Skip to content

Commit

Permalink
Azure: Add network security group rules (testing)
Browse files Browse the repository at this point in the history
  • Loading branch information
@jhixson74
jhixson74 committed Apr 11, 2024
1 parent f0bcd38 commit 8a94b54
Show file tree
Hide file tree
Showing 2 changed files with 153 additions and 0 deletions.
151 changes: 151 additions & 0 deletions pkg/asset/manifests/azure/cluster.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (
"github.com/pkg/errors"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/utils/ptr"
capz "sigs.k8s.io/cluster-api-provider-azure/api/v1beta1"

"github.com/openshift/installer/pkg/asset"
Expand Down Expand Up @@ -85,6 +86,81 @@ func GenerateClusterAssets(installConfig *installconfig.InstallConfig, clusterID
subnets[0].String(),
},
},
SecurityGroup: capz.SecurityGroup{
Name: fmt.Sprintf("%s-nsg", clusterID.InfraID),
SecurityGroupClass: capz.SecurityGroupClass{
SecurityRules: []capz.SecurityRule{
{
Name: "everything",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 100,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("*"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
/*
{
Name: "apiserver_in",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 101,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("6443"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
{
Name: "ignition",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 102,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("22623"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
{
Name: "ssh",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 103,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("22"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
{
Name: "http",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 104,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("80"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
{
Name: "https",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 105,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("443"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
*/
},
},
},
},
{
SubnetClassSpec: capz.SubnetClassSpec{
Expand All @@ -94,6 +170,81 @@ func GenerateClusterAssets(installConfig *installconfig.InstallConfig, clusterID
subnets[1].String(),
},
},
SecurityGroup: capz.SecurityGroup{
Name: fmt.Sprintf("%s-worker-nsg", clusterID.InfraID),
SecurityGroupClass: capz.SecurityGroupClass{
SecurityRules: []capz.SecurityRule{
{
Name: "everything",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 100,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("*"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
/*
{
Name: "apiserver_in",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 101,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("6443"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
{
Name: "ignition",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 102,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("22623"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
{
Name: "ssh",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 103,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("22"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
{
Name: "http",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 104,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("80"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
{
Name: "https",
Protocol: capz.SecurityGroupProtocolTCP,
Direction: capz.SecurityRuleDirectionInbound,
Priority: 105,
SourcePorts: ptr.To("*"),
DestinationPorts: ptr.To("443"),
Source: ptr.To("*"),
Destination: ptr.To("*"),
Action: capz.SecurityRuleActionAllow,
},
*/
},
},
},
},
},
},
Expand Down
2 changes: 2 additions & 0 deletions pkg/infrastructure/azure/azure.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -547,10 +547,12 @@ func (p Provider) Ignition(ctx context.Context, in clusterapi.IgnitionInput) ([]
if err != nil {
return nil, err
}
logrus.Debugf("XXX: sasURL=%s", sasURL)
ignShim, err := bootstrap.GenerateIgnitionShimWithCertBundleAndProxy(sasURL, in.InstallConfig.Config.AdditionalTrustBundle, in.InstallConfig.Config.Proxy)
if err != nil {
return nil, fmt.Errorf("failed to create ignition shim: %w", err)
}
logrus.Debugf("XXX: ignShim=%s", ignShim)

return ignShim, nil
}

0 comments on commit 8a94b54

Please sign in to comment.