Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit d6f16ac

Browse files
changhyunichanghyuni
committedJan 9, 2025·
inboud_security_groups
Add referencing existing security groups for inbound traffic Add referencing existing security groups for inbound traffic Add inboud security groups Add inboud security group
1 parent 9e2cbe7 commit d6f16ac

File tree

6 files changed

+262
-83
lines changed

6 files changed

+262
-83
lines changed
 

‎docs/guide/ingress/annotations.md

+18
Original file line numberDiff line numberDiff line change
@@ -530,6 +530,24 @@ Access control for LoadBalancer can be controlled with following annotations:
530530
```
531531
alb.ingress.kubernetes.io/inbound-cidrs: 10.0.0.0/24
532532
```
533+
- <a name="inbound-security-groups">`alb.ingress.kubernetes.io/inbound-security-groups`</a> specifies the SecurtityGroups that are allowed to access LoadBalancer.
534+
535+
!!!note "Merge Behavior"
536+
`inbound-security-groups` is merged across all Ingresses in IngressGroup, but is exclusive per listen-port.
537+
538+
- the `inbound-security-groups` will only impact the ports defined for that Ingress.
539+
- if same listen-port is defined by multiple Ingress within IngressGroup, `inbound-security-groups` should only be defined on one of the Ingress.
540+
541+
!!!warning ""
542+
this annotation will be ignored if `alb.ingress.kubernetes.io/security-groups` is specified.
543+
544+
!!!tip ""
545+
Both name or ID of securityGroups are supported. Name matches a `Name` tag, not the `groupName` attribute.
546+
547+
!!!example
548+
```
549+
alb.ingress.kubernetes.io/inbound-security-groups: sg-xxxx, nameOfSg1, nameOfSg2
550+
```
533551

534552
- <a name="security-group-prefix-lists">`alb.ingress.kubernetes.io/security-group-prefix-lists`</a> specifies the managed prefix lists that are allowed to access LoadBalancer.
535553

‎pkg/annotations/constants.go

+45-42
Original file line numberDiff line numberDiff line change
@@ -6,48 +6,51 @@ const (
66

77
AnnotationPrefixIngress = "alb.ingress.kubernetes.io"
88
// Ingress annotation suffixes
9-
IngressSuffixLoadBalancerName = "load-balancer-name"
10-
IngressSuffixGroupName = "group.name"
11-
IngressSuffixGroupOrder = "group.order"
12-
IngressSuffixTags = "tags"
13-
IngressSuffixIPAddressType = "ip-address-type"
14-
IngressSuffixScheme = "scheme"
15-
IngressSuffixSubnets = "subnets"
16-
IngressSuffixCustomerOwnedIPv4Pool = "customer-owned-ipv4-pool"
17-
IngressSuffixLoadBalancerAttributes = "load-balancer-attributes"
18-
IngressSuffixWAFv2ACLARN = "wafv2-acl-arn"
19-
IngressSuffixWAFACLID = "waf-acl-id"
20-
IngressSuffixWebACLID = "web-acl-id" // deprecated, use "waf-acl-id" instead.
21-
IngressSuffixShieldAdvancedProtection = "shield-advanced-protection"
22-
IngressSuffixSecurityGroups = "security-groups"
23-
IngressSuffixListenPorts = "listen-ports"
24-
IngressSuffixSSLRedirect = "ssl-redirect"
25-
IngressSuffixInboundCIDRs = "inbound-cidrs"
26-
IngressSuffixCertificateARN = "certificate-arn"
27-
IngressSuffixSSLPolicy = "ssl-policy"
28-
IngressSuffixTargetType = "target-type"
29-
IngressSuffixBackendProtocol = "backend-protocol"
30-
IngressSuffixBackendProtocolVersion = "backend-protocol-version"
31-
IngressSuffixTargetGroupAttributes = "target-group-attributes"
32-
IngressSuffixHealthCheckPort = "healthcheck-port"
33-
IngressSuffixHealthCheckProtocol = "healthcheck-protocol"
34-
IngressSuffixHealthCheckPath = "healthcheck-path"
35-
IngressSuffixHealthCheckIntervalSeconds = "healthcheck-interval-seconds"
36-
IngressSuffixHealthCheckTimeoutSeconds = "healthcheck-timeout-seconds"
37-
IngressSuffixHealthyThresholdCount = "healthy-threshold-count"
38-
IngressSuffixUnhealthyThresholdCount = "unhealthy-threshold-count"
39-
IngressSuffixSuccessCodes = "success-codes"
40-
IngressSuffixAuthType = "auth-type"
41-
IngressSuffixAuthIDPCognito = "auth-idp-cognito"
42-
IngressSuffixAuthIDPOIDC = "auth-idp-oidc"
43-
IngressSuffixAuthOnUnauthenticatedRequest = "auth-on-unauthenticated-request"
44-
IngressSuffixAuthScope = "auth-scope"
45-
IngressSuffixAuthSessionCookie = "auth-session-cookie"
46-
IngressSuffixAuthSessionTimeout = "auth-session-timeout"
47-
IngressSuffixTargetNodeLabels = "target-node-labels"
48-
IngressSuffixManageSecurityGroupRules = "manage-backend-security-group-rules"
49-
IngressSuffixMutualAuthentication = "mutual-authentication"
50-
IngressSuffixSecurityGroupPrefixLists = "security-group-prefix-lists"
9+
IngressSuffixLoadBalancerName = "load-balancer-name"
10+
IngressSuffixGroupName = "group.name"
11+
IngressSuffixGroupOrder = "group.order"
12+
IngressSuffixTags = "tags"
13+
IngressSuffixIPAddressType = "ip-address-type"
14+
IngressSuffixScheme = "scheme"
15+
IngressSuffixSubnets = "subnets"
16+
IngressSuffixCustomerOwnedIPv4Pool = "customer-owned-ipv4-pool"
17+
IngressSuffixLoadBalancerAttributes = "load-balancer-attributes"
18+
IngressSuffixWAFv2ACLARN = "wafv2-acl-arn"
19+
IngressSuffixWAFACLID = "waf-acl-id"
20+
IngressSuffixWebACLID = "web-acl-id" // deprecated, use "waf-acl-id" instead.
21+
IngressSuffixShieldAdvancedProtection = "shield-advanced-protection"
22+
IngressSuffixSecurityGroups = "security-groups"
23+
IngressSuffixListenPorts = "listen-ports"
24+
IngressSuffixSSLRedirect = "ssl-redirect"
25+
IngressSuffixInboundCIDRs = "inbound-cidrs"
26+
IngressSuffixCertificateARN = "certificate-arn"
27+
IngressSuffixSSLPolicy = "ssl-policy"
28+
IngressSuffixTargetType = "target-type"
29+
IngressSuffixBackendProtocol = "backend-protocol"
30+
IngressSuffixBackendProtocolVersion = "backend-protocol-version"
31+
IngressSuffixTargetGroupAttributes = "target-group-attributes"
32+
IngressSuffixHealthCheckPort = "healthcheck-port"
33+
IngressSuffixHealthCheckProtocol = "healthcheck-protocol"
34+
IngressSuffixHealthCheckPath = "healthcheck-path"
35+
IngressSuffixHealthCheckIntervalSeconds = "healthcheck-interval-seconds"
36+
IngressSuffixHealthCheckTimeoutSeconds = "healthcheck-timeout-seconds"
37+
IngressSuffixHealthyThresholdCount = "healthy-threshold-count"
38+
IngressSuffixUnhealthyThresholdCount = "unhealthy-threshold-count"
39+
IngressSuffixSuccessCodes = "success-codes"
40+
IngressSuffixAuthType = "auth-type"
41+
IngressSuffixAuthIDPCognito = "auth-idp-cognito"
42+
IngressSuffixAuthIDPOIDC = "auth-idp-oidc"
43+
IngressSuffixAuthOnUnauthenticatedRequest = "auth-on-unauthenticated-request"
44+
IngressSuffixAuthScope = "auth-scope"
45+
IngressSuffixAuthSessionCookie = "auth-session-cookie"
46+
IngressSuffixAuthSessionTimeout = "auth-session-timeout"
47+
IngressSuffixTargetNodeLabels = "target-node-labels"
48+
IngressSuffixManageSecurityGroupRules = "manage-backend-security-group-rules"
49+
IngressSuffixMutualAuthentication = "mutual-authentication"
50+
IngressSuffixSecurityGroupPrefixLists = "security-group-prefix-lists"
51+
IngressSuffixlsAttsAnnotationPrefix = "listener-attributes"
52+
IngressLBSuffixMultiClusterTargetGroup = "multi-cluster-target-group"
53+
IngressSuffixLoadBalancerCapacityReservation = "minimum-load-balancer-capacity"
5154

5255
// NLB annotation suffixes
5356
// prefixes service.beta.kubernetes.io, service.kubernetes.io

‎pkg/ingress/model_build_listener.go

+27-4
Original file line numberDiff line numberDiff line change
@@ -107,17 +107,25 @@ type listenPortConfig struct {
107107
sslPolicy *string
108108
tlsCerts []string
109109
mutualAuthentication *elbv2model.MutualAuthenticationAttributes
110+
securityGroupIDs []string
110111
}
111112

112113
func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context.Context, ing *ClassifiedIngress) (map[int64]listenPortConfig, error) {
113114
explicitTLSCertARNs := t.computeIngressExplicitTLSCertARNs(ctx, ing)
114115
explicitSSLPolicy := t.computeIngressExplicitSSLPolicy(ctx, ing)
115116
var prefixListIDs []string
116117
t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixSecurityGroupPrefixLists, &prefixListIDs, ing.Ing.Annotations)
118+
119+
securityGroupIDs, err := t.computeIngressExplicitSecurityGroupIDs(ctx, ing)
120+
if err != nil {
121+
return nil, err
122+
}
123+
117124
inboundCIDRv4s, inboundCIDRV6s, err := t.computeIngressExplicitInboundCIDRs(ctx, ing)
118125
if err != nil {
119126
return nil, err
120127
}
128+
121129
mutualAuthenticationAttributes, err := t.computeIngressMutualAuthentication(ctx, ing)
122130
if err != nil {
123131
return nil, err
@@ -146,10 +154,11 @@ func (t *defaultModelBuildTask) computeIngressListenPortConfigByPort(ctx context
146154
listenPortConfigByPort := make(map[int64]listenPortConfig, len(listenPorts))
147155
for port, protocol := range listenPorts {
148156
cfg := listenPortConfig{
149-
protocol: protocol,
150-
inboundCIDRv4s: inboundCIDRv4s,
151-
inboundCIDRv6s: inboundCIDRV6s,
152-
prefixLists: prefixListIDs,
157+
protocol: protocol,
158+
inboundCIDRv4s: inboundCIDRv4s,
159+
inboundCIDRv6s: inboundCIDRV6s,
160+
prefixLists: prefixListIDs,
161+
securityGroupIDs: securityGroupIDs,
153162
}
154163
if protocol == elbv2model.ProtocolHTTPS {
155164
if len(explicitTLSCertARNs) == 0 {
@@ -225,6 +234,20 @@ func (t *defaultModelBuildTask) computeIngressListenPorts(_ context.Context, ing
225234
return portAndProtocols, nil
226235
}
227236

237+
func (t *defaultModelBuildTask) computeIngressExplicitSecurityGroupIDs(ctx context.Context, ing *ClassifiedIngress) ([]string, error) {
238+
var rawSecurityGroups []string
239+
if exists := t.annotationParser.ParseStringSliceAnnotation(annotations.IngressSuffixInboundSecurityGroups, &rawSecurityGroups, ing.Ing.Annotations); !exists {
240+
return nil, nil
241+
}
242+
243+
securityGroupIDs, err := t.sgResolver.ResolveViaNameOrID(ctx, rawSecurityGroups)
244+
if err != nil {
245+
return nil, fmt.Errorf("invalid %v settings on Ingress: %v: %w", annotations.IngressSuffixInboundSecurityGroups, k8s.NamespacedName(ing.Ing), err)
246+
}
247+
248+
return securityGroupIDs, nil
249+
}
250+
228251
func (t *defaultModelBuildTask) computeIngressExplicitInboundCIDRs(_ context.Context, ing *ClassifiedIngress) ([]string, []string, error) {
229252
var rawInboundCIDRs []string
230253
fromIngressClassParams := false

‎pkg/ingress/model_build_managed_sg.go

+12
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,18 @@ func (t *defaultModelBuildTask) buildManagedSecurityGroupIngressPermissions(_ co
109109
},
110110
})
111111
}
112+
for _, sgID := range cfg.securityGroupIDs {
113+
permissions = append(permissions, ec2model.IPPermission{
114+
IPProtocol: "tcp",
115+
FromPort: awssdk.Int64(port),
116+
ToPort: awssdk.Int64(port),
117+
UserIDGroupPairs: []ec2model.UserIDGroupPair{
118+
{
119+
GroupID: sgID,
120+
},
121+
},
122+
})
123+
}
112124
}
113125
return permissions
114126
}

‎pkg/ingress/model_builder.go

+15
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,9 @@ func (t *defaultModelBuildTask) mergeListenPortConfigs(_ context.Context, listen
310310
var mergedMtlsAttributesProvider *types.NamespacedName
311311
var mergedMtlsAttributes *elbv2model.MutualAuthenticationAttributes
312312

313+
var mergedSecurityGroupProvider *types.NamespacedName
314+
mergedSecurityGroups := sets.NewString()
315+
313316
for _, cfg := range listenPortConfigs {
314317
if mergedProtocolProvider == nil {
315318
mergedProtocolProvider = &cfg.ingKey
@@ -343,6 +346,17 @@ func (t *defaultModelBuildTask) mergeListenPortConfigs(_ context.Context, listen
343346
}
344347
}
345348

349+
if len(cfg.listenPortConfig.securityGroupIDs) != 0 {
350+
cfgSecurityGroups := sets.NewString(cfg.listenPortConfig.securityGroupIDs...)
351+
if mergedSecurityGroupProvider == nil {
352+
mergedSecurityGroupProvider = &cfg.ingKey
353+
mergedSecurityGroups = cfgSecurityGroups
354+
} else if !mergedSecurityGroups.Equal(cfgSecurityGroups) {
355+
return listenPortConfig{}, errors.Errorf("conflicting security groups, %v: %v | %v: %v",
356+
*mergedSecurityGroupProvider, mergedSecurityGroups.List(), cfg.ingKey, cfgSecurityGroups.List())
357+
}
358+
}
359+
346360
if cfg.listenPortConfig.sslPolicy != nil {
347361
if mergedSSLPolicyProvider == nil {
348362
mergedSSLPolicyProvider = &cfg.ingKey
@@ -389,6 +403,7 @@ func (t *defaultModelBuildTask) mergeListenPortConfigs(_ context.Context, listen
389403
sslPolicy: mergedSSLPolicy,
390404
tlsCerts: mergedTLSCerts,
391405
mutualAuthentication: mergedMtlsAttributes,
406+
securityGroupIDs: mergedSecurityGroups.List(),
392407
}, nil
393408
}
394409

‎pkg/ingress/model_builder_test.go

+145-37
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@ package ingress
33
import (
44
"context"
55
"encoding/json"
6+
ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
7+
elbv2types "github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2/types"
68
"testing"
79
"time"
810

9-
awssdk "github.com/aws/aws-sdk-go/aws"
10-
ec2sdk "github.com/aws/aws-sdk-go/service/ec2"
11-
elbv2sdk "github.com/aws/aws-sdk-go/service/elbv2"
11+
awssdk "github.com/aws/aws-sdk-go-v2/aws"
1212
jsonpatch "github.com/evanphx/json-patch"
1313
"github.com/go-logr/logr"
1414
"github.com/golang/mock/gomock"
@@ -442,7 +442,7 @@ const baseStackJSON = `
442442

443443
func Test_defaultModelBuilder_Build(t *testing.T) {
444444
type resolveViaDiscoveryCall struct {
445-
subnets []*ec2sdk.Subnet
445+
subnets []ec2types.Subnet
446446
err error
447447
}
448448
type env struct {
@@ -453,7 +453,7 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
453453
err error
454454
}
455455
type describeSecurityGroupsResult struct {
456-
securityGroups []*ec2sdk.SecurityGroup
456+
securityGroups []ec2types.SecurityGroup
457457
err error
458458
}
459459
type fields struct {
@@ -576,7 +576,7 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
576576
}
577577

578578
resolveViaDiscoveryCallForInternalLB := resolveViaDiscoveryCall{
579-
subnets: []*ec2sdk.Subnet{
579+
subnets: []ec2types.Subnet{
580580
{
581581
SubnetId: awssdk.String("subnet-a"),
582582
CidrBlock: awssdk.String("192.168.0.0/19"),
@@ -588,7 +588,7 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
588588
},
589589
}
590590
resolveViaDiscoveryCallForInternetFacingLB := resolveViaDiscoveryCall{
591-
subnets: []*ec2sdk.Subnet{
591+
subnets: []ec2types.Subnet{
592592
{
593593
SubnetId: awssdk.String("subnet-c"),
594594
CidrBlock: awssdk.String("192.168.64.0/19"),
@@ -605,14 +605,15 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
605605
}
606606

607607
tests := []struct {
608-
name string
609-
env env
610-
defaultTargetType string
611-
enableIPTargetType *bool
612-
args args
613-
fields fields
614-
wantStackPatch string
615-
wantErr string
608+
name string
609+
env env
610+
defaultTargetType string
611+
defaultLoadBalancerScheme string
612+
enableIPTargetType *bool
613+
args args
614+
fields fields
615+
wantStackPatch string
616+
wantErr string
616617
}{
617618
{
618619
name: "Ingress - vanilla internal",
@@ -2152,53 +2153,53 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
21522153
{
21532154
matchedLBs: []elbv2.LoadBalancerWithTags{
21542155
{
2155-
LoadBalancer: &elbv2sdk.LoadBalancer{
2156+
LoadBalancer: &elbv2types.LoadBalancer{
21562157
LoadBalancerArn: awssdk.String("lb-1"),
2157-
AvailabilityZones: []*elbv2sdk.AvailabilityZone{
2158+
AvailabilityZones: []elbv2types.AvailabilityZone{
21582159
{
21592160
SubnetId: awssdk.String("subnet-e"),
21602161
},
21612162
{
21622163
SubnetId: awssdk.String("subnet-f"),
21632164
},
21642165
},
2165-
Scheme: awssdk.String("internal"),
2166+
Scheme: elbv2types.LoadBalancerSchemeEnumInternal,
21662167
},
21672168
Tags: map[string]string{
21682169
"elbv2.k8s.aws/cluster": "cluster-name",
21692170
"ingress.k8s.aws/stack": "ns-1/ing-1",
21702171
},
21712172
},
21722173
{
2173-
LoadBalancer: &elbv2sdk.LoadBalancer{
2174+
LoadBalancer: &elbv2types.LoadBalancer{
21742175
LoadBalancerArn: awssdk.String("lb-2"),
2175-
AvailabilityZones: []*elbv2sdk.AvailabilityZone{
2176+
AvailabilityZones: []elbv2types.AvailabilityZone{
21762177
{
21772178
SubnetId: awssdk.String("subnet-e"),
21782179
},
21792180
{
21802181
SubnetId: awssdk.String("subnet-f"),
21812182
},
21822183
},
2183-
Scheme: awssdk.String("internal"),
2184+
Scheme: elbv2types.LoadBalancerSchemeEnumInternal,
21842185
},
21852186
Tags: map[string]string{
21862187
"keyA": "valueA2",
21872188
"keyB": "valueB2",
21882189
},
21892190
},
21902191
{
2191-
LoadBalancer: &elbv2sdk.LoadBalancer{
2192+
LoadBalancer: &elbv2types.LoadBalancer{
21922193
LoadBalancerArn: awssdk.String("lb-3"),
2193-
AvailabilityZones: []*elbv2sdk.AvailabilityZone{
2194+
AvailabilityZones: []elbv2types.AvailabilityZone{
21942195
{
21952196
SubnetId: awssdk.String("subnet-e"),
21962197
},
21972198
{
21982199
SubnetId: awssdk.String("subnet-f"),
21992200
},
22002201
},
2201-
Scheme: awssdk.String("internal"),
2202+
Scheme: elbv2types.LoadBalancerSchemeEnumInternal,
22022203
},
22032204
Tags: map[string]string{
22042205
"keyA": "valueA3",
@@ -2339,7 +2340,7 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
23392340
listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB},
23402341
describeSecurityGroupsResult: []describeSecurityGroupsResult{
23412342
{
2342-
securityGroups: []*ec2sdk.SecurityGroup{
2343+
securityGroups: []ec2types.SecurityGroup{
23432344
{
23442345
GroupId: awssdk.String("sg-manual"),
23452346
},
@@ -2478,7 +2479,7 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
24782479
listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB},
24792480
describeSecurityGroupsResult: []describeSecurityGroupsResult{
24802481
{
2481-
securityGroups: []*ec2sdk.SecurityGroup{
2482+
securityGroups: []ec2types.SecurityGroup{
24822483
{
24832484
GroupId: awssdk.String("sg-manual"),
24842485
},
@@ -3628,6 +3629,108 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
36283629
}
36293630
}
36303631
}
3632+
}`,
3633+
},
3634+
{
3635+
name: "Ingress - vanilla with default-load-balancer-scheme internet-facing",
3636+
env: env{
3637+
svcs: []*corev1.Service{ns_1_svc_1, ns_1_svc_2, ns_1_svc_3},
3638+
},
3639+
fields: fields{
3640+
resolveViaDiscoveryCalls: []resolveViaDiscoveryCall{resolveViaDiscoveryCallForInternetFacingLB},
3641+
listLoadBalancersCalls: []listLoadBalancersCall{listLoadBalancerCallForEmptyLB},
3642+
enableBackendSG: true,
3643+
},
3644+
defaultLoadBalancerScheme: string(elbv2model.LoadBalancerSchemeInternetFacing),
3645+
args: args{
3646+
ingGroup: Group{
3647+
ID: GroupID{Namespace: "ns-1", Name: "ing-1"},
3648+
Members: []ClassifiedIngress{
3649+
{
3650+
Ing: &networking.Ingress{ObjectMeta: metav1.ObjectMeta{
3651+
Namespace: "ns-1",
3652+
Name: "ing-1",
3653+
},
3654+
Spec: networking.IngressSpec{
3655+
Rules: []networking.IngressRule{
3656+
{
3657+
Host: "app-1.example.com",
3658+
IngressRuleValue: networking.IngressRuleValue{
3659+
HTTP: &networking.HTTPIngressRuleValue{
3660+
Paths: []networking.HTTPIngressPath{
3661+
{
3662+
Path: "/svc-1",
3663+
Backend: networking.IngressBackend{
3664+
Service: &networking.IngressServiceBackend{
3665+
Name: ns_1_svc_1.Name,
3666+
Port: networking.ServiceBackendPort{
3667+
Name: "http",
3668+
},
3669+
},
3670+
},
3671+
},
3672+
{
3673+
Path: "/svc-2",
3674+
Backend: networking.IngressBackend{
3675+
Service: &networking.IngressServiceBackend{
3676+
Name: ns_1_svc_2.Name,
3677+
Port: networking.ServiceBackendPort{
3678+
Name: "http",
3679+
},
3680+
},
3681+
},
3682+
},
3683+
},
3684+
},
3685+
},
3686+
},
3687+
{
3688+
Host: "app-2.example.com",
3689+
IngressRuleValue: networking.IngressRuleValue{
3690+
HTTP: &networking.HTTPIngressRuleValue{
3691+
Paths: []networking.HTTPIngressPath{
3692+
{
3693+
Path: "/svc-3",
3694+
Backend: networking.IngressBackend{
3695+
Service: &networking.IngressServiceBackend{
3696+
Name: ns_1_svc_3.Name,
3697+
Port: networking.ServiceBackendPort{
3698+
Name: "https",
3699+
},
3700+
},
3701+
},
3702+
},
3703+
},
3704+
},
3705+
},
3706+
},
3707+
},
3708+
},
3709+
},
3710+
},
3711+
},
3712+
},
3713+
},
3714+
wantStackPatch: `
3715+
{
3716+
"resources": {
3717+
"AWS::ElasticLoadBalancingV2::LoadBalancer": {
3718+
"LoadBalancer": {
3719+
"spec": {
3720+
"name": "k8s-ns1-ing1-159dd7a143",
3721+
"scheme": "internet-facing",
3722+
"subnetMapping": [
3723+
{
3724+
"subnetID": "subnet-c"
3725+
},
3726+
{
3727+
"subnetID": "subnet-d"
3728+
}
3729+
]
3730+
}
3731+
}
3732+
}
3733+
}
36313734
}`,
36323735
},
36333736
}
@@ -3681,6 +3784,10 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
36813784
if defaultTargetType == "" {
36823785
defaultTargetType = "instance"
36833786
}
3787+
defaultLoadBalancerScheme := tt.defaultLoadBalancerScheme
3788+
if defaultLoadBalancerScheme == "" {
3789+
defaultLoadBalancerScheme = string(elbv2model.LoadBalancerSchemeInternal)
3790+
}
36843791

36853792
b := &defaultModelBuilder{
36863793
k8sClient: k8sClient,
@@ -3703,8 +3810,9 @@ func Test_defaultModelBuilder_Build(t *testing.T) {
37033810
featureGates: config.NewFeatureGates(),
37043811
logger: logr.New(&log.NullLogSink{}),
37053812

3706-
defaultSSLPolicy: "ELBSecurityPolicy-2016-08",
3707-
defaultTargetType: elbv2model.TargetType(defaultTargetType),
3813+
defaultSSLPolicy: "ELBSecurityPolicy-2016-08",
3814+
defaultTargetType: elbv2model.TargetType(defaultTargetType),
3815+
defaultLoadBalancerScheme: elbv2model.LoadBalancerScheme(defaultLoadBalancerScheme),
37083816
}
37093817

37103818
if tt.enableIPTargetType == nil {
@@ -3768,7 +3876,7 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
37683876
ingGroup Group
37693877
}
37703878
type args struct {
3771-
listenPortConfigByPort map[int64]listenPortConfig
3879+
listenPortConfigByPort map[int32]listenPortConfig
37723880
}
37733881
tests := []struct {
37743882
name string
@@ -3818,7 +3926,7 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
38183926
},
38193927
},
38203928
args: args{
3821-
listenPortConfigByPort: map[int64]listenPortConfig{
3929+
listenPortConfigByPort: map[int32]listenPortConfig{
38223930
80: {
38233931
protocol: elbv2model.ProtocolHTTP,
38243932
},
@@ -3874,7 +3982,7 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
38743982
},
38753983
},
38763984
args: args{
3877-
listenPortConfigByPort: map[int64]listenPortConfig{
3985+
listenPortConfigByPort: map[int32]listenPortConfig{
38783986
80: {
38793987
protocol: elbv2model.ProtocolHTTP,
38803988
},
@@ -3933,7 +4041,7 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
39334041
},
39344042
},
39354043
args: args{
3936-
listenPortConfigByPort: map[int64]listenPortConfig{
4044+
listenPortConfigByPort: map[int32]listenPortConfig{
39374045
80: {
39384046
protocol: elbv2model.ProtocolHTTP,
39394047
},
@@ -3989,7 +4097,7 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
39894097
},
39904098
},
39914099
args: args{
3992-
listenPortConfigByPort: map[int64]listenPortConfig{
4100+
listenPortConfigByPort: map[int32]listenPortConfig{
39934101
80: {
39944102
protocol: elbv2model.ProtocolHTTP,
39954103
},
@@ -4073,7 +4181,7 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
40734181
},
40744182
},
40754183
args: args{
4076-
listenPortConfigByPort: map[int64]listenPortConfig{
4184+
listenPortConfigByPort: map[int32]listenPortConfig{
40774185
80: {
40784186
protocol: elbv2model.ProtocolHTTP,
40794187
},
@@ -4160,7 +4268,7 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
41604268
},
41614269
},
41624270
args: args{
4163-
listenPortConfigByPort: map[int64]listenPortConfig{
4271+
listenPortConfigByPort: map[int32]listenPortConfig{
41644272
80: {
41654273
protocol: elbv2model.ProtocolHTTP,
41664274
},
@@ -4253,7 +4361,7 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
42534361
},
42544362
},
42554363
args: args{
4256-
listenPortConfigByPort: map[int64]listenPortConfig{
4364+
listenPortConfigByPort: map[int32]listenPortConfig{
42574365
80: {
42584366
protocol: elbv2model.ProtocolHTTP,
42594367
},
@@ -4346,7 +4454,7 @@ func Test_defaultModelBuildTask_buildSSLRedirectConfig(t *testing.T) {
43464454
},
43474455
},
43484456
args: args{
4349-
listenPortConfigByPort: map[int64]listenPortConfig{
4457+
listenPortConfigByPort: map[int32]listenPortConfig{
43504458
80: {
43514459
protocol: elbv2model.ProtocolHTTP,
43524460
},

0 commit comments

Comments
 (0)
Please sign in to comment.