Skip to content

Commit 22e4c6d

Browse files
faiqfaiq
authored
feat: starts additional sec groups (#252)
1 parent 9446e01 commit 22e4c6d

File tree

10 files changed

+375
-14
lines changed

10 files changed

+375
-14
lines changed

‎api/v1alpha1/aws_node_types.go

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,34 @@ type AWSNodeSpec struct {
1919
// If both AMI ID and AMI lookup arguments are provided then AMI ID takes precedence
2020
//+optional
2121
AMISpec *AMISpec `json:"ami,omitempty"`
22+
23+
//+optional
24+
AdditionalSecurityGroups AdditionalSecurityGroup `json:"additionalSecurityGroups,omitempty"`
25+
}
26+
27+
type AdditionalSecurityGroup []SecurityGroup
28+
29+
type SecurityGroup struct {
30+
// ID is the id of the security group
31+
// +optional
32+
ID *string `json:"id,omitempty"`
33+
}
34+
35+
func (AdditionalSecurityGroup) VariableSchema() clusterv1.VariableSchema {
36+
return clusterv1.VariableSchema{
37+
OpenAPIV3Schema: clusterv1.JSONSchemaProps{
38+
Type: "array",
39+
Items: &clusterv1.JSONSchemaProps{
40+
Type: "object",
41+
Properties: map[string]clusterv1.JSONSchemaProps{
42+
"id": {
43+
Type: "string",
44+
Description: "Security group ID to add for the cluster Machines",
45+
},
46+
},
47+
},
48+
},
49+
}
2250
}
2351

2452
func (AWSNodeSpec) VariableSchema() clusterv1.VariableSchema {
@@ -27,9 +55,10 @@ func (AWSNodeSpec) VariableSchema() clusterv1.VariableSchema {
2755
Description: "AWS Node configuration",
2856
Type: "object",
2957
Properties: map[string]clusterv1.JSONSchemaProps{
30-
"iamInstanceProfile": IAMInstanceProfile("").VariableSchema().OpenAPIV3Schema,
31-
"instanceType": InstanceType("").VariableSchema().OpenAPIV3Schema,
32-
"ami": AMISpec{}.VariableSchema().OpenAPIV3Schema,
58+
"iamInstanceProfile": IAMInstanceProfile("").VariableSchema().OpenAPIV3Schema,
59+
"instanceType": InstanceType("").VariableSchema().OpenAPIV3Schema,
60+
"ami": AMISpec{}.VariableSchema().OpenAPIV3Schema,
61+
"additionalSecurityGroups": AdditionalSecurityGroup{}.VariableSchema().OpenAPIV3Schema,
3362
},
3463
},
3564
}

‎api/v1alpha1/zz_generated.deepcopy.go

Lines changed: 48 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/capi-runtime-extensions/templates/csi/aws-ebs/manifests/aws-ebs-csi-configmap.yaml

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1630,7 +1630,7 @@ data:
16301630
key: endpoint
16311631
name: aws-meta
16321632
optional: true
1633-
image: public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.23.1
1633+
image: public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.23.2
16341634
imagePullPolicy: IfNotPresent
16351635
livenessProbe:
16361636
failureThreshold: 5
@@ -1675,7 +1675,7 @@ data:
16751675
env:
16761676
- name: ADDRESS
16771677
value: /var/lib/csi/sockets/pluginproxy/csi.sock
1678-
image: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.5.0-eks-1-28-4
1678+
image: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.6.0-eks-1-28-7
16791679
imagePullPolicy: IfNotPresent
16801680
name: csi-provisioner
16811681
resources:
@@ -1697,7 +1697,7 @@ data:
16971697
env:
16981698
- name: ADDRESS
16991699
value: /var/lib/csi/sockets/pluginproxy/csi.sock
1700-
image: public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.3.0-eks-1-28-4
1700+
image: public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.4.0-eks-1-28-7
17011701
imagePullPolicy: IfNotPresent
17021702
name: csi-attacher
17031703
resources:
@@ -1719,7 +1719,7 @@ data:
17191719
env:
17201720
- name: ADDRESS
17211721
value: /var/lib/csi/sockets/pluginproxy/csi.sock
1722-
image: public.ecr.aws/eks-distro/kubernetes-csi/external-snapshotter/csi-snapshotter:v6.2.2-eks-1-28-4
1722+
image: public.ecr.aws/eks-distro/kubernetes-csi/external-snapshotter/csi-snapshotter:v6.3.0-eks-1-28-7
17231723
imagePullPolicy: IfNotPresent
17241724
name: csi-snapshotter
17251725
resources:
@@ -1742,7 +1742,7 @@ data:
17421742
env:
17431743
- name: ADDRESS
17441744
value: /var/lib/csi/sockets/pluginproxy/csi.sock
1745-
image: public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.8.0-eks-1-28-4
1745+
image: public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.9.0-eks-1-28-7
17461746
imagePullPolicy: IfNotPresent
17471747
name: csi-resizer
17481748
resources:
@@ -1759,7 +1759,7 @@ data:
17591759
name: socket-dir
17601760
- args:
17611761
- --csi-address=/csi/csi.sock
1762-
image: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.10.0-eks-1-28-4
1762+
image: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-28-7
17631763
imagePullPolicy: IfNotPresent
17641764
name: liveness-probe
17651765
resources:
@@ -1891,6 +1891,14 @@ data:
18911891
operator: NotIn
18921892
values:
18931893
- fargate
1894+
- key: node.kubernetes.io/instance-type
1895+
operator: NotIn
1896+
values:
1897+
- a1.medium
1898+
- a1.large
1899+
- a1.xlarge
1900+
- a1.2xlarge
1901+
- a1.4xlarge
18941902
containers:
18951903
- args:
18961904
- node
@@ -1904,7 +1912,7 @@ data:
19041912
valueFrom:
19051913
fieldRef:
19061914
fieldPath: spec.nodeName
1907-
image: public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.23.1
1915+
image: public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.23.2
19081916
imagePullPolicy: IfNotPresent
19091917
lifecycle:
19101918
preStop:
@@ -1951,7 +1959,7 @@ data:
19511959
value: /csi/csi.sock
19521960
- name: DRIVER_REG_SOCK_PATH
19531961
value: /var/lib/kubelet/plugins/ebs.csi.aws.com/csi.sock
1954-
image: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.8.0-eks-1-28-4
1962+
image: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.9.0-eks-1-28-7
19551963
imagePullPolicy: IfNotPresent
19561964
livenessProbe:
19571965
exec:
@@ -1981,7 +1989,7 @@ data:
19811989
name: probe-dir
19821990
- args:
19831991
- --csi-address=/csi/csi.sock
1984-
image: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.10.0-eks-1-28-4
1992+
image: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.11.0-eks-1-28-7
19851993
imagePullPolicy: IfNotPresent
19861994
name: liveness-probe
19871995
resources:

‎docs/content/customization/aws/security-groups.md

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
+++
2+
title = "AWS Additional Security Group Spec"
3+
+++
4+
5+
The AWS additional security group customization allows the user to specify security groups to the created machines.
6+
The customization can be applied to both control plane and nodepool machines.
7+
This customization will be available when the
8+
[provider-specific cluster configuration patch]({{< ref "..">}}) is included in the `ClusterClass`.
9+
10+
## Example
11+
12+
To specify addiitonal security groups for all control plane and nodepools, use the following configuration:
13+
14+
```yaml
15+
apiVersion: cluster.x-k8s.io/v1beta1
16+
kind: Cluster
17+
metadata:
18+
name: <NAME>
19+
spec:
20+
topology:
21+
variables:
22+
- name: clusterConfig
23+
value:
24+
controlPlane:
25+
aws:
26+
additionalSecurityGroups:
27+
- id: "sg-0fcfece738d3211b8"
28+
- name: workerConfig
29+
value:
30+
aws:
31+
additionalSecurityGroups:
32+
- id: "sg-0fcfece738d3211b8"
33+
```
34+
35+
We can further customize individual MachineDeployments by using the overrides field with the following configuration:
36+
37+
```yaml
38+
spec:
39+
topology:
40+
# ...
41+
workers:
42+
machineDeployments:
43+
- class: default-worker
44+
name: md-0
45+
variables:
46+
overrides:
47+
- name: workerConfig
48+
value:
49+
aws:
50+
additionalSecurityGroups:
51+
- id: "sg-0fcfece738d3211b8"
52+
```
53+
54+
Applying this configuration will result in the following value being set:
55+
56+
- control-plane `AWSMachineTemplate`:
57+
58+
- ```yaml
59+
spec:
60+
template:
61+
spec:
62+
additionalSecurityGroups:
63+
- id: sg-0fcfece738d3211b8
64+
```
65+
66+
- worker `AWSMachineTemplate`:
67+
68+
- ```yaml
69+
spec:
70+
template:
71+
spec:
72+
additionalSecurityGroups:
73+
- id: sg-0fcfece738d3211b8
74+
```

‎pkg/handlers/aws/mutation/metapatch_handler.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/aws/mutation/instancetype"
1515
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/aws/mutation/network"
1616
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/aws/mutation/region"
17+
"github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/aws/mutation/securitygroups"
1718
genericmutation "github.com/d2iq-labs/capi-runtime-extensions/pkg/handlers/generic/mutation"
1819
)
1920

@@ -27,6 +28,7 @@ func MetaPatchHandler(mgr manager.Manager) handlers.Named {
2728
iaminstanceprofile.NewControlPlanePatch(),
2829
instancetype.NewControlPlanePatch(),
2930
ami.NewControlPlanePatch(),
31+
securitygroups.NewControlPlanePatch(),
3032
},
3133
genericmutation.MetaMutators(mgr)...,
3234
)
@@ -43,6 +45,7 @@ func MetaWorkerPatchHandler() handlers.Named {
4345
iaminstanceprofile.NewWorkerPatch(),
4446
instancetype.NewWorkerPatch(),
4547
ami.NewWorkerPatch(),
48+
securitygroups.NewWorkerPatch(),
4649
}
4750

4851
return mutation.NewMetaGeneratePatchesHandler(

0 commit comments

Comments
 (0)