Merge pull request #2353 from stackhpc/feat/node-specific-secgroup-rules

🌱 Support for additional controlplane and worker secgroup rules

Author: k8s-ci-robot

api/v1alpha6/openstackcluster_conversion.go

@@ -222,6 +222,8 @@ func restorev1beta1ClusterSpec(previous *infrav1.OpenStackClusterSpec, dst *infr
 
 	if previous.ManagedSecurityGroups != nil && dst.ManagedSecurityGroups != nil {
 		dst.ManagedSecurityGroups.AllNodesSecurityGroupRules = previous.ManagedSecurityGroups.AllNodesSecurityGroupRules
+		dst.ManagedSecurityGroups.ControlPlaneNodesSecurityGroupRules = previous.ManagedSecurityGroups.ControlPlaneNodesSecurityGroupRules
+		dst.ManagedSecurityGroups.WorkerNodesSecurityGroupRules = previous.ManagedSecurityGroups.WorkerNodesSecurityGroupRules
 	}
 
 	if dst.APIServerLoadBalancer != nil && previous.APIServerLoadBalancer != nil {

api/v1alpha7/openstackcluster_conversion.go

@@ -218,6 +218,8 @@ func restorev1beta1ClusterSpec(previous *infrav1.OpenStackClusterSpec, dst *infr
 
 	if previous.ManagedSecurityGroups != nil && dst.ManagedSecurityGroups != nil {
 		dst.ManagedSecurityGroups.AllNodesSecurityGroupRules = previous.ManagedSecurityGroups.AllNodesSecurityGroupRules
+		dst.ManagedSecurityGroups.ControlPlaneNodesSecurityGroupRules = previous.ManagedSecurityGroups.ControlPlaneNodesSecurityGroupRules
+		dst.ManagedSecurityGroups.WorkerNodesSecurityGroupRules = previous.ManagedSecurityGroups.WorkerNodesSecurityGroupRules
 	}
 
 	if dst.APIServerLoadBalancer != nil && previous.APIServerLoadBalancer != nil {

api/v1beta1/openstackcluster_types.go

@@ -320,6 +320,22 @@ type ManagedSecurityGroups struct {
 	// +optional
 	AllNodesSecurityGroupRules []SecurityGroupRuleSpec `json:"allNodesSecurityGroupRules,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
 
+	// controlPlaneNodesSecurityGroupRules defines the rules that should be applied to control plane nodes.
+	// +patchMergeKey=name
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=name
+	// +optional
+	ControlPlaneNodesSecurityGroupRules []SecurityGroupRuleSpec `json:"controlPlaneNodesSecurityGroupRules,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
+
+	// workerNodesSecurityGroupRules defines the rules that should be applied to worker nodes.
+	// +patchMergeKey=name
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=name
+	// +optional
+	WorkerNodesSecurityGroupRules []SecurityGroupRuleSpec `json:"workerNodesSecurityGroupRules,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
+
 	// AllowAllInClusterTraffic allows all ingress and egress traffic between cluster nodes when set to true.
 	// +kubebuilder:default=false
 	// +kubebuilder:validation:Required