Skip to content

Commit 5199c55

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4293 from shuqz/shuqz-httproute
modify PrefixListsIDs with backward compatibility
2 parents 38d8ce7 + 953fdc5 commit 5199c55

File tree

7 files changed

+193
-8
lines changed

7 files changed

+193
-8
lines changed

‎apis/elbv2/v1beta1/ingressclassparams_types.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,7 @@ type IPAMConfiguration struct {
115115
}
116116

117117
// IngressClassParamsSpec defines the desired state of IngressClassParams
118+
// +kubebuilder:validation:XValidation:rule="!(has(self.prefixListsIDs) && has(self.PrefixListsIDs))", message="cannot specify both 'prefixListsIDs' and 'PrefixListsIDs' fields"
118119
type IngressClassParamsSpec struct {
119120
// CertificateArn specifies the ARN of the certificates for all Ingresses that belong to IngressClass with this IngressClassParams.
120121
// +optional
@@ -172,8 +173,14 @@ type IngressClassParamsSpec struct {
172173
// +optional
173174
IPAMConfiguration *IPAMConfiguration `json:"ipamConfiguration,omitempty"`
174175

176+
// PrefixListsIDsLegacy defines the security group prefix lists for all Ingresses that belong to IngressClass with this IngressClassParams.
177+
// Not Recommended, Use PrefixListsIDs (prefixListsIDs in JSON) instead
178+
// +optional
179+
PrefixListsIDsLegacy []string `json:"PrefixListsIDs,omitempty"`
180+
175181
// PrefixListsIDs defines the security group prefix lists for all Ingresses that belong to IngressClass with this IngressClassParams.
176-
PrefixListsIDs []string `json:"PrefixListsIDs,omitempty"`
182+
// +optional
183+
PrefixListsIDs []string `json:"prefixListsIDs,omitempty"`
177184
}
178185

179186
// +kubebuilder:object:root=true

‎apis/elbv2/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,9 @@ spec:
5656
description: IngressClassParamsSpec defines the desired state of IngressClassParams
5757
properties:
5858
PrefixListsIDs:
59-
description: PrefixListsIDs defines the security group prefix lists
60-
for all Ingresses that belong to IngressClass with this IngressClassParams.
59+
description: |-
60+
PrefixListsIDsLegacy defines the security group prefix lists for all Ingresses that belong to IngressClass with this IngressClassParams.
61+
Not Recommended, Use PrefixListsIDs (prefixListsIDs in JSON) instead
6162
items:
6263
type: string
6364
type: array
@@ -208,6 +209,12 @@ spec:
208209
type: object
209210
type: object
210211
x-kubernetes-map-type: atomic
212+
prefixListsIDs:
213+
description: PrefixListsIDs defines the security group prefix lists
214+
for all Ingresses that belong to IngressClass with this IngressClassParams.
215+
items:
216+
type: string
217+
type: array
211218
scheme:
212219
description: Scheme defines the scheme for all Ingresses that belong
213220
to IngressClass with this IngressClassParams.
@@ -269,6 +276,9 @@ spec:
269276
- ip
270277
type: string
271278
type: object
279+
x-kubernetes-validations:
280+
- message: cannot specify both 'prefixListsIDs' and 'PrefixListsIDs' fields
281+
rule: '!(has(self.prefixListsIDs) && has(self.PrefixListsIDs))'
272282
type: object
273283
served: true
274284
storage: true

‎docs/guide/ingress/ingress_class.md‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,18 @@ You can use IngressClassParams to enforce settings for a set of Ingresses.
175175
ipamConfiguration:
176176
ipv4IPAMPoolId: ipam-pool-000000000
177177
```
178-
- with PrefixListsIDs
178+
- with PrefixListsIDs (not recommended, use prefixListsIDs instead)
179+
```
180+
apiVersion: elbv2.k8s.aws/v1beta1
181+
kind: IngressClassParams
182+
metadata:
183+
name: class2048-config
184+
spec:
185+
PrefixListsIDs:
186+
- pl-00000000
187+
- pl-11111111
188+
```
189+
- with prefixListsIDs
179190
```
180191
apiVersion: elbv2.k8s.aws/v1beta1
181192
kind: IngressClassParams
@@ -321,13 +332,25 @@ Cluster administrators can use `ipamConfiguration` field to specify the IPv4 IPA
321332

322333
#### spec.PrefixListsIDs
323334

335+
We accept either `spec.prefixListsIDs` or `spec.PrefixListsIDs`. Specify both is not allowed. But `spec.PrefixListsIDs` is not recommended, use `spec.prefixListsIDs` instead.
336+
324337
`PrefixListsIDs` is an optional setting.
325338

326339
Cluster administrators can use `PrefixListsIDs` field to specify the managed prefix lists that are allowed to access the load balancers that belong to this IngressClass. You can specify the list of prefix list IDs in the `spec.PrefixListsIDs` field.
327340

328341
1. If `PrefixListsIDs` is set, the prefix lists defined will be applied to the load balancer that belong to this IngressClass. If you specify invalid prefix list IDs, the controller will fail to reconcile ingresses belonging to the particular ingress class.
329342
2. If `PrefixListsIDs` un-specified, Ingresses with this IngressClass can continue to use `alb.ingress.kubernetes.io/security-group-prefix-lists` annotation to specify the load balancer prefix lists.
330343

344+
345+
#### spec.prefixListsIDs
346+
347+
`prefixListsIDs` is an optional setting.
348+
349+
Cluster administrators can use `prefixListsIDs` field to specify the managed prefix lists that are allowed to access the load balancers that belong to this IngressClass. You can specify the list of prefix list IDs in the `spec.prefixListsIDs` field.
350+
351+
1. If `prefixListsIDs` is set, the prefix lists defined will be applied to the load balancer that belong to this IngressClass. If you specify invalid prefix list IDs, the controller will fail to reconcile ingresses belonging to the particular ingress class.
352+
2. If `prefixListsIDs` un-specified, Ingresses with this IngressClass can continue to use `alb.ingress.kubernetes.io/security-group-prefix-lists` annotation to specify the load balancer prefix lists.
353+
331354
#### spec.listeners
332355

333356
`listeners` is an optional setting.

‎helm/aws-load-balancer-controller/crds/crds.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,9 @@ spec:
5555
description: IngressClassParamsSpec defines the desired state of IngressClassParams
5656
properties:
5757
PrefixListsIDs:
58-
description: PrefixListsIDs defines the security group prefix lists
59-
for all Ingresses that belong to IngressClass with this IngressClassParams.
58+
description: |-
59+
PrefixListsIDsLegacy defines the security group prefix lists for all Ingresses that belong to IngressClass with this IngressClassParams.
60+
Not Recommended, Use PrefixListsIDs (prefixListsIDs in JSON) instead
6061
items:
6162
type: string
6263
type: array
@@ -207,6 +208,12 @@ spec:
207208
type: object
208209
type: object
209210
x-kubernetes-map-type: atomic
211+
prefixListsIDs:
212+
description: PrefixListsIDs defines the security group prefix lists
213+
for all Ingresses that belong to IngressClass with this IngressClassParams.
214+
items:
215+
type: string
216+
type: array
210217
scheme:
211218
description: Scheme defines the scheme for all Ingresses that belong
212219
to IngressClass with this IngressClassParams.
@@ -268,6 +275,9 @@ spec:
268275
- ip
269276
type: string
270277
type: object
278+
x-kubernetes-validations:
279+
- message: cannot specify both 'prefixListsIDs' and 'PrefixListsIDs' fields
280+
rule: '!(has(self.prefixListsIDs) && has(self.PrefixListsIDs))'
271281
type: object
272282
served: true
273283
storage: true

‎pkg/ingress/model_build_listener.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -279,8 +279,12 @@ func (t *defaultModelBuildTask) computeIngressExplicitSSLPolicy(_ context.Contex
279279
}
280280

281281
func (t *defaultModelBuildTask) computeIngressExplicitPrefixListIDs(_ context.Context, ing *ClassifiedIngress) []string {
282-
if ing.IngClassConfig.IngClassParams != nil && len(ing.IngClassConfig.IngClassParams.Spec.PrefixListsIDs) != 0 {
283-
return ing.IngClassConfig.IngClassParams.Spec.PrefixListsIDs
282+
if ing.IngClassConfig.IngClassParams != nil {
283+
if len(ing.IngClassConfig.IngClassParams.Spec.PrefixListsIDs) != 0 {
284+
return ing.IngClassConfig.IngClassParams.Spec.PrefixListsIDs
285+
} else if len(ing.IngClassConfig.IngClassParams.Spec.PrefixListsIDsLegacy) != 0 {
286+
return ing.IngClassConfig.IngClassParams.Spec.PrefixListsIDsLegacy
287+
}
284288
}
285289
var prefixListIDs []string
286290
t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixSecurityGroupPrefixLists, &prefixListIDs, ing.Ing.Annotations)

‎pkg/ingress/model_builder_test.go‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4138,6 +4138,132 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
41384138
}
41394139
}
41404140
}
4141+
}`,
4142+
},
4143+
{
4144+
name: "Ingress - ingress with managed prefix list in IngressClassParam - input PrefixListsIDsLegacy",
4145+
env: env{
4146+
svcs: []*corev1.Service{ns_1_svc_1, ns_1_svc_2, ns_1_svc_3},
4147+
},
4148+
fields: fields{
4149+
resolveViaDiscoveryCalls: []resolveViaDiscoveryCall{resolveViaDiscoveryCallForInternalLB},
4150+
listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB},
4151+
enableBackendSG: true,
4152+
},
4153+
args: args{
4154+
ingGroup: Group{
4155+
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
4156+
Members: []ClassifiedIngress{
4157+
{
4158+
IngClassConfig: ClassConfiguration{
4159+
IngClassParams: &v1beta1.IngressClassParams{
4160+
Spec: v1beta1.IngressClassParamsSpec{
4161+
PrefixListsIDsLegacy: []string{
4162+
"pl-11111111",
4163+
"pl-22222222",
4164+
},
4165+
},
4166+
},
4167+
},
4168+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
4169+
Namespace: "ns-1",
4170+
Name: "ing-1",
4171+
Annotations: map[string]string{
4172+
"alb.ingress.kubernetes.io/security-group-prefix-lists": "pl-00000000",
4173+
},
4174+
},
4175+
Spec: networking.IngressSpec{
4176+
Rules: []networking.IngressRule{
4177+
{
4178+
Host: "app-1.example.com",
4179+
IngressRuleValue: networking.IngressRuleValue{
4180+
HTTP: &networking.HTTPIngressRuleValue{
4181+
Paths: []networking.HTTPIngressPath{
4182+
{
4183+
Path: "/svc-1",
4184+
Backend: networking.IngressBackend{
4185+
Service: &networking.IngressServiceBackend{
4186+
Name: ns_1_svc_1.Name,
4187+
Port: networking.ServiceBackendPort{
4188+
Name: "http",
4189+
},
4190+
},
4191+
},
4192+
},
4193+
{
4194+
Path: "/svc-2",
4195+
Backend: networking.IngressBackend{
4196+
Service: &networking.IngressServiceBackend{
4197+
Name: ns_1_svc_2.Name,
4198+
Port: networking.ServiceBackendPort{
4199+
Name: "http",
4200+
},
4201+
},
4202+
},
4203+
},
4204+
},
4205+
},
4206+
},
4207+
},
4208+
{
4209+
Host: "app-2.example.com",
4210+
IngressRuleValue: networking.IngressRuleValue{
4211+
HTTP: &networking.HTTPIngressRuleValue{
4212+
Paths: []networking.HTTPIngressPath{
4213+
{
4214+
Path: "/svc-3",
4215+
Backend: networking.IngressBackend{
4216+
Service: &networking.IngressServiceBackend{
4217+
Name: ns_1_svc_3.Name,
4218+
Port: networking.ServiceBackendPort{
4219+
Name: "https",
4220+
},
4221+
},
4222+
},
4223+
},
4224+
},
4225+
},
4226+
},
4227+
},
4228+
},
4229+
},
4230+
},
4231+
},
4232+
},
4233+
},
4234+
},
4235+
wantStackPatch: `
4236+
{
4237+
"resources": {
4238+
"AWS::EC2::SecurityGroup": {
4239+
"ManagedLBSecurityGroup": {
4240+
"spec": {
4241+
"ingress": [
4242+
{
4243+
"fromPort": 80,
4244+
"ipProtocol": "tcp",
4245+
"prefixLists": [
4246+
{
4247+
"listID": "pl-11111111"
4248+
}
4249+
],
4250+
"toPort": 80
4251+
},
4252+
{
4253+
"fromPort": 80,
4254+
"ipProtocol": "tcp",
4255+
"prefixLists": [
4256+
{
4257+
"listID": "pl-22222222"
4258+
}
4259+
],
4260+
"toPort": 80
4261+
}
4262+
]
4263+
}
4264+
}
4265+
}
4266+
}
41414267
}`,
41424268
},
41434269
{

0 commit comments

Comments
 (0)