Security Group support for OpenStack Load Balancers #31921
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Can a kubernetes member verify that this patch is reasonable Regular contributors should join the org to skip this step. |
k8s-github-robot
added
size/L
grahamhayes
force-pushed
the
openstack-loadbalancer-security-groups
branch
3 times, most recently
from
ddbe005
to
2334c44
Compare
grahamhayes
changed the title
|
/cc @kubernetes/sig-openstack |
grahamhayes
force-pushed
the
openstack-loadbalancer-security-groups
branch
from
2334c44
to
b7b4cce
Compare
k8s-github-robot
added
size/XXL
grahamhayes
force-pushed
the
openstack-loadbalancer-security-groups
branch
2 times, most recently
from
59f1ec2
to
cb39b80
Compare
k8s-github-robot
added
size/L
grahamhayes
force-pushed
the
openstack-loadbalancer-security-groups
branch
from
cb39b80
to
19fcb91
Compare
| return false, err | ||
| } | ||
|
|
||
| for _, rule := range ruleList { |
There was a problem hiding this comment.
Extremely minor point, but you can append lists with:
securityRules = append(securityRules, ruleList...)
To deal with Security Groups in kubernetes we need the gophercloud code for groups and rules. This adds the required vendored code
dagnello
force-pushed
the
openstack-loadbalancer-security-groups
branch
from
e5c1b1e
to
79523c3
Compare
|
@anguslees this pr has been rebased and is ready to merge. thanks |
k8s-github-robot
removed
the
needs-rebase
|
@k8s-bot gci gce e2e test this |
mikedanese
added
lgtm
|
ok to test pr builder appears to be missing, activating due to 'lgtm' label. |
1 similar comment
|
ok to test pr builder appears to be missing, activating due to 'lgtm' label. |
|
Jenkins verification failed for commit 79523c3. Full PR test history. The magic incantation to run this job again is |
|
Jenkins GKE smoke e2e failed for commit 79523c3. Full PR test history. The magic incantation to run this job again is |
This allows security groups to be created and attached to the neutron port that the loadbalancer is using on the subnet. The security group ID that is assigned to the nodes needs to be provided, to allow for traffic from the loadbalancer to the nodePort to be refelected in the rules. This adds two config items to the LoadBalancer options - ManageSecurityGroups (bool) NodeSecurityGroupID (string)
dagnello
force-pushed
the
openstack-loadbalancer-security-groups
branch
from
79523c3
to
ac20518
Compare
k8s-github-robot
removed
the
lgtm
|
/lgtm |
k8s-github-robot
added
the
lgtm
|
@k8s-bot test this [submit-queue is verifying that this PR is safe to merge] |
|
Automatic merge from submit-queue |
dims
pushed a commit
to dims/kubernetes
that referenced
this pull request
Feb 8, 2018
…lancer-security-groups Automatic merge from submit-queue Security Group support for OpenStack Load Balancers <!-- Thanks for sending a pull request! Here are some tips for you: 1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md 2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md 3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes --> **Add Security Group Support for OpenStack Load Balancers**: fixes kubernetes#29745 adds OpenStack support to the work done in kubernetes#20392 **Release note**: ``` This allows security groups to be created and attached to the neutron port that the load balancer is using on the subnet. The security group ID that is assigned to the nodes needs to be provided, to allow for traffic from the load balancer to the nodePort to be reflected in the rules. This adds two config items to the LoadBalancer options - ManageSecurityGroups (bool) NodeSecurityGroupID (string) ```
stefannica
added a commit
to stefannica/skuba
that referenced
this pull request
Jun 22, 2020
When the OpenStack cloud provider is enabled, all cloud load balancer instances created to reflect LoadBalancer type services are automatically associated with the default security group in the OpenStack project specified in the cloud provider configuration. There is a cloud provider setting, manage-security-groups [1], that can be enabled to allow the kubernetes OpenStack cloud provider to manage load balancer security group rules automatically to match the service ports. The node-security-group setting has been deprecated [2] and is not required anymore. [1] kubernetes/kubernetes#31921 [2] kubernetes/kubernetes#58145
stefannica
added a commit
to stefannica/skuba
that referenced
this pull request
Jun 22, 2020
When the OpenStack cloud provider is enabled, all cloud load balancer instances created to reflect LoadBalancer type services are automatically associated with the default security group in the OpenStack project specified in the cloud provider configuration. There is a cloud provider setting, manage-security-groups [1], that can be enabled to allow the kubernetes OpenStack cloud provider to manage load balancer security group rules automatically to match the service ports. The node-security-group setting has been deprecated [2] and is not required anymore. [1] kubernetes/kubernetes#31921 [2] kubernetes/kubernetes#58145 Signed-off-by: Stefan Nica <snica@suse.com>
stefannica
added a commit
to stefannica/catapult
that referenced
this pull request
Jun 23, 2020
When the OpenStack cloud provider is enabled, all cloud load balancer instances created to reflect LoadBalancer type services are automatically associated with the default security group in the OpenStack project specified in the cloud provider configuration. There is a cloud provider setting, manage-security-groups [1], that can be enabled to allow the kubernetes OpenStack cloud provider to manage load balancer security group rules automatically to match the service ports. The node-security-group setting has been deprecated [2] and is not required anymore. [1] kubernetes/kubernetes#31921 [2] kubernetes/kubernetes#58145 Signed-off-by: Stefan Nica <snica@suse.com>
c3y1huang
pushed a commit
to SUSE/skuba
that referenced
this pull request
Jun 29, 2020
When the OpenStack cloud provider is enabled, all cloud load balancer instances created to reflect LoadBalancer type services are automatically associated with the default security group in the OpenStack project specified in the cloud provider configuration. There is a cloud provider setting, manage-security-groups [1], that can be enabled to allow the kubernetes OpenStack cloud provider to manage load balancer security group rules automatically to match the service ports. The node-security-group setting has been deprecated [2] and is not required anymore. [1] kubernetes/kubernetes#31921 [2] kubernetes/kubernetes#58145 Signed-off-by: Stefan Nica <snica@suse.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add Security Group Support for OpenStack Load Balancers:
fixes #29745
adds OpenStack support to the work done in #20392
Release note:
This change is