Skip to content

Commit 340b6b9

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #2620 from sedefsavas/sgfix
🐛 Managed SecurityGroups should be filtered correctly
2 parents 50f8b3f + 03ae34e commit 340b6b9

File tree

5 files changed

+141
-18
lines changed

5 files changed

+141
-18
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ require (
3535
k8s.io/klog/v2 v2.1.0
3636
k8s.io/utils v0.0.0-20210709001253-0e1f9d693477
3737
sigs.k8s.io/aws-iam-authenticator v0.5.3
38-
sigs.k8s.io/cluster-api v0.3.21
38+
sigs.k8s.io/cluster-api v0.3.22
3939
sigs.k8s.io/controller-runtime v0.5.14
4040
sigs.k8s.io/yaml v1.2.0
4141
)

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1186,8 +1186,8 @@ modernc.org/xc v1.0.0/go.mod h1:mRNCo0bvLjGhHO9WsyuKVU4q0ceiDDDoEeWDJHrNx8I=
11861186
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
11871187
sigs.k8s.io/aws-iam-authenticator v0.5.3 h1:EyqQ/uxzbe2mDETZZmuMnv0xHITnyLhZfPlGb6Mma20=
11881188
sigs.k8s.io/aws-iam-authenticator v0.5.3/go.mod h1:DIq7gy0lvnyaG88AgFyJzUVeix+ia5msHEp4RL0102I=
1189-
sigs.k8s.io/cluster-api v0.3.21 h1:AOumFs+wJ/kJDNNzdqk1IQjhM+0x6nZbzaSpytX9Xms=
1190-
sigs.k8s.io/cluster-api v0.3.21/go.mod h1:1DBZEj6GmcWxe77d8YOeac1JIa8ttP21uTHUlAyji2g=
1189+
sigs.k8s.io/cluster-api v0.3.22 h1:yxl/YHujBqTx+OBcX1FVlJ0DSwXH4LXg8hmDeh8Lick=
1190+
sigs.k8s.io/cluster-api v0.3.22/go.mod h1:1DBZEj6GmcWxe77d8YOeac1JIa8ttP21uTHUlAyji2g=
11911191
sigs.k8s.io/controller-runtime v0.5.14 h1:lmoRaPvLg9877ZOnjFivjtyIdqyLbWfcCEilxHXTEj4=
11921192
sigs.k8s.io/controller-runtime v0.5.14/go.mod h1:OTqxLuz7gVcrq+BHGUgedRu6b2VIKCEc7Pu4Jbwui0A=
11931193
sigs.k8s.io/kind v0.7.1-0.20200303021537-981bd80d3802 h1:L6/8hETA7jvdx3xBcbDifrIN2xaYHE7tA58n+Kdp2Zw=

‎pkg/cloud/services/securitygroup/securitygroups.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -326,7 +326,7 @@ func (s *Service) describeClusterOwnedSecurityGroups() ([]infrav1.SecurityGroup,
326326
input := &ec2.DescribeSecurityGroupsInput{
327327
Filters: []*ec2.Filter{
328328
filter.EC2.VPC(s.scope.VPC().ID),
329-
filter.EC2.ProviderOwned(s.scope.Name()),
329+
filter.EC2.ClusterOwned(s.scope.Name()),
330330
},
331331
}
332332

‎pkg/cloud/services/securitygroup/securitygroups_test.go‎

Lines changed: 124 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,23 @@ limitations under the License.
1717
package securitygroup
1818

1919
import (
20-
"github.com/pkg/errors"
20+
"context"
2121
"strings"
2222
"testing"
2323

2424
"github.com/aws/aws-sdk-go/aws"
2525
"github.com/aws/aws-sdk-go/service/ec2"
2626
"github.com/golang/mock/gomock"
27+
"github.com/pkg/errors"
2728
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
29+
"k8s.io/apimachinery/pkg/runtime"
2830
"k8s.io/apimachinery/pkg/util/sets"
2931
infrav1 "sigs.k8s.io/cluster-api-provider-aws/api/v1alpha3"
3032
"sigs.k8s.io/cluster-api-provider-aws/pkg/cloud/scope"
3133
"sigs.k8s.io/cluster-api-provider-aws/pkg/cloud/services"
3234
"sigs.k8s.io/cluster-api-provider-aws/pkg/cloud/services/ec2/mock_ec2iface"
3335
clusterv1 "sigs.k8s.io/cluster-api/api/v1alpha3"
36+
"sigs.k8s.io/controller-runtime/pkg/client/fake"
3437
)
3538

3639
func TestReconcileSecurityGroups(t *testing.T) {
@@ -385,3 +388,123 @@ func TestControlPlaneSecurityGroupNotOpenToAnyCIDR(t *testing.T) {
385388
}
386389
}
387390
}
391+
392+
func TestDeleteSecurityGroups(t *testing.T) {
393+
mockCtrl := gomock.NewController(t)
394+
defer mockCtrl.Finish()
395+
396+
testCases := []struct {
397+
name string
398+
input *infrav1.NetworkSpec
399+
expect func(m *mock_ec2iface.MockEC2APIMockRecorder)
400+
err error
401+
}{
402+
{
403+
name: "do not delete overridden security groups, only delete 'owned' SGs",
404+
input: &infrav1.NetworkSpec{
405+
VPC: infrav1.VPCSpec{
406+
ID: "vpc-securitygroups",
407+
InternetGatewayID: aws.String("igw-01"),
408+
},
409+
Subnets: infrav1.Subnets{
410+
&infrav1.SubnetSpec{
411+
ID: "subnet-securitygroups-private",
412+
IsPublic: false,
413+
AvailabilityZone: "us-east-1a",
414+
},
415+
&infrav1.SubnetSpec{
416+
ID: "subnet-securitygroups-public",
417+
IsPublic: true,
418+
NatGatewayID: aws.String("nat-01"),
419+
AvailabilityZone: "us-east-1a",
420+
},
421+
},
422+
SecurityGroupOverrides: map[infrav1.SecurityGroupRole]string{
423+
infrav1.SecurityGroupBastion: "sg-bastion",
424+
infrav1.SecurityGroupAPIServerLB: "sg-apiserver-lb",
425+
infrav1.SecurityGroupLB: "sg-lb",
426+
infrav1.SecurityGroupControlPlane: "sg-control",
427+
infrav1.SecurityGroupNode: "sg-node",
428+
},
429+
},
430+
expect: func(m *mock_ec2iface.MockEC2APIMockRecorder) {
431+
m.DescribeSecurityGroupsPages(gomock.Any(), gomock.Any()).Do(func(_, y interface{}) {
432+
funct := y.(func(output *ec2.DescribeSecurityGroupsOutput, lastPage bool) bool)
433+
funct(&ec2.DescribeSecurityGroupsOutput{
434+
SecurityGroups: []*ec2.SecurityGroup{
435+
{
436+
GroupName: aws.String("sg-bastion"),
437+
GroupId: aws.String("sg-bastion"),
438+
439+
Tags: []*ec2.Tag{
440+
{
441+
Key: aws.String("Name"),
442+
Value: aws.String("test-cluster-nat"),
443+
},
444+
{
445+
Key: aws.String("sigs.k8s.io/cluster-api-provider-aws/cluster/test-cluster"),
446+
Value: aws.String("owned"),
447+
},
448+
{
449+
Key: aws.String("sigs.k8s.io/cluster-api-provider-aws/role"),
450+
Value: aws.String("common"),
451+
},
452+
},
453+
},
454+
},
455+
}, true)
456+
}).Return(nil)
457+
458+
m.DescribeSecurityGroups(gomock.Any()).Return(&ec2.DescribeSecurityGroupsOutput{}, nil)
459+
m.DeleteSecurityGroup(gomock.Any()).Return(nil, nil)
460+
},
461+
},
462+
}
463+
464+
for _, tc := range testCases {
465+
t.Run(tc.name, func(t *testing.T) {
466+
ec2Mock := mock_ec2iface.NewMockEC2API(mockCtrl)
467+
468+
scheme := runtime.NewScheme()
469+
_ = infrav1.AddToScheme(scheme)
470+
awsCluster := &infrav1.AWSCluster{
471+
TypeMeta: metav1.TypeMeta{
472+
APIVersion: infrav1.GroupVersion.String(),
473+
Kind: "AWSCluster",
474+
},
475+
ObjectMeta: metav1.ObjectMeta{Name: "test"},
476+
Spec: infrav1.AWSClusterSpec{
477+
NetworkSpec: *tc.input,
478+
},
479+
}
480+
client := fake.NewFakeClientWithScheme(scheme, awsCluster)
481+
482+
ctx := context.TODO()
483+
client.Create(ctx, awsCluster)
484+
485+
scope, err := scope.NewClusterScope(scope.ClusterScopeParams{
486+
Client: client,
487+
Cluster: &clusterv1.Cluster{
488+
ObjectMeta: metav1.ObjectMeta{Name: "test-cluster"},
489+
},
490+
AWSCluster: awsCluster,
491+
})
492+
if err != nil {
493+
t.Fatalf("Failed to create test context: %v", err)
494+
}
495+
496+
tc.expect(ec2Mock.EXPECT())
497+
498+
s := NewService(scope)
499+
s.EC2Client = ec2Mock
500+
501+
if err := s.DeleteSecurityGroups(); err != nil && tc.err != nil {
502+
if !strings.Contains(err.Error(), tc.err.Error()) {
503+
t.Fatalf("was expecting error to look like '%v', but got '%v'", tc.err, err)
504+
}
505+
} else if err != nil {
506+
t.Fatalf("got an unexpected error: %v", err)
507+
}
508+
})
509+
}
510+
}

‎test/e2e/data/e2e_conf.yaml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,11 @@
1414
# For more details, run `go run ./cmd/clusterawsadm bootstrap credentials`
1515

1616
images:
17-
- name: gcr.io/k8s-staging-cluster-api/cluster-api-controller:v0.3.21
17+
- name: gcr.io/k8s-staging-cluster-api/cluster-api-controller:v0.3.22
1818
loadBehavior: tryLoad
19-
- name: gcr.io/k8s-staging-cluster-api/kubeadm-bootstrap-controller:v0.3.21
19+
- name: gcr.io/k8s-staging-cluster-api/kubeadm-bootstrap-controller:v0.3.22
2020
loadBehavior: tryLoad
21-
- name: gcr.io/k8s-staging-cluster-api/kubeadm-control-plane-controller:v0.3.21
21+
- name: gcr.io/k8s-staging-cluster-api/kubeadm-control-plane-controller:v0.3.22
2222
loadBehavior: tryLoad
2323
# Use local dev images built source tree;
2424
- name: gcr.io/k8s-staging-cluster-api/capa-manager:e2e
@@ -35,9 +35,9 @@ providers:
3535
- name: cluster-api
3636
type: CoreProvider
3737
versions:
38-
- name: v0.3.21
38+
- name: v0.3.22
3939
# Use manifest from source files
40-
value: "https://github.com/kubernetes-sigs/cluster-api/releases/download/v0.3.21/core-components.yaml"
40+
value: "https://github.com/kubernetes-sigs/cluster-api/releases/download/v0.3.22/core-components.yaml"
4141
type: "url"
4242
replacements:
4343
- old: "imagePullPolicy: Always"
@@ -50,9 +50,9 @@ providers:
5050
- name: kubeadm
5151
type: BootstrapProvider
5252
versions:
53-
- name: v0.3.21
53+
- name: v0.3.22
5454
# Use manifest from source files
55-
value: "https://github.com/kubernetes-sigs/cluster-api/releases/download/v0.3.21/bootstrap-components.yaml"
55+
value: "https://github.com/kubernetes-sigs/cluster-api/releases/download/v0.3.22/bootstrap-components.yaml"
5656
type: "url"
5757
replacements:
5858
- old: "imagePullPolicy: Always"
@@ -65,9 +65,9 @@ providers:
6565
- name: kubeadm
6666
type: ControlPlaneProvider
6767
versions:
68-
- name: v0.3.21
68+
- name: v0.3.22
6969
# Use manifest from source files
70-
value: "https://github.com/kubernetes-sigs/cluster-api/releases/download/v0.3.21/control-plane-components.yaml"
70+
value: "https://github.com/kubernetes-sigs/cluster-api/releases/download/v0.3.22/control-plane-components.yaml"
7171
type: "url"
7272
replacements:
7373
- old: "imagePullPolicy: Always"
@@ -116,21 +116,21 @@ providers:
116116
- sourcePath: "./infrastructure-aws/cluster-template-nested-multitenancy.yaml"
117117
targetName: "cluster-template-nested-multitenancy.yaml"
118118
variables:
119-
KUBERNETES_VERSION: "v1.21.2"
119+
KUBERNETES_VERSION: "v1.21.3"
120120
CNI: "../../data/cni/calico.yaml"
121121
EXP_CLUSTER_RESOURCE_SET: "true"
122122
EVENT_BRIDGE_INSTANCE_STATE: "true"
123123
AWS_CONTROL_PLANE_MACHINE_TYPE: t3.large
124124
AWS_NODE_MACHINE_TYPE: t3.large
125125
AWS_SSH_KEY_NAME: "cluster-api-provider-aws-sigs-k8s-io"
126-
CONFORMANCE_CI_ARTIFACTS_KUBERNETES_VERSION: "v1.21.2"
126+
CONFORMANCE_CI_ARTIFACTS_KUBERNETES_VERSION: "v1.21.3"
127127
CONFORMANCE_WORKER_MACHINE_COUNT: "5"
128128
CONFORMANCE_CONTROL_PLANE_MACHINE_COUNT: "1"
129129
EXP_MACHINE_POOL: "true"
130130
ETCD_VERSION_UPGRADE_TO: "3.4.13-0"
131131
COREDNS_VERSION_UPGRADE_TO: "1.7.1"
132-
KUBERNETES_VERSION_UPGRADE_TO: "v1.21.2"
133-
KUBERNETES_VERSION_UPGRADE_FROM: "v1.20.8"
132+
KUBERNETES_VERSION_UPGRADE_TO: "v1.21.3"
133+
KUBERNETES_VERSION_UPGRADE_FROM: "v1.20.9"
134134
MULTI_TENANCY_ROLE_NAME: "multi-tenancy-role"
135135
MULTI_TENANCY_NESTED_ROLE_NAME: "multi-tenancy-nested-role"
136136

0 commit comments

Comments
 (0)