Skip to content

Commit acaa22b

Browse files
shraddhabangshraddhabang
committed
[feat: gw api][bug fix] generate sg rules using listener protocols, not route protocols
1 parent 8ed0f0e commit acaa22b

File tree

4 files changed

+217
-187
lines changed

4 files changed

+217
-187
lines changed

‎controllers/gateway/eventhandlers/gateway_class_events.go

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package eventhandlers
33
import (
44
"context"
55
"github.com/go-logr/logr"
6-
"k8s.io/apimachinery/pkg/api/equality"
76
"k8s.io/client-go/tools/record"
87
"k8s.io/client-go/util/workqueue"
98
"sigs.k8s.io/aws-load-balancer-controller/pkg/k8s"
@@ -42,17 +41,8 @@ func (h *enqueueRequestsForGatewayClassEvent) Create(ctx context.Context, e even
4241
}
4342

4443
func (h *enqueueRequestsForGatewayClassEvent) Update(ctx context.Context, e event.TypedUpdateEvent[*gatewayv1.GatewayClass], queue workqueue.TypedRateLimitingInterface[reconcile.Request]) {
45-
gwClassOld := e.ObjectOld
4644
gwClassNew := e.ObjectNew
4745

48-
// we only care below update event:
49-
// 1. GatewayClass spec updates
50-
// 3. GatewayClass deletions
51-
if equality.Semantic.DeepEqual(gwClassOld.Spec, gwClassNew.Spec) &&
52-
equality.Semantic.DeepEqual(gwClassOld.DeletionTimestamp.IsZero(), gwClassNew.DeletionTimestamp.IsZero()) {
53-
return
54-
}
55-
5646
h.logger.V(1).Info("enqueue gatewayclass update event", "gatewayclass", gwClassNew.Name)
5747
h.enqueueImpactedGateways(ctx, gwClassNew, queue)
5848
}

‎pkg/gateway/model/model_build_listener.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ func (l listenerBuilderImpl) buildL4ListenerSpec(ctx context.Context, stack core
146146

147147
// For L4 Gateways we will assume that each L4 gateway Listener will have a single L4 route and each route will only have a single backendRef as weighted tgs are not supported for NLBs.
148148
if len(routes) > 1 {
149-
return &elbv2model.ListenerSpec{}, errors.Errorf("multiple routes %v are not supported for listener on port:protocol %v:%v for gateway %v", routes, port, listenerSpec.Protocol, k8s.NamespacedName(gw))
149+
return &elbv2model.ListenerSpec{}, errors.Errorf("multiple routes %+v are not supported for listener %v:%v for gateway %v", routes, listenerSpec.Protocol, port, k8s.NamespacedName(gw))
150150
}
151151
routeDescriptor := routes[0]
152152
if routeDescriptor.GetAttachedRules()[0].GetBackends() == nil || len(routeDescriptor.GetAttachedRules()[0].GetBackends()) == 0 {

‎pkg/gateway/model/model_build_security_group.go

Lines changed: 65 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ import (
1010
"github.com/go-logr/logr"
1111
"github.com/pkg/errors"
1212
"k8s.io/apimachinery/pkg/types"
13-
"k8s.io/apimachinery/pkg/util/sets"
1413
"regexp"
1514
elbv2gw "sigs.k8s.io/aws-load-balancer-controller/apis/gateway/v1beta1"
1615
"sigs.k8s.io/aws-load-balancer-controller/pkg/gateway/routeutils"
@@ -79,7 +78,7 @@ func (builder *securityGroupBuilderImpl) buildSecurityGroups(ctx context.Context
7978

8079
func (builder *securityGroupBuilderImpl) handleManagedSecurityGroup(ctx context.Context, stack core.Stack, lbConf elbv2gw.LoadBalancerConfiguration, gw *gwv1.Gateway, routes map[int32][]routeutils.RouteDescriptor, ipAddressType elbv2model.IPAddressType) (securityGroupOutput, error) {
8180
var lbSGTokens []core.StringToken
82-
managedSG, err := builder.buildManagedSecurityGroup(stack, lbConf, gw, routes, ipAddressType)
81+
managedSG, err := builder.buildManagedSecurityGroup(stack, lbConf, gw, ipAddressType)
8382
if err != nil {
8483
return securityGroupOutput{}, err
8584
}
@@ -144,14 +143,14 @@ func (builder *securityGroupBuilderImpl) getBackendSecurityGroup(ctx context.Con
144143
return core.LiteralStringToken(backendSGID), nil
145144
}
146145

147-
func (builder *securityGroupBuilderImpl) buildManagedSecurityGroup(stack core.Stack, lbConf elbv2gw.LoadBalancerConfiguration, gw *gwv1.Gateway, routes map[int32][]routeutils.RouteDescriptor, ipAddressType elbv2model.IPAddressType) (*ec2model.SecurityGroup, error) {
146+
func (builder *securityGroupBuilderImpl) buildManagedSecurityGroup(stack core.Stack, lbConf elbv2gw.LoadBalancerConfiguration, gw *gwv1.Gateway, ipAddressType elbv2model.IPAddressType) (*ec2model.SecurityGroup, error) {
148147
name := builder.buildManagedSecurityGroupName(gw)
149148
tags, err := builder.tagHelper.getGatewayTags(lbConf)
150149
if err != nil {
151150
return nil, err
152151
}
153152

154-
ingressPermissions := builder.buildManagedSecurityGroupIngressPermissions(lbConf, routes, ipAddressType)
153+
ingressPermissions := builder.buildManagedSecurityGroupIngressPermissions(lbConf, gw, ipAddressType)
155154
return ec2model.NewSecurityGroup(stack, resourceIDManagedSecurityGroup, ec2model.SecurityGroupSpec{
156155
GroupName: name,
157156
Description: managedSGDescription,
@@ -173,7 +172,7 @@ func (builder *securityGroupBuilderImpl) buildManagedSecurityGroupName(gw *gwv1.
173172
return fmt.Sprintf("k8s-%.8s-%.8s-%.10s", sanitizedNamespace, sanitizedName, uuid)
174173
}
175174

176-
func (builder *securityGroupBuilderImpl) buildManagedSecurityGroupIngressPermissions(lbConf elbv2gw.LoadBalancerConfiguration, routes map[int32][]routeutils.RouteDescriptor, ipAddressType elbv2model.IPAddressType) []ec2model.IPPermission {
175+
func (builder *securityGroupBuilderImpl) buildManagedSecurityGroupIngressPermissions(lbConf elbv2gw.LoadBalancerConfiguration, gw *gwv1.Gateway, ipAddressType elbv2model.IPAddressType) []ec2model.IPPermission {
177176
var permissions []ec2model.IPPermission
178177

179178
// Default to 0.0.0.0/0 and ::/0
@@ -200,97 +199,88 @@ func (builder *securityGroupBuilderImpl) buildManagedSecurityGroupIngressPermiss
200199

201200
includeIPv6 := isIPv6Supported(ipAddressType)
202201

203-
// Port Loop
204-
for port, cfg := range routes {
205-
// Protocol Loop
206-
for _, protocol := range generateProtocolListFromRoutes(cfg) {
207-
// CIDR Loop
208-
for _, cidr := range sourceRanges {
209-
isIPv6 := isIPv6CIDR(cidr)
202+
//listener loop
203+
for _, listener := range gw.Spec.Listeners {
204+
port := int32(listener.Port)
205+
protocol := getSgRuleProtocol(listener.Protocol)
206+
// CIDR Loop
207+
for _, cidr := range sourceRanges {
208+
isIPv6 := isIPv6CIDR(cidr)
210209

211-
if !isIPv6 {
210+
if !isIPv6 {
211+
permissions = append(permissions, ec2model.IPPermission{
212+
IPProtocol: string(protocol),
213+
FromPort: awssdk.Int32(int32(port)),
214+
ToPort: awssdk.Int32(int32(port)),
215+
IPRanges: []ec2model.IPRange{
216+
{
217+
CIDRIP: cidr,
218+
},
219+
},
220+
})
221+
222+
if enableICMP {
212223
permissions = append(permissions, ec2model.IPPermission{
213-
IPProtocol: protocol,
214-
FromPort: awssdk.Int32(int32(port)),
215-
ToPort: awssdk.Int32(int32(port)),
224+
IPProtocol: shared_constants.ICMPV4Protocol,
225+
FromPort: awssdk.Int32(shared_constants.ICMPV4TypeForPathMtu),
226+
ToPort: awssdk.Int32(shared_constants.ICMPV4CodeForPathMtu),
216227
IPRanges: []ec2model.IPRange{
217228
{
218229
CIDRIP: cidr,
219230
},
220231
},
221232
})
233+
}
222234

223-
if enableICMP {
224-
permissions = append(permissions, ec2model.IPPermission{
225-
IPProtocol: shared_constants.ICMPV4Protocol,
226-
FromPort: awssdk.Int32(shared_constants.ICMPV4TypeForPathMtu),
227-
ToPort: awssdk.Int32(shared_constants.ICMPV4CodeForPathMtu),
228-
IPRanges: []ec2model.IPRange{
229-
{
230-
CIDRIP: cidr,
231-
},
232-
},
233-
})
234-
}
235+
} else if includeIPv6 {
236+
permissions = append(permissions, ec2model.IPPermission{
237+
IPProtocol: string(protocol),
238+
FromPort: awssdk.Int32(int32(port)),
239+
ToPort: awssdk.Int32(int32(port)),
240+
IPv6Range: []ec2model.IPv6Range{
241+
{
242+
CIDRIPv6: cidr,
243+
},
244+
},
245+
})
235246

236-
} else if includeIPv6 {
247+
if enableICMP {
237248
permissions = append(permissions, ec2model.IPPermission{
238-
IPProtocol: protocol,
239-
FromPort: awssdk.Int32(int32(port)),
240-
ToPort: awssdk.Int32(int32(port)),
249+
IPProtocol: shared_constants.ICMPV6Protocol,
250+
FromPort: awssdk.Int32(shared_constants.ICMPV6TypeForPathMtu),
251+
ToPort: awssdk.Int32(shared_constants.ICMPV6CodeForPathMtu),
241252
IPv6Range: []ec2model.IPv6Range{
242253
{
243254
CIDRIPv6: cidr,
244255
},
245256
},
246257
})
247-
248-
if enableICMP {
249-
permissions = append(permissions, ec2model.IPPermission{
250-
IPProtocol: shared_constants.ICMPV6Protocol,
251-
FromPort: awssdk.Int32(shared_constants.ICMPV6TypeForPathMtu),
252-
ToPort: awssdk.Int32(shared_constants.ICMPV6CodeForPathMtu),
253-
IPv6Range: []ec2model.IPv6Range{
254-
{
255-
CIDRIPv6: cidr,
256-
},
257-
},
258-
})
259-
}
260258
}
261-
} // CIDR Loop
262-
// PL loop
263-
for _, prefixID := range prefixes {
264-
permissions = append(permissions, ec2model.IPPermission{
265-
IPProtocol: protocol,
266-
FromPort: awssdk.Int32(int32(port)),
267-
ToPort: awssdk.Int32(int32(port)),
268-
PrefixLists: []ec2model.PrefixList{
269-
{
270-
ListID: prefixID,
271-
},
259+
}
260+
} // CIDR Loop
261+
// PL loop
262+
for _, prefixID := range prefixes {
263+
permissions = append(permissions, ec2model.IPPermission{
264+
IPProtocol: string(protocol),
265+
FromPort: awssdk.Int32(int32(port)),
266+
ToPort: awssdk.Int32(int32(port)),
267+
PrefixLists: []ec2model.PrefixList{
268+
{
269+
ListID: prefixID,
272270
},
273-
})
274-
} // PL Loop
275-
} // Protocol Loop
276-
} // Port Loop
271+
},
272+
})
273+
} // PL loop
274+
} // listener loop
277275
return permissions
278276
}
279277

280-
func generateProtocolListFromRoutes(routes []routeutils.RouteDescriptor) []string {
281-
protocolSet := sets.New[string]()
282-
283-
for _, route := range routes {
284-
switch route.GetRouteKind() {
285-
case routeutils.HTTPRouteKind, routeutils.GRPCRouteKind, routeutils.TCPRouteKind, routeutils.TLSRouteKind:
286-
protocolSet.Insert(string(ec2types.ProtocolTcp))
287-
break
288-
case routeutils.UDPRouteKind:
289-
protocolSet = protocolSet.Insert(string(ec2types.ProtocolUdp))
290-
break
291-
default:
292-
// Ignore? Throw error?
293-
}
278+
func getSgRuleProtocol(protocol gwv1.ProtocolType) ec2types.Protocol {
279+
switch protocol {
280+
case gwv1.HTTPProtocolType, gwv1.HTTPSProtocolType, gwv1.TCPProtocolType, gwv1.TLSProtocolType:
281+
return ec2types.ProtocolTcp
282+
case gwv1.UDPProtocolType:
283+
return ec2types.ProtocolUdp
294284
}
295-
return protocolSet.UnsortedList()
285+
return ec2types.ProtocolTcp
296286
}

0 commit comments

Comments
 (0)