, flagDefaultTargetType, string(elbv2.TargetTypeInstance),
116120
"Default target type for Ingresses and Services - ip, instance")
121+
fs.StringVar(&cfg.DefaultLoadBalancerScheme, flagDefaultLoadBalancerScheme, string(elbv2.LoadBalancerSchemeInternal),
122+
"Default scheme for ELBs")
117123
fs.StringSliceVar(&cfg.ExternalManagedTags, flagExternalManagedTags, nil,
118124
"List of Tag keys on AWS resources that will be managed externally")
119125
fs.IntVar(&cfg.ServiceMaxConcurrentReconciles, flagServiceMaxConcurrentReconciles, defaultMaxConcurrentReconciles,
@@ -162,6 +168,9 @@ func (cfg *ControllerConfig) Validate() error {
162168
if err := cfg.validateDefaultTargetType(); err != nil {
163169
return err
164170
}
171+
if err := cfg.validateDefaultLoadBalancerScheme(); err != nil {
172+
return err
173+
}
165174
if err := cfg.validateBackendSecurityGroupConfiguration(); err != nil {
166175
return err
167176
}
@@ -205,6 +214,15 @@ func (cfg *ControllerConfig) validateDefaultTargetType() error {
205214
}
206215
}
207216

217+
func (cfg *ControllerConfig) validateDefaultLoadBalancerScheme() error {
218+
switch cfg.DefaultLoadBalancerScheme {
219+
case string(elbv2.LoadBalancerSchemeInternal), string(elbv2.LoadBalancerSchemeInternetFacing):
220+
return nil
221+
default:
222+
return errors.Errorf("invalid value %v for default scheme", cfg.DefaultLoadBalancerScheme)
223+
}
224+
}
225+
208226
func (cfg *ControllerConfig) validateBackendSecurityGroupConfiguration() error {
209227
if len(cfg.BackendSecurityGroup) == 0 {
210228
return nil

‎pkg/ingress/model_builder.go

+47-45
Original file line numberDiff line numberDiff line change
@@ -42,37 +42,38 @@ func NewDefaultModelBuilder(k8sClient client.Client, eventRecorder record.EventR
4242
annotationParser annotations.Parser, subnetsResolver networkingpkg.SubnetsResolver,
4343
authConfigBuilder AuthConfigBuilder, enhancedBackendBuilder EnhancedBackendBuilder,
4444
trackingProvider tracking.Provider, elbv2TaggingManager elbv2deploy.TaggingManager, featureGates config.FeatureGates,
45-
vpcID string, clusterName string, defaultTags map[string]string, externalManagedTags []string, defaultSSLPolicy string, defaultTargetType string,
45+
vpcID string, clusterName string, defaultTags map[string]string, externalManagedTags []string, defaultSSLPolicy string, defaultTargetType string, defaultLoadBalancerScheme string,
4646
backendSGProvider networkingpkg.BackendSGProvider, sgResolver networkingpkg.SecurityGroupResolver,
4747
enableBackendSG bool, disableRestrictedSGRules bool, allowedCAARNs []string, enableIPTargetType bool, logger logr.Logger) *defaultModelBuilder {
4848
certDiscovery := NewACMCertDiscovery(acmClient, allowedCAARNs, logger)
4949
ruleOptimizer := NewDefaultRuleOptimizer(logger)
5050
return &defaultModelBuilder{
51-
k8sClient: k8sClient,
52-
eventRecorder: eventRecorder,
53-
ec2Client: ec2Client,
54-
elbv2Client: elbv2Client,
55-
vpcID: vpcID,
56-
clusterName: clusterName,
57-
annotationParser: annotationParser,
58-
subnetsResolver: subnetsResolver,
59-
backendSGProvider: backendSGProvider,
60-
sgResolver: sgResolver,
61-
certDiscovery: certDiscovery,
62-
authConfigBuilder: authConfigBuilder,
63-
enhancedBackendBuilder: enhancedBackendBuilder,
64-
ruleOptimizer: ruleOptimizer,
65-
trackingProvider: trackingProvider,
66-
elbv2TaggingManager: elbv2TaggingManager,
67-
featureGates: featureGates,
68-
defaultTags: defaultTags,
69-
externalManagedTags: sets.NewString(externalManagedTags...),
70-
defaultSSLPolicy: defaultSSLPolicy,
71-
defaultTargetType: elbv2model.TargetType(defaultTargetType),
72-
enableBackendSG: enableBackendSG,
73-
disableRestrictedSGRules: disableRestrictedSGRules,
74-
enableIPTargetType: enableIPTargetType,
75-
logger: logger,
51+
k8sClient: k8sClient,
52+
eventRecorder: eventRecorder,
53+
ec2Client: ec2Client,
54+
elbv2Client: elbv2Client,
55+
vpcID: vpcID,
56+
clusterName: clusterName,
57+
annotationParser: annotationParser,
58+
subnetsResolver: subnetsResolver,
59+
backendSGProvider: backendSGProvider,
60+
sgResolver: sgResolver,
61+
certDiscovery: certDiscovery,
62+
authConfigBuilder: authConfigBuilder,
63+
enhancedBackendBuilder: enhancedBackendBuilder,
64+
ruleOptimizer: ruleOptimizer,
65+
trackingProvider: trackingProvider,
66+
elbv2TaggingManager: elbv2TaggingManager,
67+
featureGates: featureGates,
68+
defaultTags: defaultTags,
69+
externalManagedTags: sets.NewString(externalManagedTags...),
70+
defaultSSLPolicy: defaultSSLPolicy,
71+
defaultTargetType: elbv2model.TargetType(defaultTargetType),
72+
defaultLoadBalancerScheme: elbv2model.LoadBalancerScheme(defaultLoadBalancerScheme),
73+
enableBackendSG: enableBackendSG,
74+
disableRestrictedSGRules: disableRestrictedSGRules,
75+
enableIPTargetType: enableIPTargetType,
76+
logger: logger,
7677
}
7778
}
7879

@@ -88,24 +89,25 @@ type defaultModelBuilder struct {
8889
vpcID string
8990
clusterName string
9091

91-
annotationParser annotations.Parser
92-
subnetsResolver networkingpkg.SubnetsResolver
93-
backendSGProvider networkingpkg.BackendSGProvider
94-
sgResolver networkingpkg.SecurityGroupResolver
95-
certDiscovery CertDiscovery
96-
authConfigBuilder AuthConfigBuilder
97-
enhancedBackendBuilder EnhancedBackendBuilder
98-
ruleOptimizer RuleOptimizer
99-
trackingProvider tracking.Provider
100-
elbv2TaggingManager elbv2deploy.TaggingManager
101-
featureGates config.FeatureGates
102-
defaultTags map[string]string
103-
externalManagedTags sets.String
104-
defaultSSLPolicy string
105-
defaultTargetType elbv2model.TargetType
106-
enableBackendSG bool
107-
disableRestrictedSGRules bool
108-
enableIPTargetType bool
92+
annotationParser annotations.Parser
93+
subnetsResolver networkingpkg.SubnetsResolver
94+
backendSGProvider networkingpkg.BackendSGProvider
95+
sgResolver networkingpkg.SecurityGroupResolver
96+
certDiscovery CertDiscovery
97+
authConfigBuilder AuthConfigBuilder
98+
enhancedBackendBuilder EnhancedBackendBuilder
99+
ruleOptimizer RuleOptimizer
100+
trackingProvider tracking.Provider
101+
elbv2TaggingManager elbv2deploy.TaggingManager
102+
featureGates config.FeatureGates
103+
defaultTags map[string]string
104+
externalManagedTags sets.String
105+
defaultSSLPolicy string
106+
defaultTargetType elbv2model.TargetType
107+
defaultLoadBalancerScheme elbv2model.LoadBalancerScheme
108+
enableBackendSG bool
109+
disableRestrictedSGRules bool
110+
enableIPTargetType bool
109111

110112
logger logr.Logger
111113
}
@@ -142,7 +144,7 @@ func (b *defaultModelBuilder) Build(ctx context.Context, ingGroup Group) (core.S
142144
defaultTags: b.defaultTags,
143145
externalManagedTags: b.externalManagedTags,
144146
defaultIPAddressType: elbv2model.IPAddressTypeIPV4,
145-
defaultScheme: elbv2model.LoadBalancerSchemeInternal,
147+
defaultScheme: b.defaultLoadBalancerScheme,
146148
defaultSSLPolicy: b.defaultSSLPolicy,
147149
defaultTargetType: b.defaultTargetType,
148150
defaultBackendProtocol: elbv2model.ProtocolHTTP,

‎pkg/ingress/model_builder_test.go

+118-10
Original file line numberDiff line numberDiff line change
@@ -605,14 +605,15 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
605605
}
606606

607607
tests := []struct {
608-
name string
609-
env env
610-
defaultTargetType string
611-
enableIPTargetType *bool
612-
args args
613-
fields fields
614-
wantStackPatch string
615-
wantErr string
608+
name string
609+
env env
610+
defaultTargetType string
611+
defaultLoadBalancerScheme string
612+
enableIPTargetType *bool
613+
args args
614+
fields fields
615+
wantStackPatch string
616+
wantErr string
616617
}{
617618
{
618619
name: "Ingress - vanilla internal",
@@ -3628,6 +3629,108 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
36283629
}
36293630
}
36303631
}
3632+
}`,
3633+
},
3634+
{
3635+
name: "Ingress - vanilla with default-load-balancer-scheme internet-facing",
3636+
env: env{
3637+
svcs: []*corev1.Service{ns_1_svc_1, ns_1_svc_2, ns_1_svc_3},
3638+
},
3639+
fields: fields{
3640+
resolveViaDiscoveryCalls: []resolveViaDiscoveryCall{resolveViaDiscoveryCallForInternetFacingLB},
3641+
listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB},
3642+
enableBackendSG: true,
3643+
},
3644+
defaultLoadBalancerScheme: string(elbv2model.LoadBalancerSchemeInternetFacing),
3645+
args: args{
3646+
ingGroup: Group{
3647+
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
3648+
Members: []ClassifiedIngress{
3649+
{
3650+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
3651+
Namespace: "ns-1",
3652+
Name: "ing-1",
3653+
},
3654+
Spec: networking.IngressSpec{
3655+
Rules: []networking.IngressRule{
3656+
{
3657+
Host: "app-1.example.com",
3658+
IngressRuleValue: networking.IngressRuleValue{
3659+
HTTP: &networking.HTTPIngressRuleValue{
3660+
Paths: []networking.HTTPIngressPath{
3661+
{
3662+
Path: "/svc-1",
3663+
Backend: networking.IngressBackend{
3664+
Service: &networking.IngressServiceBackend{
3665+
Name: ns_1_svc_1.Name,
3666+
Port: networking.ServiceBackendPort{
3667+
Name: "http",
3668+
},
3669+
},
3670+
},
3671+
},
3672+
{
3673+
Path: "/svc-2",
3674+
Backend: networking.IngressBackend{
3675+
Service: &networking.IngressServiceBackend{
3676+
Name: ns_1_svc_2.Name,
3677+
Port: networking.ServiceBackendPort{
3678+
Name: "http",
3679+
},
3680+
},
3681+
},
3682+
},
3683+
},
3684+
},
3685+
},
3686+
},
3687+
{
3688+
Host: "app-2.example.com",
3689+
IngressRuleValue: networking.IngressRuleValue{
3690+
HTTP: &networking.HTTPIngressRuleValue{
3691+
Paths: []networking.HTTPIngressPath{
3692+
{
3693+
Path: "/svc-3",
3694+
Backend: networking.IngressBackend{
3695+
Service: &networking.IngressServiceBackend{
3696+
Name: ns_1_svc_3.Name,
3697+
Port: networking.ServiceBackendPort{
3698+
Name: "https",
3699+
},
3700+
},
3701+
},
3702+
},
3703+
},
3704+
},
3705+
},
3706+
},
3707+
},
3708+
},
3709+
},
3710+
},
3711+
},
3712+
},
3713+
},
3714+
wantStackPatch: `
3715+
{
3716+
"resources": {
3717+
"AWS::ElasticLoadBalancingV2::LoadBalancer": {
3718+
"LoadBalancer": {
3719+
"spec": {
3720+
"name": "k8s-ns1-ing1-159dd7a143",
3721+
"scheme": "internet-facing",
3722+
"subnetMapping": [
3723+
{
3724+
"subnetID": "subnet-c"
3725+
},
3726+
{
3727+
"subnetID": "subnet-d"
3728+
}
3729+
]
3730+
}
3731+
}
3732+
}
3733+
}
36313734
}`,
36323735
},
36333736
}
@@ -3681,6 +3784,10 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
36813784
if defaultTargetType == "" {
36823785
defaultTargetType = "instance"
36833786
}
3787+
defaultLoadBalancerScheme := tt.defaultLoadBalancerScheme
3788+
if defaultLoadBalancerScheme == "" {
3789+
defaultLoadBalancerScheme = string(elbv2model.LoadBalancerSchemeInternal)
3790+
}
36843791

36853792
b := &defaultModelBuilder{
36863793
k8sClient: k8sClient,
@@ -3703,8 +3810,9 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
37033810
featureGates: config.NewFeatureGates(),
37043811
logger: logr.New(&log.NullLogSink{}),
37053812

3706-
defaultSSLPolicy: "ELBSecurityPolicy-2016-08",
3707-
defaultTargetType: elbv2model.TargetType(defaultTargetType),
3813+
defaultSSLPolicy: "ELBSecurityPolicy-2016-08",
3814+
defaultTargetType: elbv2model.TargetType(defaultTargetType),
3815+
defaultLoadBalancerScheme: elbv2model.LoadBalancerScheme(defaultLoadBalancerScheme),
37083816
}
37093817

37103818
if tt.enableIPTargetType == nil {

‎pkg/service/model_build_load_balancer.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,7 @@ func (t *defaultModelBuildTask) buildLoadBalancerScheme(ctx context.Context) (el
245245
return "", errors.New("invalid load balancer scheme")
246246
}
247247
}
248-
return elbv2model.LoadBalancerSchemeInternal, nil
248+
return t.defaultLoadBalancerScheme, nil
249249
}
250250

251251
func (t *defaultModelBuildTask) buildLoadBalancerSchemeViaAnnotation(ctx context.Context) (elbv2model.LoadBalancerScheme, bool, error) {

0 commit comments

Comments
 (0)