adestis-mf opened a new pull request, #115: URL: https://github.com/apache/cloudstack-kubernetes-provider/pull/115
Fixes #114 Since CloudStack 4.23 (apache/cloudstack#12706) a VPC offering can include the Firewall service. A tier lists the service only if its own offering does, so on the other tiers the controller only added a Network ACL rule, and the VPC's virtual router kept the Service's port closed. ### Changes - From CloudStack 4.23 on, the controller reads the VPC of a tier with `listVPCs`, once per sync and before an IP is associated. If the VPC has the Firewall service, it manages a firewall rule on the public IP next to the ACL rule, with `spec.loadBalancerSourceRanges` applied, and deletes it with the Service or an obsolete rule. If that fails, the load balancer rule is kept for the retry, as for ACL rules. - If the account may not call `listVPCs` (error 432), the controller behaves as before and logs a warning once per VPC. - As on isolated networks, firewall rules on a Service's IP and port are treated as the Service's, so rules added by hand as a workaround are replaced or deleted. The README says what to do before upgrading. - `deleteFirewallRule` now returns the first failed delete instead of the result of the last one. - README: the new permission, the VPC section, troubleshooting and the upgrade note. Isolated networks, VPCs without the Firewall service and CloudStack before 4.23 behave as before. The project role that CKS creates allows neither `listVPCs` nor `listNetworkACLLists`; apache/cloudstack#14690 adds them. A few colleagues and I worked on this, since LoadBalancer Services in VPCs with the Firewall service matter for our cloud environment. ### Testing - New unit tests for the VPC lookup, the create, prune and delete paths and their error cases; existing test cases are unchanged. `go test ./...`, `go vet` and `golangci-lint` pass. - Live on CloudStack 4.23.0.0, with a CKS cluster on such a tier running this change: without `listVPCs` the controller logged the warning (error 432) and the port stayed closed. With it, the firewall rule was created and the Service answered from outside. Source ranges, a port change and deleting the Service worked as expected, and the cluster's own rules were left alone. - A Service on a new public IP gets its rules but stays unreachable until apache/cloudstack#14146 is fixed (apache/cloudstack#14681). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
