Skip to content

Commit 3c1c87e

Browse files
shyamradhakrishnanshyamradhakrishnan
authored
Add missing NSG rule for control plane Kubelet communication, and fix cluster templates (#23)
1 parent d3f1ede commit 3c1c87e

File tree

8 files changed

+238
-112
lines changed

8 files changed

+238
-112
lines changed

‎cloud/scope/nsg_reconciler.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -643,6 +643,20 @@ func (s *ClusterScope) GetControlPlaneMachineDefaultIngressRules() []infrastruct
643643
},
644644
},
645645
},
646+
{
647+
IngressSecurityRule: infrastructurev1beta1.IngressSecurityRule{
648+
Description: common.String("Control Plane to Control Plane Kubelet Communication"),
649+
Protocol: common.String("6"),
650+
TcpOptions: &infrastructurev1beta1.TcpOptions{
651+
DestinationPortRange: &infrastructurev1beta1.PortRange{
652+
Max: common.Int(10250),
653+
Min: common.Int(10250),
654+
},
655+
},
656+
SourceType: infrastructurev1beta1.IngressSecurityRuleSourceTypeCidrBlock,
657+
Source: common.String(ControlPlaneMachineSubnetDefaultCIDR),
658+
},
659+
},
646660
}
647661
}
648662

‎cloud/scope/nsg_reconciler_test.go

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -308,6 +308,20 @@ func TestClusterScope_NSGSpec(t *testing.T) {
308308
},
309309
},
310310
},
311+
{
312+
IngressSecurityRule: infrastructurev1beta1.IngressSecurityRule{
313+
Description: common.String("Control Plane to Control Plane Kubelet Communication"),
314+
Protocol: common.String("6"),
315+
TcpOptions: &infrastructurev1beta1.TcpOptions{
316+
DestinationPortRange: &infrastructurev1beta1.PortRange{
317+
Max: common.Int(10250),
318+
Min: common.Int(10250),
319+
},
320+
},
321+
SourceType: infrastructurev1beta1.IngressSecurityRuleSourceTypeCidrBlock,
322+
Source: common.String(ControlPlaneMachineSubnetDefaultCIDR),
323+
},
324+
},
311325
},
312326
},
313327
{
@@ -728,6 +742,20 @@ func TestClusterScope_NSGSpec(t *testing.T) {
728742
},
729743
},
730744
},
745+
{
746+
IngressSecurityRule: infrastructurev1beta1.IngressSecurityRule{
747+
Description: common.String("Control Plane to Control Plane Kubelet Communication"),
748+
Protocol: common.String("6"),
749+
TcpOptions: &infrastructurev1beta1.TcpOptions{
750+
DestinationPortRange: &infrastructurev1beta1.PortRange{
751+
Max: common.Int(10250),
752+
Min: common.Int(10250),
753+
},
754+
},
755+
SourceType: infrastructurev1beta1.IngressSecurityRuleSourceTypeCidrBlock,
756+
Source: common.String(ControlPlaneMachineSubnetDefaultCIDR),
757+
},
758+
},
731759
},
732760
},
733761
},

‎docs/src/networking/antrea.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ The OCI Compute instances running the Kubernetes Control plane components will b
3535
| CIDR Block | 10.0.0.8/29 | 6443 | TCP | Kubernetes API endpoint to Kubernetes Control plane communication |
3636
| CIDR Block | 10.0.0.0/29 | 6443 | TCP | Control plane to Control plane (API Server port) communication |
3737
| CIDR Block | 10.0.64.0/20 | 6443 | TCP | Worker Node to Kubernetes Control plane (API Server port)communication|
38+
| CIDR block | 10.0.0.0/29 | 10250 | TCP | Control Plane to Control Plane Kubelet Communication |
3839
| CIDR Block | 10.0.0.0/29 | 2379 | TCP | etcd client communication |
3940
| CIDR Block | 10.0.0.0/29 | 2380 | TCP | etcd peer communication |
4041
| CIDR Block | 10.0.0.0/29 | 10349 | TCP | Antrea Service |

‎docs/src/networking/calico.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,11 @@ The OCI compute instances running the Kubernetes control plane components will b
3131
#### Ingress Rules
3232

3333
| Source Type | Source | Destination Port | Protocol | Description |
34-
| ---------------- | ----------------- | ----------------- | -------------------- | --------------------------------------------------------------------- |
34+
| ---------------- | ----------------- | ----------------- | -------------------- |-----------------------------------------------------------------------|
3535
| CIDR block | 10.0.0.8/29 | 6443 | TCP | Kubernetes API endpoint to Kubernetes control plane communication |
3636
| CIDR block | 10.0.0.0/29 | 6443 | TCP | Control plane to control plane (API server port) communication |
3737
| CIDR block | 10.0.64.0/20 | 6443 | TCP | Worker Node to Kubernetes control plane (API Server) communication |
38+
| CIDR block | 10.0.0.0/29 | 10250 | TCP | Control Plane to Control Plane Kubelet Communication |
3839
| CIDR block | 10.0.0.0/29 | 2379 | TCP | etcd client communication |
3940
| CIDR block | 10.0.0.0/29 | 2380 | TCP | etcd peer communication |
4041
| CIDR block | 10.0.0.0/29 | 179 | TCP | Calico networking (BGP) |

‎templates/cluster-template-antrea.yaml

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,16 @@ spec:
156156
destinationPortRange:
157157
max: 22
158158
min: 22
159+
- ingressRule:
160+
description: Control Plane to Control Plane Kubelet Communication
161+
isStateless: false
162+
protocol: "6"
163+
source: 10.0.0.0/29
164+
sourceType: CIDR_BLOCK
165+
tcpOptions:
166+
destinationPortRange:
167+
max: 10250
168+
min: 10250
159169
name: control-plane
160170
role: control-plane
161171
- egressRules:
@@ -290,7 +300,7 @@ spec:
290300
memoryInGBs: "${OCI_SHAPE_MEMORY_IN_GBS}"
291301
metadata:
292302
ssh_authorized_keys: "${OCI_SSH_KEY}"
293-
IsPvEncryptionInTransitEnabled: ${OCI_PV_TRANSIT_ENCRYPTION=true}
303+
isPvEncryptionInTransitEnabled: ${OCI_PV_TRANSIT_ENCRYPTION=true}
294304
---
295305
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
296306
kind: OCIMachineTemplate
@@ -307,7 +317,7 @@ spec:
307317
memoryInGBs: "${OCI_SHAPE_MEMORY_IN_GBS}"
308318
metadata:
309319
ssh_authorized_keys: "${OCI_SSH_KEY}"
310-
IsPvEncryptionInTransitEnabled: ${OCI_PV_TRANSIT_ENCRYPTION=true}
320+
isPvEncryptionInTransitEnabled: ${OCI_PV_TRANSIT_ENCRYPTION=true}
311321
---
312322
apiVersion: bootstrap.cluster.x-k8s.io/v1alpha4
313323
kind: KubeadmConfigTemplate

‎templates/cluster-template-failure-domain-spread.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ spec:
8686
memoryInGBs: "${OCI_SHAPE_MEMORY_IN_GBS}"
8787
metadata:
8888
ssh_authorized_keys: "${OCI_SSH_KEY}"
89-
IsPvEncryptionInTransitEnabled: ${OCI_PV_TRANSIT_ENCRYPTION=true}
89+
isPvEncryptionInTransitEnabled: ${OCI_PV_TRANSIT_ENCRYPTION=true}
9090
---
9191
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
9292
kind: OCIMachineTemplate
@@ -103,7 +103,7 @@ spec:
103103
memoryInGBs: "${OCI_SHAPE_MEMORY_IN_GBS}"
104104
metadata:
105105
ssh_authorized_keys: "${OCI_SSH_KEY}"
106-
IsPvEncryptionInTransitEnabled: ${OCI_PV_TRANSIT_ENCRYPTION=true}
106+
isPvEncryptionInTransitEnabled: ${OCI_PV_TRANSIT_ENCRYPTION=true}
107107
---
108108
apiVersion: bootstrap.cluster.x-k8s.io/v1alpha4
109109
kind: KubeadmConfigTemplate

0 commit comments

Comments
 (0)