Azure: Add network security group rules (testing)

openshift · Apr 10, 2024 · a620c38 · a620c38
1 parent 05dfded
commit a620c38
Show file tree

Hide file tree

Showing 3 changed files with 65 additions and 1 deletion.
diff --git a/pkg/asset/manifests/azure/cluster.go b/pkg/asset/manifests/azure/cluster.go
@@ -6,6 +6,7 @@ import (
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
 	capz "sigs.k8s.io/cluster-api-provider-azure/api/v1beta1"
 
 	"github.com/openshift/installer/pkg/asset"
@@ -85,6 +86,68 @@ func GenerateClusterAssets(installConfig *installconfig.InstallConfig, clusterID
 								subnets[0].String(),
 							},
 						},
+						SecurityGroup: capz.SecurityGroup{
+							Name: fmt.Sprintf("%s-cluster", clusterID.InfraID),
+							SecurityGroupClass: capz.SecurityGroupClass{
+								SecurityRules: []capz.SecurityRule{
+									capz.SecurityRule{
+										Name:             "apiserver_in",
+										Protocol:         capz.SecurityGroupProtocolTCP,
+										Direction:        capz.SecurityRuleDirectionInbound,
+										Priority:         101,
+										SourcePorts:      ptr.To("*"),
+										DestinationPorts: ptr.To("6443"),
+										Source:           ptr.To("*"),
+										Destination:      ptr.To("*"),
+										Action:           capz.SecurityRuleActionAllow,
+									},
+									capz.SecurityRule{
+										Name:             "ignition",
+										Protocol:         capz.SecurityGroupProtocolTCP,
+										Direction:        capz.SecurityRuleDirectionInbound,
+										Priority:         102,
+										SourcePorts:      ptr.To("*"),
+										DestinationPorts: ptr.To("22623"),
+										Source:           ptr.To("*"),
+										Destination:      ptr.To("*"),
+										Action:           capz.SecurityRuleActionAllow,
+									},
+									capz.SecurityRule{
+										Name:             "ssh",
+										Protocol:         capz.SecurityGroupProtocolTCP,
+										Direction:        capz.SecurityRuleDirectionInbound,
+										Priority:         103,
+										SourcePorts:      ptr.To("*"),
+										DestinationPorts: ptr.To("22"),
+										Source:           ptr.To("*"),
+										Destination:      ptr.To("*"),
+										Action:           capz.SecurityRuleActionAllow,
+									},
+									capz.SecurityRule{
+										Name:             "http",
+										Protocol:         capz.SecurityGroupProtocolTCP,
+										Direction:        capz.SecurityRuleDirectionInbound,
+										Priority:         104,
+										SourcePorts:      ptr.To("*"),
+										DestinationPorts: ptr.To("80"),
+										Source:           ptr.To("*"),
+										Destination:      ptr.To("*"),
+										Action:           capz.SecurityRuleActionAllow,
+									},
+									capz.SecurityRule{
+										Name:             "https",
+										Protocol:         capz.SecurityGroupProtocolTCP,
+										Direction:        capz.SecurityRuleDirectionInbound,
+										Priority:         105,
+										SourcePorts:      ptr.To("*"),
+										DestinationPorts: ptr.To("443"),
+										Source:           ptr.To("*"),
+										Destination:      ptr.To("*"),
+										Action:           capz.SecurityRuleActionAllow,
+									},
+								},
+							},
+						},
 					},
 					{
 						SubnetClassSpec: capz.SubnetClassSpec{

diff --git a/pkg/infrastructure/azure/azure.go b/pkg/infrastructure/azure/azure.go
@@ -547,10 +547,12 @@ func (p Provider) Ignition(ctx context.Context, in clusterapi.IgnitionInput) ([]
 	if err != nil {
 		return nil, err
 	}
+	logrus.Debugf("XXX: sasURL=%s", sasURL)
 	ignShim, err := bootstrap.GenerateIgnitionShimWithCertBundleAndProxy(sasURL, in.InstallConfig.Config.AdditionalTrustBundle, in.InstallConfig.Config.Proxy)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create ignition shim: %w", err)
 	}
+	logrus.Debugf("XXX: ignShim=%s", ignShim)
 
 	return ignShim, nil
 }
diff --git a/pkg/infrastructure/azure/storage.go b/pkg/infrastructure/azure/storage.go
@@ -384,6 +384,5 @@ func CreateBlockBlob(ctx context.Context, in *CreateBlockBlobInput) (string, err
 		return "", fmt.Errorf("failed to get SAS URL: %w", err)
 	}
 
-	// XXX what more to do here?
 	return sasURL, nil
 }