diff --git a/pkg/model/azuremodel/context.go b/pkg/model/azuremodel/context.go index faa95bb1dde99..273dfac3de861 100644 --- a/pkg/model/azuremodel/context.go +++ b/pkg/model/azuremodel/context.go @@ -77,6 +77,16 @@ func (c *AzureModelContext) NameForLoadBalancer() string { return "api-" + c.ClusterName() } +// LinkToApplicationSecurityGroup returns the Application Security Group object for the InstanceGroup role. +func (c *AzureModelContext) LinkToApplicationSecurityGroup(role kops.InstanceGroupRole) *azuretasks.ApplicationSecurityGroup { + return &azuretasks.ApplicationSecurityGroup{Name: fi.PtrTo(c.NameForApplicationSecurityGroup(role))} +} + +// NameForApplicationSecurityGroup returns the name of the Application Security Group object for the InstanceGroup role. +func (c *AzureModelContext) NameForApplicationSecurityGroup(role kops.InstanceGroupRole) string { + return role.ToLowerString() + "." + c.ClusterName() +} + // CloudTagsForInstanceGroup computes the tags to apply to instances in the specified InstanceGroup // Mostly copied from pkg/model/context.go, but "/" in tag keys are replaced with "_" as Azure // doesn't allow "/" in tag keys. diff --git a/pkg/model/azuremodel/vmscaleset.go b/pkg/model/azuremodel/vmscaleset.go index 684b79babc8f5..aeed9a5f2e826 100644 --- a/pkg/model/azuremodel/vmscaleset.go +++ b/pkg/model/azuremodel/vmscaleset.go @@ -41,6 +41,19 @@ var _ fi.CloudupModelBuilder = &VMScaleSetModelBuilder{} // Build is responsible for constructing the VM ScaleSet from the kops spec. func (b *VMScaleSetModelBuilder) Build(c *fi.CloudupModelBuilderContext) error { + c.AddTask(&azuretasks.ApplicationSecurityGroup{ + Name: fi.PtrTo(b.NameForApplicationSecurityGroup(kops.InstanceGroupRoleControlPlane)), + Lifecycle: b.Lifecycle, + ResourceGroup: b.LinkToResourceGroup(), + Tags: map[string]*string{}, + }) + c.AddTask(&azuretasks.ApplicationSecurityGroup{ + Name: fi.PtrTo(b.NameForApplicationSecurityGroup(kops.InstanceGroupRoleNode)), + Lifecycle: b.Lifecycle, + ResourceGroup: b.LinkToResourceGroup(), + Tags: map[string]*string{}, + }) + for _, ig := range b.InstanceGroups { name := b.AutoscalingGroupName(ig) vmss, err := b.buildVMScaleSetTask(c, name, ig) @@ -82,14 +95,15 @@ func (b *VMScaleSetModelBuilder) buildVMScaleSetTask( azNumbers = append(azNumbers, az) } t := &azuretasks.VMScaleSet{ - Name: fi.PtrTo(name), - Lifecycle: b.Lifecycle, - ResourceGroup: b.LinkToResourceGroup(), - VirtualNetwork: b.LinkToVirtualNetwork(), - SKUName: fi.PtrTo(ig.Spec.MachineType), - ComputerNamePrefix: fi.PtrTo(ig.Name), - AdminUser: fi.PtrTo(b.Cluster.Spec.CloudProvider.Azure.AdminUser), - Zones: azNumbers, + Name: fi.PtrTo(name), + Lifecycle: b.Lifecycle, + ResourceGroup: b.LinkToResourceGroup(), + VirtualNetwork: b.LinkToVirtualNetwork(), + ApplicationSecurityGroups: []*azuretasks.ApplicationSecurityGroup{b.LinkToApplicationSecurityGroup(ig.Spec.Role)}, + SKUName: fi.PtrTo(ig.Spec.MachineType), + ComputerNamePrefix: fi.PtrTo(ig.Name), + AdminUser: fi.PtrTo(b.Cluster.Spec.CloudProvider.Azure.AdminUser), + Zones: azNumbers, } var err error diff --git a/pkg/resources/azure/azure.go b/pkg/resources/azure/azure.go index 5fd676b7bf987..07c0171fe8ca2 100644 --- a/pkg/resources/azure/azure.go +++ b/pkg/resources/azure/azure.go @@ -31,16 +31,17 @@ import ( ) const ( - typeResourceGroup = "ResourceGroup" - typeVirtualNetwork = "VirtualNetwork" - typeNetworkSecurityGroup = "NetworkSecurityGroup" - typeSubnet = "Subnet" - typeRouteTable = "RouteTable" - typeVMScaleSet = "VMScaleSet" - typeDisk = "Disk" - typeRoleAssignment = "RoleAssignment" - typeLoadBalancer = "LoadBalancer" - typePublicIPAddress = "PublicIPAddress" + typeResourceGroup = "ResourceGroup" + typeVirtualNetwork = "VirtualNetwork" + typeNetworkSecurityGroup = "NetworkSecurityGroup" + typeApplicationSecurityGroup = "ApplicationSecurityGroup" + typeSubnet = "Subnet" + typeRouteTable = "RouteTable" + typeVMScaleSet = "VMScaleSet" + typeDisk = "Disk" + typeRoleAssignment = "RoleAssignment" + typeLoadBalancer = "LoadBalancer" + typePublicIPAddress = "PublicIPAddress" ) // ListResourcesAzure lists all resources for the cluster by quering Azure. @@ -87,6 +88,7 @@ func (g *resourceGetter) listAll() ([]*resources.Resource, error) { g.listResourceGroups, g.listVirtualNetworksAndSubnets, g.listNetworkSecurityGroups, + g.listApplicationSecurityGroups, g.listRouteTables, g.listVMScaleSetsAndRoleAssignments, g.listDisks, @@ -267,6 +269,39 @@ func (g *resourceGetter) deleteNetworkSecurityGroup(r *resources.Resource) error return g.cloud.NetworkSecurityGroup().Delete(context.TODO(), g.resourceGroupName(), r.Name) } +func (g *resourceGetter) listApplicationSecurityGroups(ctx context.Context) ([]*resources.Resource, error) { + ApplicationSecurityGroups, err := g.cloud.ApplicationSecurityGroup().List(ctx, g.resourceGroupName()) + if err != nil { + return nil, err + } + + var rs []*resources.Resource + for i := range ApplicationSecurityGroups { + rs = append(rs, g.toApplicationSecurityGroupResource(&ApplicationSecurityGroups[i])) + } + return rs, nil +} + +func (g *resourceGetter) toApplicationSecurityGroupResource(ApplicationSecurityGroup *network.ApplicationSecurityGroup) *resources.Resource { + return &resources.Resource{ + Obj: ApplicationSecurityGroup, + Type: typeApplicationSecurityGroup, + ID: *ApplicationSecurityGroup.Name, + Name: *ApplicationSecurityGroup.Name, + Deleter: func(_ fi.Cloud, r *resources.Resource) error { + return g.deleteApplicationSecurityGroup(r) + }, + Blocks: []string{ + toKey(typeResourceGroup, g.resourceGroupName()), + }, + Shared: g.clusterInfo.AzureNetworkShared, + } +} + +func (g *resourceGetter) deleteApplicationSecurityGroup(r *resources.Resource) error { + return g.cloud.ApplicationSecurityGroup().Delete(context.TODO(), g.resourceGroupName(), r.Name) +} + func (g *resourceGetter) listRouteTables(ctx context.Context) ([]*resources.Resource, error) { rts, err := g.cloud.RouteTable().List(ctx, g.resourceGroupName()) if err != nil { @@ -344,6 +379,7 @@ func (g *resourceGetter) toVMScaleSetResource(vmss *compute.VirtualMachineScaleS vnets := set.New[string]() subnets := set.New[string]() + asgs := set.New[string]() lbs := set.New[string]() for _, iface := range *vmss.VirtualMachineProfile.NetworkProfile.NetworkInterfaceConfigurations { for _, ip := range *iface.IPConfigurations { @@ -353,6 +389,15 @@ func (g *resourceGetter) toVMScaleSetResource(vmss *compute.VirtualMachineScaleS } vnets.Insert(subnetID.VirtualNetworkName) subnets.Insert(subnetID.SubnetName) + if ip.ApplicationSecurityGroups != nil { + for _, asg := range *ip.ApplicationSecurityGroups { + asgID, err := azure.ParseApplicationSecurityGroupID(*asg.ID) + if err != nil { + return nil, fmt.Errorf("parsing application security group ID: %s", err) + } + asgs.Insert(asgID.ApplicationSecurityGroupName) + } + } if ip.LoadBalancerBackendAddressPools != nil { for _, lb := range *ip.LoadBalancerBackendAddressPools { lbID, err := azure.ParseLoadBalancerID(*lb.ID) @@ -370,6 +415,9 @@ func (g *resourceGetter) toVMScaleSetResource(vmss *compute.VirtualMachineScaleS for subnet := range subnets { blocks = append(blocks, toKey(typeSubnet, subnet)) } + for asg := range asgs { + blocks = append(blocks, toKey(typeApplicationSecurityGroup, asg)) + } for lb := range lbs { blocks = append(blocks, toKey(typeLoadBalancer, lb)) } diff --git a/upup/pkg/fi/cloudup/azure/applicationsecuritygroup.go b/upup/pkg/fi/cloudup/azure/applicationsecuritygroup.go new file mode 100644 index 0000000000000..7e501e056633b --- /dev/null +++ b/upup/pkg/fi/cloudup/azure/applicationsecuritygroup.go @@ -0,0 +1,83 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package azure + +import ( + "context" + "fmt" + + "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2022-05-01/network" + "github.com/Azure/go-autorest/autorest" +) + +// ApplicationSecurityGroupsClient is a client for managing Application Security Groups. +type ApplicationSecurityGroupsClient interface { + CreateOrUpdate(ctx context.Context, resourceGroupName, applicationSecurityGroupName string, parameters network.ApplicationSecurityGroup) (*network.ApplicationSecurityGroup, error) + List(ctx context.Context, resourceGroupName string) ([]network.ApplicationSecurityGroup, error) + Delete(ctx context.Context, resourceGroupName, applicationSecurityGroupName string) error +} + +type ApplicationSecurityGroupsClientImpl struct { + c *network.ApplicationSecurityGroupsClient +} + +var _ ApplicationSecurityGroupsClient = &ApplicationSecurityGroupsClientImpl{} + +func (c *ApplicationSecurityGroupsClientImpl) CreateOrUpdate(ctx context.Context, resourceGroupName, applicationSecurityGroupName string, parameters network.ApplicationSecurityGroup) (*network.ApplicationSecurityGroup, error) { + future, err := c.c.CreateOrUpdate(ctx, resourceGroupName, applicationSecurityGroupName, parameters) + if err != nil { + return nil, fmt.Errorf("error creating/updating Application Security Group: %w", err) + } + if err := future.WaitForCompletionRef(ctx, c.c.Client); err != nil { + return nil, fmt.Errorf("error waiting for Application Security Group create/update completion: %w", err) + } + asg, err := future.Result(*c.c) + if err != nil { + return nil, fmt.Errorf("error obtaining result for Application Security Group create/update: %w", err) + } + return &asg, err +} + +func (c *ApplicationSecurityGroupsClientImpl) List(ctx context.Context, resourceGroupName string) ([]network.ApplicationSecurityGroup, error) { + var l []network.ApplicationSecurityGroup + for iter, err := c.c.ListComplete(ctx, resourceGroupName); iter.NotDone(); err = iter.NextWithContext(ctx) { + if err != nil { + return nil, err + } + l = append(l, iter.Value()) + } + return l, nil +} + +func (c *ApplicationSecurityGroupsClientImpl) Delete(ctx context.Context, resourceGroupName, applicationSecurityGroupName string) error { + future, err := c.c.Delete(ctx, resourceGroupName, applicationSecurityGroupName) + if err != nil { + return fmt.Errorf("error deleting virtual network: %w", err) + } + if err := future.WaitForCompletionRef(ctx, c.c.Client); err != nil { + return fmt.Errorf("error waiting for virtual network deletion completion: %w", err) + } + return nil +} + +func newApplicationSecurityGroupsClientImpl(subscriptionID string, authorizer autorest.Authorizer) *ApplicationSecurityGroupsClientImpl { + c := network.NewApplicationSecurityGroupsClient(subscriptionID) + c.Authorizer = authorizer + return &ApplicationSecurityGroupsClientImpl{ + c: &c, + } +} diff --git a/upup/pkg/fi/cloudup/azure/azure_cloud.go b/upup/pkg/fi/cloudup/azure/azure_cloud.go index 549ad611c0599..fb7474b3f4c7d 100644 --- a/upup/pkg/fi/cloudup/azure/azure_cloud.go +++ b/upup/pkg/fi/cloudup/azure/azure_cloud.go @@ -50,6 +50,7 @@ type AzureCloud interface { Subnet() SubnetsClient RouteTable() RouteTablesClient NetworkSecurityGroup() NetworkSecurityGroupsClient + ApplicationSecurityGroup() ApplicationSecurityGroupsClient VMScaleSet() VMScaleSetsClient VMScaleSetVM() VMScaleSetVMsClient Disk() DisksClient @@ -60,21 +61,22 @@ type AzureCloud interface { } type azureCloudImplementation struct { - subscriptionID string - location string - tags map[string]string - resourceGroupsClient ResourceGroupsClient - networkSecurityGroupsClient NetworkSecurityGroupsClient - vnetsClient VirtualNetworksClient - subnetsClient SubnetsClient - routeTablesClient RouteTablesClient - vmscaleSetsClient VMScaleSetsClient - vmscaleSetVMsClient VMScaleSetVMsClient - disksClient DisksClient - roleAssignmentsClient RoleAssignmentsClient - networkInterfacesClient NetworkInterfacesClient - loadBalancersClient LoadBalancersClient - publicIPAddressesClient PublicIPAddressesClient + subscriptionID string + location string + tags map[string]string + resourceGroupsClient ResourceGroupsClient + networkSecurityGroupsClient NetworkSecurityGroupsClient + applicationSecurityGroupsClient ApplicationSecurityGroupsClient + vnetsClient VirtualNetworksClient + subnetsClient SubnetsClient + routeTablesClient RouteTablesClient + vmscaleSetsClient VMScaleSetsClient + vmscaleSetVMsClient VMScaleSetVMsClient + disksClient DisksClient + roleAssignmentsClient RoleAssignmentsClient + networkInterfacesClient NetworkInterfacesClient + loadBalancersClient LoadBalancersClient + publicIPAddressesClient PublicIPAddressesClient } var _ fi.Cloud = &azureCloudImplementation{} @@ -87,21 +89,22 @@ func NewAzureCloud(subscriptionID, location string, tags map[string]string) (Azu } return &azureCloudImplementation{ - subscriptionID: subscriptionID, - location: location, - tags: tags, - resourceGroupsClient: newResourceGroupsClientImpl(subscriptionID, authorizer), - vnetsClient: newVirtualNetworksClientImpl(subscriptionID, authorizer), - subnetsClient: newSubnetsClientImpl(subscriptionID, authorizer), - routeTablesClient: newRouteTablesClientImpl(subscriptionID, authorizer), - networkSecurityGroupsClient: newNetworkSecurityGroupsClientImpl(subscriptionID, authorizer), - vmscaleSetsClient: newVMScaleSetsClientImpl(subscriptionID, authorizer), - vmscaleSetVMsClient: newVMScaleSetVMsClientImpl(subscriptionID, authorizer), - disksClient: newDisksClientImpl(subscriptionID, authorizer), - roleAssignmentsClient: newRoleAssignmentsClientImpl(subscriptionID, authorizer), - networkInterfacesClient: newNetworkInterfacesClientImpl(subscriptionID, authorizer), - loadBalancersClient: newLoadBalancersClientImpl(subscriptionID, authorizer), - publicIPAddressesClient: newPublicIPAddressesClientImpl(subscriptionID, authorizer), + subscriptionID: subscriptionID, + location: location, + tags: tags, + resourceGroupsClient: newResourceGroupsClientImpl(subscriptionID, authorizer), + vnetsClient: newVirtualNetworksClientImpl(subscriptionID, authorizer), + subnetsClient: newSubnetsClientImpl(subscriptionID, authorizer), + routeTablesClient: newRouteTablesClientImpl(subscriptionID, authorizer), + networkSecurityGroupsClient: newNetworkSecurityGroupsClientImpl(subscriptionID, authorizer), + applicationSecurityGroupsClient: newApplicationSecurityGroupsClientImpl(subscriptionID, authorizer), + vmscaleSetsClient: newVMScaleSetsClientImpl(subscriptionID, authorizer), + vmscaleSetVMsClient: newVMScaleSetVMsClientImpl(subscriptionID, authorizer), + disksClient: newDisksClientImpl(subscriptionID, authorizer), + roleAssignmentsClient: newRoleAssignmentsClientImpl(subscriptionID, authorizer), + networkInterfacesClient: newNetworkInterfacesClientImpl(subscriptionID, authorizer), + loadBalancersClient: newLoadBalancersClientImpl(subscriptionID, authorizer), + publicIPAddressesClient: newPublicIPAddressesClientImpl(subscriptionID, authorizer), }, nil } @@ -293,6 +296,10 @@ func (c *azureCloudImplementation) NetworkSecurityGroup() NetworkSecurityGroupsC return c.networkSecurityGroupsClient } +func (c *azureCloudImplementation) ApplicationSecurityGroup() ApplicationSecurityGroupsClient { + return c.applicationSecurityGroupsClient +} + func (c *azureCloudImplementation) VMScaleSet() VMScaleSetsClient { return c.vmscaleSetsClient } diff --git a/upup/pkg/fi/cloudup/azure/azure_utils.go b/upup/pkg/fi/cloudup/azure/azure_utils.go index d21e68aefec7c..ad317d99b4eb6 100644 --- a/upup/pkg/fi/cloudup/azure/azure_utils.go +++ b/upup/pkg/fi/cloudup/azure/azure_utils.go @@ -100,6 +100,34 @@ func ParseNetworkSecurityGroupID(s string) (*NetworkSecurityGroupID, error) { }, nil } +// ApplicationSecurityGroupID contains the resource ID/names required to construct a ApplicationSecurityGroup ID. +type ApplicationSecurityGroupID struct { + SubscriptionID string + ResourceGroupName string + ApplicationSecurityGroupName string +} + +// String returns the ApplicationSecurityGroup ID in the path format. +func (s *ApplicationSecurityGroupID) String() string { + return fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Network/applicationSecurityGroups/%s", + s.SubscriptionID, + s.ResourceGroupName, + s.ApplicationSecurityGroupName) +} + +// ParseApplicationSecurityGroupID parses a given ApplicationSecurityGroup ID string and returns a ApplicationSecurityGroup ID. +func ParseApplicationSecurityGroupID(s string) (*ApplicationSecurityGroupID, error) { + l := strings.Split(s, "/") + if len(l) != 9 { + return nil, fmt.Errorf("malformed format of ApplicationSecurityGroup ID: %s, %d", s, len(l)) + } + return &ApplicationSecurityGroupID{ + SubscriptionID: l[2], + ResourceGroupName: l[4], + ApplicationSecurityGroupName: l[8], + }, nil +} + // LoadBalancerID contains the resource ID/names required to construct a load balancer ID. type LoadBalancerID struct { SubscriptionID string diff --git a/upup/pkg/fi/cloudup/azuretasks/applicationsecuritygroup.go b/upup/pkg/fi/cloudup/azuretasks/applicationsecuritygroup.go new file mode 100644 index 0000000000000..23ca0538171cd --- /dev/null +++ b/upup/pkg/fi/cloudup/azuretasks/applicationsecuritygroup.go @@ -0,0 +1,135 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package azuretasks + +import ( + "context" + + "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2022-05-01/network" + "github.com/Azure/go-autorest/autorest/to" + "k8s.io/klog/v2" + "k8s.io/kops/upup/pkg/fi" + "k8s.io/kops/upup/pkg/fi/cloudup/azure" +) + +// ApplicationSecurityGroup is an Azure Cloud Application Security Group +// +kops:fitask +type ApplicationSecurityGroup struct { + Name *string + ID *string + Lifecycle fi.Lifecycle + ResourceGroup *ResourceGroup + + Tags map[string]*string +} + +var ( + _ fi.CloudupTask = &ApplicationSecurityGroup{} + _ fi.CompareWithID = &ApplicationSecurityGroup{} + _ fi.CloudupTaskNormalize = &ApplicationSecurityGroup{} +) + +// CompareWithID returns the Name of the Application Security Group +func (asg *ApplicationSecurityGroup) CompareWithID() *string { + return asg.ID +} + +// Find discovers the Application Security Group in the cloud provider +func (asg *ApplicationSecurityGroup) Find(c *fi.CloudupContext) (*ApplicationSecurityGroup, error) { + cloud := c.T.Cloud.(azure.AzureCloud) + l, err := cloud.ApplicationSecurityGroup().List(context.TODO(), *asg.ResourceGroup.Name) + if err != nil { + return nil, err + } + var found *network.ApplicationSecurityGroup + for _, v := range l { + if *v.Name == *asg.Name { + found = &v + break + } + } + if found == nil { + return nil, nil + } + + asg.ID = found.ID + + return &ApplicationSecurityGroup{ + Name: asg.Name, + Lifecycle: asg.Lifecycle, + ResourceGroup: &ResourceGroup{ + Name: asg.ResourceGroup.Name, + }, + ID: found.ID, + Tags: found.Tags, + }, nil +} + +func (asg *ApplicationSecurityGroup) Normalize(c *fi.CloudupContext) error { + c.T.Cloud.(azure.AzureCloud).AddClusterTags(asg.Tags) + return nil +} + +// Run implements fi.Task.Run. +func (asg *ApplicationSecurityGroup) Run(c *fi.CloudupContext) error { + return fi.CloudupDefaultDeltaRunMethod(asg, c) +} + +// CheckChanges returns an error if a change is not allowed. +func (*ApplicationSecurityGroup) CheckChanges(a, e, changes *ApplicationSecurityGroup) error { + if a == nil { + // Check if required fields are set when a new resource is created. + if e.Name == nil { + return fi.RequiredField("Name") + } + return nil + } + + // Check if unchangeable fields won't be changed. + if changes.Name != nil { + return fi.CannotChangeField("Name") + } + return nil +} + +// RenderAzure creates or updates a Application Security Group. +func (*ApplicationSecurityGroup) RenderAzure(t *azure.AzureAPITarget, a, e, changes *ApplicationSecurityGroup) error { + if a == nil { + klog.Infof("Creating a new Application Security Group with name: %s", fi.ValueOf(e.Name)) + } else { + klog.Infof("Updating a Application Security Group with name: %s", fi.ValueOf(e.Name)) + } + + p := network.ApplicationSecurityGroup{ + Location: to.StringPtr(t.Cloud.Region()), + Name: to.StringPtr(*e.Name), + Tags: e.Tags, + } + + asg, err := t.Cloud.ApplicationSecurityGroup().CreateOrUpdate( + context.TODO(), + *e.ResourceGroup.Name, + *e.Name, + p) + if err != nil { + return err + } + + e.ID = asg.ID + + return nil +} diff --git a/upup/pkg/fi/cloudup/azuretasks/applicationsecuritygroup_fitask.go b/upup/pkg/fi/cloudup/azuretasks/applicationsecuritygroup_fitask.go new file mode 100644 index 0000000000000..9a1bfcf8e8b01 --- /dev/null +++ b/upup/pkg/fi/cloudup/azuretasks/applicationsecuritygroup_fitask.go @@ -0,0 +1,52 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by fitask. DO NOT EDIT. + +package azuretasks + +import ( + "k8s.io/kops/upup/pkg/fi" +) + +// ApplicationSecurityGroup + +var _ fi.HasLifecycle = &ApplicationSecurityGroup{} + +// GetLifecycle returns the Lifecycle of the object, implementing fi.HasLifecycle +func (o *ApplicationSecurityGroup) GetLifecycle() fi.Lifecycle { + return o.Lifecycle +} + +// SetLifecycle sets the Lifecycle of the object, implementing fi.SetLifecycle +func (o *ApplicationSecurityGroup) SetLifecycle(lifecycle fi.Lifecycle) { + o.Lifecycle = lifecycle +} + +var _ fi.HasName = &ApplicationSecurityGroup{} + +// GetName returns the Name of the object, implementing fi.HasName +func (o *ApplicationSecurityGroup) GetName() *string { + return o.Name +} + +// String is the stringer function for the task, producing readable output using fi.TaskAsString +func (o *ApplicationSecurityGroup) String() string { + return fi.CloudupTaskAsString(o) +} diff --git a/upup/pkg/fi/cloudup/azuretasks/testing.go b/upup/pkg/fi/cloudup/azuretasks/testing.go index 0ceb2a6e8b27c..67b76e146d67f 100644 --- a/upup/pkg/fi/cloudup/azuretasks/testing.go +++ b/upup/pkg/fi/cloudup/azuretasks/testing.go @@ -46,19 +46,20 @@ const ( // MockAzureCloud is a mock implementation of AzureCloud. type MockAzureCloud struct { - Location string - ResourceGroupsClient *MockResourceGroupsClient - VirtualNetworksClient *MockVirtualNetworksClient - SubnetsClient *MockSubnetsClient - RouteTablesClient *MockRouteTablesClient - NetworkSecurityGroupsClient *MockNetworkSecurityGroupsClient - VMScaleSetsClient *MockVMScaleSetsClient - VMScaleSetVMsClient *MockVMScaleSetVMsClient - DisksClient *MockDisksClient - RoleAssignmentsClient *MockRoleAssignmentsClient - NetworkInterfacesClient *MockNetworkInterfacesClient - LoadBalancersClient *MockLoadBalancersClient - PublicIPAddressesClient *MockPublicIPAddressesClient + Location string + ResourceGroupsClient *MockResourceGroupsClient + VirtualNetworksClient *MockVirtualNetworksClient + SubnetsClient *MockSubnetsClient + RouteTablesClient *MockRouteTablesClient + NetworkSecurityGroupsClient *MockNetworkSecurityGroupsClient + ApplicationSecurityGroupsClient *MockApplicationSecurityGroupsClient + VMScaleSetsClient *MockVMScaleSetsClient + VMScaleSetVMsClient *MockVMScaleSetVMsClient + DisksClient *MockDisksClient + RoleAssignmentsClient *MockRoleAssignmentsClient + NetworkInterfacesClient *MockNetworkInterfacesClient + LoadBalancersClient *MockLoadBalancersClient + PublicIPAddressesClient *MockPublicIPAddressesClient } var _ azure.AzureCloud = &MockAzureCloud{} @@ -82,6 +83,9 @@ func NewMockAzureCloud(location string) *MockAzureCloud { NetworkSecurityGroupsClient: &MockNetworkSecurityGroupsClient{ NSGs: map[string]network.SecurityGroup{}, }, + ApplicationSecurityGroupsClient: &MockApplicationSecurityGroupsClient{ + ASGs: map[string]network.ApplicationSecurityGroup{}, + }, VMScaleSetsClient: &MockVMScaleSetsClient{ VMSSes: map[string]compute.VirtualMachineScaleSet{}, }, @@ -199,11 +203,16 @@ func (c *MockAzureCloud) RouteTable() azure.RouteTablesClient { return c.RouteTablesClient } -// NetworkSecurityGroup returns the VM Scale Set client. +// NetworkSecurityGroup returns the Network Security Group client. func (c *MockAzureCloud) NetworkSecurityGroup() azure.NetworkSecurityGroupsClient { return c.NetworkSecurityGroupsClient } +// ApplicationSecurityGroup returns the Application Security Group client. +func (c *MockAzureCloud) ApplicationSecurityGroup() azure.ApplicationSecurityGroupsClient { + return c.ApplicationSecurityGroupsClient +} + // VMScaleSet returns the VM Scale Set client. func (c *MockAzureCloud) VMScaleSet() azure.VMScaleSetsClient { return c.VMScaleSetsClient @@ -640,13 +649,13 @@ type MockNetworkSecurityGroupsClient struct { var _ azure.NetworkSecurityGroupsClient = &MockNetworkSecurityGroupsClient{} // CreateOrUpdate creates or updates a Network Security Group. -func (c *MockNetworkSecurityGroupsClient) CreateOrUpdate(ctx context.Context, resourceGroupName, asgName string, parameters network.SecurityGroup) (*network.SecurityGroup, error) { +func (c *MockNetworkSecurityGroupsClient) CreateOrUpdate(ctx context.Context, resourceGroupName, nsgName string, parameters network.SecurityGroup) (*network.SecurityGroup, error) { // Ignore resourceGroupName for simplicity. - if _, ok := c.NSGs[asgName]; ok { + if _, ok := c.NSGs[nsgName]; ok { return nil, fmt.Errorf("update not supported") } - parameters.Name = &asgName - c.NSGs[asgName] = parameters + parameters.Name = &nsgName + c.NSGs[nsgName] = parameters return ¶meters, nil } @@ -677,3 +686,49 @@ func (c *MockNetworkSecurityGroupsClient) Delete(ctx context.Context, resourceGr delete(c.NSGs, nsgName) return nil } + +// MockApplicationSecurityGroupsClient is a mock implementation of Application Security Group client. +type MockApplicationSecurityGroupsClient struct { + ASGs map[string]network.ApplicationSecurityGroup +} + +var _ azure.ApplicationSecurityGroupsClient = &MockApplicationSecurityGroupsClient{} + +// CreateOrUpdate creates or updates a Application Security Group. +func (c *MockApplicationSecurityGroupsClient) CreateOrUpdate(ctx context.Context, resourceGroupName, asgName string, parameters network.ApplicationSecurityGroup) (*network.ApplicationSecurityGroup, error) { + // Ignore resourceGroupName for simplicity. + if _, ok := c.ASGs[asgName]; ok { + return nil, fmt.Errorf("update not supported") + } + parameters.Name = &asgName + c.ASGs[asgName] = parameters + return ¶meters, nil +} + +// List returns a slice of Application Security Groups. +func (c *MockApplicationSecurityGroupsClient) List(ctx context.Context, resourceGroupName string) ([]network.ApplicationSecurityGroup, error) { + var l []network.ApplicationSecurityGroup + for _, nsg := range c.ASGs { + l = append(l, nsg) + } + return l, nil +} + +// Get Returns a specified Application Security Group. +func (c *MockApplicationSecurityGroupsClient) Get(ctx context.Context, resourceGroupName string, asgName string) (*network.ApplicationSecurityGroup, error) { + asg, ok := c.ASGs[asgName] + if !ok { + return nil, nil + } + return &asg, nil +} + +// Delete deletes a specified Application Security Group. +func (c *MockApplicationSecurityGroupsClient) Delete(ctx context.Context, resourceGroupName, asgName string) error { + // Ignore resourceGroupName for simplicity. + if _, ok := c.ASGs[asgName]; !ok { + return fmt.Errorf("%s does not exist", asgName) + } + delete(c.ASGs, asgName) + return nil +} diff --git a/upup/pkg/fi/cloudup/azuretasks/vmscaleset.go b/upup/pkg/fi/cloudup/azuretasks/vmscaleset.go index 752c3a1fdb60a..727c4ef322134 100644 --- a/upup/pkg/fi/cloudup/azuretasks/vmscaleset.go +++ b/upup/pkg/fi/cloudup/azuretasks/vmscaleset.go @@ -35,10 +35,11 @@ type VMScaleSet struct { Name *string Lifecycle fi.Lifecycle - ResourceGroup *ResourceGroup - VirtualNetwork *VirtualNetwork - Subnet *Subnet - StorageProfile *VMScaleSetStorageProfile + ResourceGroup *ResourceGroup + VirtualNetwork *VirtualNetwork + Subnet *Subnet + ApplicationSecurityGroups []*ApplicationSecurityGroup + StorageProfile *VMScaleSetStorageProfile // RequirePublicIP is set to true when VMs require public IPs. RequirePublicIP *bool // LoadBalancer is the Load Balancer object the VMs will use. @@ -167,6 +168,13 @@ func (s *VMScaleSet) Find(c *fi.CloudupContext) (*VMScaleSet, error) { Tags: found.Tags, PrincipalID: found.Identity.PrincipalID, } + if ipConfig.ApplicationSecurityGroups != nil { + for _, asg := range *ipConfig.ApplicationSecurityGroups { + vmss.ApplicationSecurityGroups = append(vmss.ApplicationSecurityGroups, &ApplicationSecurityGroup{ + ID: asg.ID, + }) + } + } if loadBalancerID != nil { vmss.LoadBalancer = &LoadBalancer{ Name: to.StringPtr(loadBalancerID.LoadBalancerName), @@ -247,12 +255,19 @@ func (s *VMScaleSet) RenderAzure(t *azure.AzureAPITarget, a, e, changes *VMScale VirtualNetworkName: *e.VirtualNetwork.Name, SubnetName: *e.Subnet.Name, } + var asgs []compute.SubResource + for _, asg := range e.ApplicationSecurityGroups { + asgs = append(asgs, compute.SubResource{ + ID: asg.ID, + }) + } ipConfigProperties := &compute.VirtualMachineScaleSetIPConfigurationProperties{ Subnet: &compute.APIEntityReference{ ID: to.StringPtr(subnetID.String()), }, - Primary: to.BoolPtr(true), - PrivateIPAddressVersion: compute.IPv4, + Primary: to.BoolPtr(true), + PrivateIPAddressVersion: compute.IPv4, + ApplicationSecurityGroups: &asgs, } if *e.RequirePublicIP { ipConfigProperties.PublicIPAddressConfiguration = &compute.VirtualMachineScaleSetPublicIPAddressConfiguration{