Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit b8964b0

Browse files
changhyunichanghyuni
committedJan 9, 2025·
inboud_security_groups
Add referencing existing security groups for inbound traffic Add referencing existing security groups for inbound traffic Add inboud security groups Add inboud security group Add annotation
1 parent 9e2cbe7 commit b8964b0

File tree

6 files changed

+263
-83
lines changed

6 files changed

+263
-83
lines changed
 

‎docs/guide/ingress/annotations.md

+18
Original file line numberDiff line numberDiff line change
@@ -530,6 +530,24 @@ Access control for LoadBalancer can be controlled with following annotations:
530530
```
531531
alb.ingress.kubernetes.io/inbound-cidrs: 10.0.0.0/24
532532
```
533+
- <a name="inbound-security-groups">`alb.ingress.kubernetes.io/inbound-security-groups`</a> specifies the SecurtityGroups that are allowed to access LoadBalancer.
534+
535+
!!!note "Merge Behavior"
536+
`inbound-security-groups` is merged across all Ingresses in IngressGroup, but is exclusive per listen-port.
537+
538+
- the `inbound-security-groups` will only impact the ports defined for that Ingress.
539+
- if same listen-port is defined by multiple Ingress within IngressGroup, `inbound-security-groups` should only be defined on one of the Ingress.
540+
541+
!!!warning ""
542+
this annotation will be ignored if `alb.ingress.kubernetes.io/security-groups` is specified.
543+
544+
!!!tip ""
545+
Both name or ID of securityGroups are supported. Name matches a `Name` tag, not the `groupName` attribute.
546+
547+
!!!example
548+
```
549+
alb.ingress.kubernetes.io/inbound-security-groups: sg-xxxx, nameOfSg1, nameOfSg2
550+
```
533551

534552
- <a name="security-group-prefix-lists">`alb.ingress.kubernetes.io/security-group-prefix-lists`</a> specifies the managed prefix lists that are allowed to access LoadBalancer.
535553

‎pkg/annotations/constants.go

+46-42
Original file line numberDiff line numberDiff line change
@@ -6,48 +6,52 @@ const (
66

77
AnnotationPrefixIngress = "alb.ingress.kubernetes.io"
88
// Ingress annotation suffixes
9-
IngressSuffixLoadBalancerName = "load-balancer-name"
10-
IngressSuffixGroupName = "group.name"
11-
IngressSuffixGroupOrder = "group.order"
12-
IngressSuffixTags = "tags"
13-
IngressSuffixIPAddressType = "ip-address-type"
14-
IngressSuffixScheme = "scheme"
15-
IngressSuffixSubnets = "subnets"
16-
IngressSuffixCustomerOwnedIPv4Pool = "customer-owned-ipv4-pool"
17-
IngressSuffixLoadBalancerAttributes = "load-balancer-attributes"
18-
IngressSuffixWAFv2ACLARN = "wafv2-acl-arn"
19-
IngressSuffixWAFACLID = "waf-acl-id"
20-
IngressSuffixWebACLID = "web-acl-id" // deprecated, use "waf-acl-id" instead.
21-
IngressSuffixShieldAdvancedProtection = "shield-advanced-protection"
22-
IngressSuffixSecurityGroups = "security-groups"
23-
IngressSuffixListenPorts = "listen-ports"
24-
IngressSuffixSSLRedirect = "ssl-redirect"
25-
IngressSuffixInboundCIDRs = "inbound-cidrs"
26-
IngressSuffixCertificateARN = "certificate-arn"
27-
IngressSuffixSSLPolicy = "ssl-policy"
28-
IngressSuffixTargetType = "target-type"
29-
IngressSuffixBackendProtocol = "backend-protocol"
30-
IngressSuffixBackendProtocolVersion = "backend-protocol-version"
31-
IngressSuffixTargetGroupAttributes = "target-group-attributes"
32-
IngressSuffixHealthCheckPort = "healthcheck-port"
33-
IngressSuffixHealthCheckProtocol = "healthcheck-protocol"
34-
IngressSuffixHealthCheckPath = "healthcheck-path"
35-
IngressSuffixHealthCheckIntervalSeconds = "healthcheck-interval-seconds"
36-
IngressSuffixHealthCheckTimeoutSeconds = "healthcheck-timeout-seconds"
37-
IngressSuffixHealthyThresholdCount = "healthy-threshold-count"
38-
IngressSuffixUnhealthyThresholdCount = "unhealthy-threshold-count"
39-
IngressSuffixSuccessCodes = "success-codes"
40-
IngressSuffixAuthType = "auth-type"
41-
IngressSuffixAuthIDPCognito = "auth-idp-cognito"
42-
IngressSuffixAuthIDPOIDC = "auth-idp-oidc"
43-
IngressSuffixAuthOnUnauthenticatedRequest = "auth-on-unauthenticated-request"
44-
IngressSuffixAuthScope = "auth-scope"
45-
IngressSuffixAuthSessionCookie = "auth-session-cookie"
46-
IngressSuffixAuthSessionTimeout = "auth-session-timeout"
47-
IngressSuffixTargetNodeLabels = "target-node-labels"
48-
IngressSuffixManageSecurityGroupRules = "manage-backend-security-group-rules"
49-
IngressSuffixMutualAuthentication = "mutual-authentication"
50-
IngressSuffixSecurityGroupPrefixLists = "security-group-prefix-lists"
9+
IngressSuffixLoadBalancerName = "load-balancer-name"
10+
IngressSuffixGroupName = "group.name"
11+
IngressSuffixGroupOrder = "group.order"
12+
IngressSuffixTags = "tags"
13+
IngressSuffixIPAddressType = "ip-address-type"
14+
IngressSuffixScheme = "scheme"
15+
IngressSuffixSubnets = "subnets"
16+
IngressSuffixCustomerOwnedIPv4Pool = "customer-owned-ipv4-pool"
17+
IngressSuffixLoadBalancerAttributes = "load-balancer-attributes"
18+
IngressSuffixWAFv2ACLARN = "wafv2-acl-arn"
19+
IngressSuffixWAFACLID = "waf-acl-id"
20+
IngressSuffixWebACLID = "web-acl-id" // deprecated, use "waf-acl-id" instead.
21+
IngressSuffixShieldAdvancedProtection = "shield-advanced-protection"
22+
IngressSuffixSecurityGroups = "security-groups"
23+
IngressSuffixListenPorts = "listen-ports"
24+
IngressSuffixSSLRedirect = "ssl-redirect"
25+
IngressSuffixInboundCIDRs = "inbound-cidrs"
26+
IngressSuffixCertificateARN = "certificate-arn"
27+
IngressSuffixSSLPolicy = "ssl-policy"
28+
IngressSuffixTargetType = "target-type"
29+
IngressSuffixBackendProtocol = "backend-protocol"
30+
IngressSuffixBackendProtocolVersion = "backend-protocol-version"
31+
IngressSuffixTargetGroupAttributes = "target-group-attributes"
32+
IngressSuffixHealthCheckPort = "healthcheck-port"
33+
IngressSuffixHealthCheckProtocol = "healthcheck-protocol"
34+
IngressSuffixHealthCheckPath = "healthcheck-path"
35+
IngressSuffixHealthCheckIntervalSeconds = "healthcheck-interval-seconds"
36+
IngressSuffixHealthCheckTimeoutSeconds = "healthcheck-timeout-seconds"
37+
IngressSuffixHealthyThresholdCount = "healthy-threshold-count"
38+
IngressSuffixUnhealthyThresholdCount = "unhealthy-threshold-count"
39+
IngressSuffixSuccessCodes = "success-codes"
40+
IngressSuffixAuthType = "auth-type"
41+
IngressSuffixAuthIDPCognito = "auth-idp-cognito"
42+
IngressSuffixAuthIDPOIDC = "auth-idp-oidc"
43+
IngressSuffixAuthOnUnauthenticatedRequest = "auth-on-unauthenticated-request"
44+
IngressSuffixAuthScope = "auth-scope"
45+
IngressSuffixAuthSessionCookie = "auth-session-cookie"
46+
IngressSuffixAuthSessionTimeout = "auth-session-timeout"
47+
IngressSuffixTargetNodeLabels = "target-node-labels"
48+
IngressSuffixManageSecurityGroupRules = "manage-backend-security-group-rules"
49+
IngressSuffixMutualAuthentication = "mutual-authentication"
50+
IngressSuffixSecurityGroupPrefixLists = "security-group-prefix-lists"
51+
IngressSuffixlsAttsAnnotationPrefix = "listener-attributes"
52+
IngressLBSuffixMultiClusterTargetGroup = "multi-cluster-target-group"
53+
IngressSuffixLoadBalancerCapacityReservation = "minimum-load-balancer-capacity"
54+
IngressSuffixInboundSecurityGroups = "inbound-security-groups"
5155

5256
// NLB annotation suffixes
5357
// prefixes service.beta.kubernetes.io, service.kubernetes.io

‎pkg/ingress/model_build_listener.go

+27-4
Original file line numberDiff line numberDiff line change
@@ -107,17 +107,25 @@ type listenPortConfig struct {
107107
sslPolicy *string
108108
tlsCerts []string
109109
mutualAuthentication *elbv2model.MutualAuthenticationAttributes
110+
securityGroupIDs []string
110111
}
111112

112113
func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context.Context, ing *ClassifiedIngress) (map[int64]listenPortConfig, error) {
113114
explicitTLSCertARNs := t.computeIngressExplicitTLSCertARNs(ctx, ing)
114115
explicitSSLPolicy := t.computeIngressExplicitSSLPolicy(ctx, ing)
115116
var prefixListIDs []string
116117
t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixSecurityGroupPrefixLists, &prefixListIDs, ing.Ing.Annotations)
118+
119+
securityGroupIDs, err := t.computeIngressExplicitSecurityGroupIDs(ctx, ing)
120+
if err != nil {
121+
return nil, err
122+
}
123+
117124
inboundCIDRv4s, inboundCIDRV6s, err := t.computeIngressExplicitInboundCIDRs(ctx, ing)
118125
if err != nil {
119126
return nil, err
120127
}
128+
121129
mutualAuthenticationAttributes, err := t.computeIngressMutualAuthentication(ctx, ing)
122130
if err != nil {
123131
return nil, err
@@ -146,10 +154,11 @@ func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context
146154
listenPortConfigByPort := make(map[int64]listenPortConfig, len(listenPorts))
147155
for port, protocol := range listenPorts {
148156
cfg := listenPortConfig{
149-
protocol: protocol,
150-
inboundCIDRv4s: inboundCIDRv4s,
151-
inboundCIDRv6s: inboundCIDRV6s,
152-
prefixLists: prefixListIDs,
157+
protocol: protocol,
158+
inboundCIDRv4s: inboundCIDRv4s,
159+
inboundCIDRv6s: inboundCIDRV6s,
160+
prefixLists: prefixListIDs,
161+
securityGroupIDs: securityGroupIDs,
153162
}
154163
if protocol == elbv2model.ProtocolHTTPS {
155164
if len(explicitTLSCertARNs) == 0 {
@@ -225,6 +234,20 @@ func (t *defaultModelBuildTask) computeIngressListenPorts(_ context.Context, ing
225234
return portAndProtocols, nil
226235
}
227236

237+
func (t *defaultModelBuildTask) computeIngressExplicitSecurityGroupIDs(ctx context.Context, ing *ClassifiedIngress) ([]string, error) {
238+
var rawSecurityGroups []string
239+
if exists := t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixInboundSecurityGroups, &rawSecurityGroups, ing.Ing.Annotations); !exists {
240+
return nil, nil
241+
}
242+
243+
securityGroupIDs, err := t.sgResolver.ResolveViaNameOrID(ctx, rawSecurityGroups)
244+
if err != nil {
245+
return nil, fmt.Errorf("invalid %v settings on Ingress: %v: %w", annotations.IngressSuffixInboundSecurityGroups, k8s.NamespacedName(ing.Ing), err)
246+
}
247+
248+
return securityGroupIDs, nil
249+
}
250+
228251
func (t *defaultModelBuildTask) computeIngressExplicitInboundCIDRs(_ context.Context, ing *ClassifiedIngress) ([]string, []string, error) {
229252
var rawInboundCIDRs []string
230253
fromIngressClassParams := false

‎pkg/ingress/model_build_managed_sg.go

+12
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,18 @@ func (t *defaultModelBuildTask) buildManagedSecurityGroupIngressPermissions(_ co
109109
},
110110
})
111111
}
112+
for _, sgID := range cfg.securityGroupIDs {
113+
permissions = append(permissions, ec2model.IPPermission{
114+
IPProtocol: "tcp",
115+
FromPort: awssdk.Int64(port),
116+
ToPort: awssdk.Int64(port),
117+
UserIDGroupPairs: []ec2model.UserIDGroupPair{
118+
{
119+
GroupID: sgID,
120+
},
121+
},
122+
})
123+
}
112124
}
113125
return permissions
114126
}

‎pkg/ingress/model_builder.go

+15
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,9 @@ func (t *defaultModelBuildTask) mergeListenPortConfigs(_ context.Context, listen
310310
var mergedMtlsAttributesProvider *types.NamespacedName
311311
var mergedMtlsAttributes *elbv2model.MutualAuthenticationAttributes
312312

313+
var mergedSecurityGroupProvider *types.NamespacedName
314+
mergedSecurityGroups := sets.NewString()
315+
313316
for _, cfg := range listenPortConfigs {
314317
if mergedProtocolProvider == nil {
315318
mergedProtocolProvider = &cfg.ingKey
@@ -343,6 +346,17 @@ func (t *defaultModelBuildTask) mergeListenPortConfigs(_ context.Context, listen
343346
}
344347
}
345348

349+
if len(cfg.listenPortConfig.securityGroupIDs) != 0 {
350+
cfgSecurityGroups := sets.NewString(cfg.listenPortConfig.securityGroupIDs...)
351+
if mergedSecurityGroupProvider == nil {
352+
mergedSecurityGroupProvider = &cfg.ingKey
353+
mergedSecurityGroups = cfgSecurityGroups
354+
} else if !mergedSecurityGroups.Equal(cfgSecurityGroups) {
355+
return listenPortConfig{}, errors.Errorf("conflicting security groups, %v: %v | %v: %v",
356+
*mergedSecurityGroupProvider, mergedSecurityGroups.List(), cfg.ingKey, cfgSecurityGroups.List())
357+
}
358+
}
359+
346360
if cfg.listenPortConfig.sslPolicy != nil {
347361
if mergedSSLPolicyProvider == nil {
348362
mergedSSLPolicyProvider = &cfg.ingKey
@@ -389,6 +403,7 @@ func (t *defaultModelBuildTask) mergeListenPortConfigs(_ context.Context, listen
389403
sslPolicy: mergedSSLPolicy,
390404
tlsCerts: mergedTLSCerts,
391405
mutualAuthentication: mergedMtlsAttributes,
406+
securityGroupIDs: mergedSecurityGroups.List(),
392407
}, nil
393408
}
394409

0 commit comments

Comments
 (0)
Please sign in to comment.