Skip to content

Commit 879e715

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #3860 from gdlx/feature/prefix-list-param
Add PrefixListsIDs field to IngressClassParams
2 parents ab69d95 + b253f20 commit 879e715

File tree

6 files changed

+160
-2
lines changed

6 files changed

+160
-2
lines changed

‎apis/elbv2/v1beta1/ingressclassparams_types.go

+3
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,9 @@ type IngressClassParamsSpec struct {
167167
// IPAMConfiguration defines the IPAM settings for a Load Balancer.
168168
// +optional
169169
IPAMConfiguration *IPAMConfiguration `json:"ipamConfiguration,omitempty"`
170+
171+
// PrefixListsIDs defines the security group prefix lists for all Ingresses that belong to IngressClass with this IngressClassParams.
172+
PrefixListsIDs []string `json:"PrefixListsIDs,omitempty"`
170173
}
171174

172175
// +kubebuilder:object:root=true

‎apis/elbv2/v1beta1/zz_generated.deepcopy.go

+5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,12 @@ spec:
5555
spec:
5656
description: IngressClassParamsSpec defines the desired state of IngressClassParams
5757
properties:
58+
PrefixListsIDs:
59+
description: PrefixListsIDs defines the security group prefix lists
60+
for all Ingresses that belong to IngressClass with this IngressClassParams.
61+
items:
62+
type: string
63+
type: array
5864
certificateArn:
5965
description: CertificateArn specifies the ARN of the certificates
6066
for all Ingresses that belong to IngressClass with this IngressClassParams.

‎docs/guide/ingress/ingress_class.md

+9
Original file line numberDiff line numberDiff line change
@@ -258,3 +258,12 @@ If `capacityUnits` is specified, it must be to valid positive value greater than
258258
The IPAM pool you choose will be the preferred source of public IPv4 addresses.
259259
If the pool is depleted, IPv4 addresses will be assigned by AWS.
260260
To remove the IPAM pool from your ALB, remove `spec.ipv4IPAMPoolId` from the IngressClass definition.
261+
262+
#### spec.prefixListIDs
263+
264+
`prefixListIDs` is an optional setting.
265+
266+
Cluster administrators can use `prefixListIDs` field to specify the managed prefix lists that are allowed to access the load balancers that belong to this IngressClass. You can specify the list of prefix list IDs in the `spec.prefixListIDs` field.
267+
268+
1. If `prefixListIDs` is set, the prefix lists defined will be applied to the load balancer that belong to this IngressClass. If you specify invalid prefix list IDs, the controller will fail to reconcile ingresses belonging to the particular ingress class.
269+
2. If `prefixListIDs` un-specified, Ingresses with this IngressClass can continue to use `alb.ingress.kubernetes.io/security-group-prefix-lists` annotation to specify the load balancer prefix lists.

‎pkg/ingress/model_build_listener.go

+11-2
Original file line numberDiff line numberDiff line change
@@ -127,8 +127,7 @@ type listenPortConfig struct {
127127
func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context.Context, ing *ClassifiedIngress) (map[int32]listenPortConfig, error) {
128128
explicitTLSCertARNs := t.computeIngressExplicitTLSCertARNs(ctx, ing)
129129
explicitSSLPolicy := t.computeIngressExplicitSSLPolicy(ctx, ing)
130-
var prefixListIDs []string
131-
t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixSecurityGroupPrefixLists, &prefixListIDs, ing.Ing.Annotations)
130+
prefixListIDs := t.computeIngressExplicitPrefixListIDs(ctx, ing)
132131
inboundCIDRv4s, inboundCIDRV6s, err := t.computeIngressExplicitInboundCIDRs(ctx, ing)
133132
if err != nil {
134133
return nil, err
@@ -279,6 +278,16 @@ func (t *defaultModelBuildTask) computeIngressExplicitSSLPolicy(_ context.Contex
279278
return &rawSSLPolicy
280279
}
281280

281+
func (t *defaultModelBuildTask) computeIngressExplicitPrefixListIDs(_ context.Context, ing *ClassifiedIngress) []string {
282+
if ing.IngClassConfig.IngClassParams != nil && len(ing.IngClassConfig.IngClassParams.Spec.PrefixListsIDs) != 0 {
283+
return ing.IngClassConfig.IngClassParams.Spec.PrefixListsIDs
284+
}
285+
var prefixListIDs []string
286+
t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixSecurityGroupPrefixLists, &prefixListIDs, ing.Ing.Annotations)
287+
288+
return prefixListIDs
289+
}
290+
282291
type MutualAuthenticationConfig struct {
283292
Port int32 `json:"port"`
284293
Mode string `json:"mode"`

‎pkg/ingress/model_builder_test.go

+126
Original file line numberDiff line numberDiff line change
@@ -3396,6 +3396,132 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
33963396
}
33973397
}
33983398
}
3399+
}`,
3400+
},
3401+
{
3402+
name: "Ingress - ingress with managed prefix list in IngressClassParam",
3403+
env: env{
3404+
svcs: []*corev1.Service{ns_1_svc_1, ns_1_svc_2, ns_1_svc_3},
3405+
},
3406+
fields: fields{
3407+
resolveViaDiscoveryCalls: []resolveViaDiscoveryCall{resolveViaDiscoveryCallForInternalLB},
3408+
listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB},
3409+
enableBackendSG: true,
3410+
},
3411+
args: args{
3412+
ingGroup: Group{
3413+
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
3414+
Members: []ClassifiedIngress{
3415+
{
3416+
IngClassConfig: ClassConfiguration{
3417+
IngClassParams: &v1beta1.IngressClassParams{
3418+
Spec: v1beta1.IngressClassParamsSpec{
3419+
PrefixListsIDs: []string{
3420+
"pl-11111111",
3421+
"pl-22222222",
3422+
},
3423+
},
3424+
},
3425+
},
3426+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
3427+
Namespace: "ns-1",
3428+
Name: "ing-1",
3429+
Annotations: map[string]string{
3430+
"alb.ingress.kubernetes.io/security-group-prefix-lists": "pl-00000000",
3431+
},
3432+
},
3433+
Spec: networking.IngressSpec{
3434+
Rules: []networking.IngressRule{
3435+
{
3436+
Host: "app-1.example.com",
3437+
IngressRuleValue: networking.IngressRuleValue{
3438+
HTTP: &networking.HTTPIngressRuleValue{
3439+
Paths: []networking.HTTPIngressPath{
3440+
{
3441+
Path: "/svc-1",
3442+
Backend: networking.IngressBackend{
3443+
Service: &networking.IngressServiceBackend{
3444+
Name: ns_1_svc_1.Name,
3445+
Port: networking.ServiceBackendPort{
3446+
Name: "http",
3447+
},
3448+
},
3449+
},
3450+
},
3451+
{
3452+
Path: "/svc-2",
3453+
Backend: networking.IngressBackend{
3454+
Service: &networking.IngressServiceBackend{
3455+
Name: ns_1_svc_2.Name,
3456+
Port: networking.ServiceBackendPort{
3457+
Name: "http",
3458+
},
3459+
},
3460+
},
3461+
},
3462+
},
3463+
},
3464+
},
3465+
},
3466+
{
3467+
Host: "app-2.example.com",
3468+
IngressRuleValue: networking.IngressRuleValue{
3469+
HTTP: &networking.HTTPIngressRuleValue{
3470+
Paths: []networking.HTTPIngressPath{
3471+
{
3472+
Path: "/svc-3",
3473+
Backend: networking.IngressBackend{
3474+
Service: &networking.IngressServiceBackend{
3475+
Name: ns_1_svc_3.Name,
3476+
Port: networking.ServiceBackendPort{
3477+
Name: "https",
3478+
},
3479+
},
3480+
},
3481+
},
3482+
},
3483+
},
3484+
},
3485+
},
3486+
},
3487+
},
3488+
},
3489+
},
3490+
},
3491+
},
3492+
},
3493+
wantStackPatch: `
3494+
{
3495+
"resources": {
3496+
"AWS::EC2::SecurityGroup": {
3497+
"ManagedLBSecurityGroup": {
3498+
"spec": {
3499+
"ingress": [
3500+
{
3501+
"fromPort": 80,
3502+
"ipProtocol": "tcp",
3503+
"prefixLists": [
3504+
{
3505+
"listID": "pl-11111111"
3506+
}
3507+
],
3508+
"toPort": 80
3509+
},
3510+
{
3511+
"fromPort": 80,
3512+
"ipProtocol": "tcp",
3513+
"prefixLists": [
3514+
{
3515+
"listID": "pl-22222222"
3516+
}
3517+
],
3518+
"toPort": 80
3519+
}
3520+
]
3521+
}
3522+
}
3523+
}
3524+
}
33993525
}`,
34003526
},
34013527
{

0 commit comments

Comments
 (0)