Skip to content

Commit 99cacca

Browse files
modzilla99modzilla99
committed
Automatically allow egress IPs on ManagedSeeds
Signed-off-by: Justin Lamp <[email protected]>
1 parent a2359a5 commit 99cacca

File tree

5 files changed

+165
-1
lines changed

5 files changed

+165
-1
lines changed

‎charts/gardener-extension-acl/templates/rbac.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,23 @@ rules:
144144
- watch
145145
---
146146
apiVersion: rbac.authorization.k8s.io/v1
147+
kind: Role
148+
metadata:
149+
labels:
150+
{{ include "labels" . | indent 4 }}
151+
name: {{ include "name" . }}
152+
namespace: kube-system
153+
rules:
154+
- apiGroups:
155+
- ""
156+
resources:
157+
- configmaps
158+
resourceNames:
159+
- shoot-info
160+
verbs:
161+
- get
162+
---
163+
apiVersion: rbac.authorization.k8s.io/v1
147164
kind: ClusterRoleBinding
148165
metadata:
149166
name: {{ include "name" . }}
@@ -157,3 +174,19 @@ subjects:
157174
- kind: ServiceAccount
158175
name: {{ include "name" . }}
159176
namespace: {{ .Release.Namespace }}
177+
---
178+
apiVersion: rbac.authorization.k8s.io/v1
179+
kind: RoleBinding
180+
metadata:
181+
name: {{ include "name" . }}
182+
namespace: kube-system
183+
labels:
184+
{{ include "labels" . | indent 4 }}
185+
roleRef:
186+
apiGroup: rbac.authorization.k8s.io
187+
kind: Role
188+
name: {{ include "name" . }}
189+
subjects:
190+
- kind: ServiceAccount
191+
name: {{ include "name" . }}
192+
namespace: {{ .Release.Namespace }}

‎deploy/extension/base/controller-registration.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ kind: ControllerDeployment
44
metadata:
55
name: acl
66
helm:
7-
rawChart: H4sIAAAAAAAAA+0ba3PbNjKf+StwynWadErqYUluNZOZKrYv9YxfY6e+uel0PBAJUahJggVIOcrjfvstAIqESMqUH3EujfaDRC4WiwX2gcWDPuYeiQi3ybuERIKyyMZu0H72mNAB2B0M1D9A+V89d3f63d6gNxxKfLff7XafocGjSrEGUpFgjtAzzlhyG11T+VcKfr3+nRkJQupHjJOHtyEVPOz31+of1F7S/7DXHz5DnYc33QzfuP6fozOcJIRHAiUMaY2jmxmJ0CSlgUcjH8XYvcY+EY71HL2dUYFEGseMJ/AAVhIgP2ATFOLEnQH1j4iTACd0TqBeMjPwOPKAQUR8KGURehFzMqXviIduKND946WDTqNggVikakqRUEw4CmhEHMvZv7i6SEA2YLHHwhAYXO5dII9yYTk+TdrqV4tvOZP3vK1+l4iZ35Y/y1cxj9oFown0L43RlAZEWD844iaG3wm+ht8khOf/Aukl5pSlAh3uH0CDMWd/EjexHOoR3NZ0gLKcuXCZR9rWl9bq5rDG//dmmCfOAofBI7TR5P+9zm7Z/zs7g63/PwXgmF4SLvU+QvOuheM4f211nU7L8ohwOY0ThRqjX2FeQK60DjRlHCUzgt5kJoTGe0coNyPHinBIRqjewKz5spWOA818RQ7zN4M1/p+QMIYwTsRjZIJ3z/+GXQgJ2/zvCaBR/1cwx8M8LJwkvu9c0BD/u71eKf73Ov2dnW38fwr48MFGHiRikHW1ZMBuIfvTJ2tN0JbEJPIUiWXWDPCEBMKB2cO5JgvNQ72kE8jjCNiRQ1lb8l/hsYbFHAdpJsiHD4hGbpB6uXgOyireIki1bllAyWWE1lBk7auWqr2gEVhM5BJV3TknAcGCOCcg3K2S0RByaC0YQrKATtE1jbxDgVoi4ZAiQ4uXsmVoRdKinHINGsQlkssMizOVSwOjGe4NhqMSJyfBflEthraSKWp9J375TpQpOYmZoJBoL25joVquYTi6N0MYMWPwPn360m7xzUBj/HdZNKV+iGNb6W0O6x7GbQb52w2nCdlkjdCU//eHpfU/POxu4/+TQBaJVnzzUun4dKli6Zm2bVulpYIMXiNYQ0vzOMaxFZIEezjBI/BpnfrXB+96O8oqiRjXRVaF1uFCx+lRTXSX7D8CEuw5QX1JvRRHtSiuVo12hD5KJrf2fJXd3zE8Nfq/R+KALUIYhHtvBzT4/2CwU87/ut3hdv3/JFB2bMh3RDv37v1c+Ru7950dGQHMqD+z8RxTQNKAJgtbTzuQPgiWchf8c2mojhuw1GsnixjYA1XCWRAQvlE8EDFxZYOczKns7q9UyMzkiIY0GaGOKokD6mKhJc9CQ4bcYykwUrIL6JKMFFp6tcd5tFlcGmoGS//KGBhjKwFHEUvUNqlYojaM0ygDd0bca5GGxvRdOHhtAF7R5wuV06F/Om8zOZ3XoMEzuaHb2igjaL1Undb5KMhRyGakexph2oEESLRvGAf78ys6Z7YHI4JwELAb4m1Wg4PSaEhsMHJBOAhZ1G9Q1U9LGZdmIwEGhkEvF3sBFuJkdYdLLATo1f6508mIZYPUJWPXlaZzcrvXKLWBPWNYLvB8POwmZ9OgNLFKlS04qmRnaRCcMbDoxYqVl8rMapj7hoJsZNshfidd1E05h6GyOZEvcgP9lcGx8E71nBFfLCJXmNwlvxnBQTJTVnt33kblpnY8KvAkILZR3eSaFe8VpWAOfzIaodaPrTIvfZpgs5hw5at24bbrJNVVTpc1xnmFMm+ImJ6clGWYUS7rvVqTTZUoV7iofVpbnsO8aqtnkReX4gn2PCqr42CsnWOPerwyegWVnfmQ7Uo6s7trONUPYyUYVATLHTrbMC6LlDtfVm6KclvdmpZJNDeNXPvd0cF4/+D86uDoYO/t4enJ1cn4+ODibLx3kFMipPYL/sVZODKQCE0pCbxzMl3FZngZS0d54HfyKXPdODQF/KW8h8fjNweXIOzp+dXp5cH5v88P31ZkHaHMHIqUuF2bI99BUflMbdLkSDUvJuw/wLOmxkeUcBoWkbfbaVCVIODkMgqDb8G8Zo6wMswzTucQMXxyIFwcYH14McWBIAali2OdbVAiVnXkcRaP0O/jo6M/DDzMJGNxwqJzyARHIHFKyoW/CTm9DCGh7ZWL3nCWxtUy6IjLwviMM3n8uCqFTnHO9fy1T6Y4DZL7msecBWlIjuU0JKpG3pAaGFKFkoO23aoJmX2GqCSPc0vjVFHlnbqhO1GZGjeV3l0uVc1hvtdKNbcTrZRj5gGPfq9jdCrr5ZdO7xuhcf0XMwjogqfqBHCSej6580Kw8f5Hv7z/s9PZ3d7/eBLIHNBP0AuZ8dcteV6ibt0WUKzSxGKteMa8/dxQXitD+XyLxrus9iCf/C3KFpeBZi/SSWN/H7zK+yrCQKP/8wl2H3gRpMH/+zuD8v2P3d3udv/3SaDs1UrdOE1msMp9rxIn5/onde5VbPkGMGaEn7OA3MXB7+K6PA3kPG8jEE1lTmrSt82VPhUgHMgFeJiZJxmBDDryP4Bi9XAjvVY9xflTGoPIRD26kKhkjx54u3o0klaJh2UBW0B2Bl0WVYlytynvUFUZuXrchG4tEnJhyz39SqMpxwJyJTdJodpGnXqILAVp6bUN7pCkmwlQO6oVqdZt4VWFCnEE+ZaXYxuEMHR3U6fbQrRMtRXRWq2qEPk8dE8lwKuhB+07NbYApsDCJVKdEatV85pGja5WOlgd8HUuvNYkOQuIKCMm4JDgaBpfUJSK7ijsXbXRggUSJ4lo6TdIxiP98pkNQ26D14lTnIY0SlE0fd8BcRnEBxrdrkKVJpU0kTX4QIZLvErBdNnGe1CGMEaXl2O0znW8kArpN5z4MIr8djnDVG6dRf4NmcwYu9aru1RX2jx+3Vc39TNRSUQf+N3gxYaR5EEz8Wvtkp9tQoYmsq2s5UDcIiFQVVOFBnkgJZd3qtWsrytfrOyeN/dnkxXEl063/u+gMf/PzjCw1sK9VgJN6/+dbre0/u8Bcpv/PwWsvdhR8r4vupKHGMPUzuOqUG/ZNcn3db/0QH6l0Oj/8xg/9DuQpvu/O+X7X93dwXB36/9PAaUNeKltEsl9Mq9uz086ojxRkWlPORkBooRC2RnzxhkZ4Y8dN/SeXo3Qy8zLPLxexeldvPyEXSGpeZqQF+mD+u9/+N7Kjz1olJ1mmmcHbpwqUTn5K6UcRqy1XiKnYOFAPURFXq11S0fK1YwjHXltJGR8cS8RdNX7SJHVXN3fRAicCPLa/LSz7kqRxFeuFTWdwQCBzstNJWqMPnYxznul4CaxU9B9NfuxTw1r4v9cj+jjfADYGP8HO5Xvf7fnP08D+uKQCpbLi/oj5M9cLmM7DI17TRN9l2rNNyHS9f0RUslCYlUuGB1OT1hyBuFEOrtlHrOMUE8ijAWzDEXAJAvJKrq2Bp2wZZnBrjXsH9OWZYGzS7psssrPmetifjV6K97A2loNpJJ1Y8BpnRO9aQBCGHd7JGHp8hE0Aci1d36KGwnGBaZ8liozsqp3k0bo9z8sq/7CjS57jupO1OXN5+doeS16pJ6Lw3QMmR9ROIT0WJ4bpjFLkliM2m3hzm4wf0+TXzwyd/D7lBPHZWGBL54ccU3aV/Ij7Yy5cfsqa8c0Pk58R22Hy3oOSTtdJ7PD7FKfZLcqprLAVsfpOT+DUpaGOtLbLtnHrK1t0N/CFrawhS1sYQtb2MIWtvBtw/8AAsQ90gBQAAA=
7+
rawChart: H4sIAAAAAAAAA+0ba2/jNnI/61fwvFd0t6jkR2KnNbBA3SS3DZAXkm0Oh6IIaIm22UiiSlLOeh/3229IyrKsR2Q7Wee29XywJXI4HHIeHA6pMeYeCQm3yXtJQkFZaGPXb754SmgBHHS7+h8g/6+f23v77U630+up8vZ+u91+gbpPykUFxEJijtALzph8CK+u/iuFcbn8nQnxAzoOGSeP70MJuLe/Xyl/EHtO/r3Ofu8Faj2+63r4m8v/JbrEUhIeCiQZMhJH9xMSomFMfY+GYxRh9w6PiXCsl+jdhAok4ihiXMIDaImPxj4bogBLdwLY3yNOfCzplEA7OcmU49ADAiEZQy0L0auIkxF9Tzx0TwHvH68ddBH6M8RC3VKxhCLCkU9D4ljO0fXttQTegMQhCwIgcHN4jTzKheWMqWzqX8O+5Qw/8Kb+nRdMxk31M38V07C5IDSE8cURGlGfCOs7R9xH8DvEd/ArA3j+L6DeYE5ZLNDJ0TF0GHH2B3Gl5VCP4KbBgyLLmQqXeaRpPbdUV4cK+z+cYC6dGQ78J+ijzv47rYO8/bf2ujv73wbgiN4QruTeR9O2haMofW20nVbD8ohwOY2kLhqgX2BdQK7SDjRiHMkJQW8TFUKDw1OUqpFjhTggfVSuYNZ03kvLgW6+IoP5i0GF/UsSRODGiXiKSHD9+K/XBpewi/+2ALXyv4U1HtZh4cho07Wgxv+3O52c/++09vf2dv5/G/Dxo408CMQg6mooh91A9ufPVoXTVsgk9DSKlW3p4yHxhQOrh3NHZoaGfomHEMcR0COHsqaiv0SjgsQU+3HCyMePiIauH3spew5KGj7ASLFtnkFFpY8qMJL+dU/FUdAQNCZ0iW7uXBGfYEGcc2DuQc5oADG0YQwhVUFH6I6G3olADSE5hMjQ443qGXpRuCjFrCgGdomiMsHiUsfSQGiCO91eP0fJkXi8aBZBX3KEGt+In74ReUxOIiYoBNqzh0jonksI9jcmCDOWmbzPn5/bLP42UOv/XRaO6DjAka3lNoV9D+M2g/jtnlNJVtkj1MX/+73c/h8eDnb+fyuQeKIl27zRMr6Yi1hZpm3bVm6roJxXH/bQSj3OcGQFRGIPS9wHmzahf7nzLtejpJGIcJln1cXGXRg/3S/x7or8JygEfZZoX2HP2dE9ittlpe2jT4rIgyNfJvdXdE+19u+RyGezACZh43RAjf13u3v5+K/d7u32/1uBvGFDvCOaqXUfpcJf2bzXNmQEMKHjiY2nmEIh9amc2WbZgfBBsJi7YJ9zRXVcn8VeU84iIA9YkjPfJ3wlfyAi4qoOOZlSNdxfqFCRySkNqOyjlq6JfOpiYThPXENSeMhiIKR5FzAk5SkM9zrHebqaX+oZAnP7Sghk5lYBDkMmdZpUzItW9NMoAXdC3DsRB5nle2HgpQ54SZ6vdEyH/um8S/h0fgYJXqqEbmOliKDxWg/axKPAx4K3TLhnCrJ6oAAC7XvGQf/GBZkz24MZQdj32T3xVmvBQWg0IDYouSAcmFy0rxHVD3Me52qjACaGwShnhz4W4nw5wyVmAuRq/9hqJciqQ+qSgesq1Tl/2Gq02ECfMWwXeDofdp2xGdCSWMZKNhxFtMvY9y8ZaPRsSctzddlmmI8zArKRbQf4vTJRN+YcpsrmRL2oBPqbDMWFdernBPl6FroiS13RmxDsy4nW2vVpZxrX9eNRgYc+sTPNs1ST6sNFLajDH4yGqPF9I0/LnCbYLCJc26q9MNsqTk2Ti3mLQdogTxs8pqcWZeVmtMl6byqiqRzmEhWdp7XVOcybpn4WaXXOn2DPo6o59gfGOA6pxwuzt8CyExuyXYWXHW4FpfJpLDiDAmOpQScJ4zxLqfEl9VlWHmpb0jMJp1klN3Z3ejw4Or66PT49Pnx3cnF+ez44O76+HBwep5gI6XzBvzgL+plChEaU+N4VGS2XJuXKl/ZTx++kS2bVPNQ5/Dm/J2eDt8c3wOzF1e3FzfHVv69O3hV47aNEHRYhcbM0Rl5DUOlKncVJC/W6KNl/gGZJi09IchosPG+7VSMqQcDIlRcG24J1LTvDWjEvOZ2CxxiTY+FiH5vDixH2Bclgujgy0QYlYllGHmdRH/02OD39PVMOK8lAnLPwCiLBPnAck3zlr0ItLz0IaDv5qrecxVGxDgbisiC65EwdPy5zYUKcK7N+HZERjn25qXpMmR8H5EwtQ6Ko5DWhQYarQFEwultUoeyYwSup49zcPBVEudYwzCAKS+Oq3LvzrWp2mjfaqaZ6YoRyxjygsd9pZQaVjPK5w/taqN3/RQwcuuCxPgEcxt6YrL0RrL3/sZ/P/+y1Dnb3P7YCiQGOJXqlIv6yLc9r1C5LAUU6TFzsFS+Zd5Qqys9aUb7cpnGd3R7Ek7+GyebSN+RFPKwd76N3eV+FG6i1fz7E7iMvgtTmf7r5+18HB+1d/mcrkLdqLW4cywnscj/owMm5+0Gfey1Svj7MGeFXzCfrGPg6pstjX63zNgLWdOSkF307u9OnApgDvqAcVuZhgqCcjvr3oVo/3Cur1U9R+hRHwDLRjy4EKsmjB9auHzNBqyqHbQGbQXQGQxZFjlKzyWeoioRcM2/C9BYKtbHlnnml4YhjAbGSK2NottKgHsPLAjX32gRzkPFqDJTOaoGrqhRekakAhxBveWlpDRMZ2d2XyXbBWiLaAmuNRpGJdB3aUAjwmpGDsZ0SXQBVYMG8UJ8R611zRaeZoRYGWJzwKhOuVEnOfCLyBUMwSDA0U77AyFWtyey60mjABokTKRrmDYLx0Lx8YcVQafAydhanIbVcLLredEJcBv6Bhg+LUIdJOUkkHT6S4Lxch2CmbuUcVIaZzJDnc1RlOl5AhbIbTsYwi/xhPoNYpc7C8T0ZThi7M7u72DRa3X9tKpvylSjH4hjo3ePZip5k/ZW4sASvs8auE5GrGzBJertybS4z3/SooEKfBEhO2rD4lSzjj4tMfjYu6osFKNBFktqbT8MDHAJWMXSq4Qe2KOqOuZ5p0/h66TRhLflV7qg2VLoNZrdCm7Yy7f838/3c0X4Ravd/yRkWNrOw0U6wLv+z127n8j8dKNzt/7YBlRd7ctr/rJkcMG6mM8/LTL1jdyTN6z/3RH6lUGv/0wg/9juguvvfe/n7f+2Dbu9gZ//bgNwBjJI2CVWe1CsLD5QhqhM1Ffbm4wJAkhTqLpk3SNAIf2q/YXK6JUzPg8vs5YXlMpPFTW9Y6EKaPU1Kq8xFjW+/+9ZKj71omJxmZ8+O3CjWrHLyZ0w5zFijmiNnQcKBdoiKtFnjgYHkm2WO9NS1oYDx2UYsmKabcJG0XM5vIwRGBEF7etpddqVMlReuldWdwQGC2ZdlhWhKzLFb5rxfMZ5FdhZ4X00+fttQ4f+nZkaf5gPQWv/f3St8/707/9sOmItj2lnOP9Too/HE5cq3w9S4d1Sau3QV3wQp0x/3kQ4WpFW4YHYyOmfyEtyJMnYre8zWRx1VkMkXKFcERBKXrL1ro9sKGlbW2TV6+2e0YVlg7AovWazSewZlPr/ovTVtIG0tO1JFutbhNK6ISRoBE5m7XQoxd/kMuoDCyjtfixspmQts6SqVJ2QV76b10W+/W1b5hStT9xKV3ahQN99fovm1+L5+XlymwBD5EV2GkJnLq4xqTKSMRL/ZFO7kHvMPVP7kkamDP8ScOC4LFuWLJ0fckeat+kg/IZ65fZf0k1U+TsaOPg5R7RwSt9pOoofJpU5FbplNrYGNltNxfgShzBW1b3JKycfMjZ3T38EOdrCDHexgBzvYwQ7+B6z5p1QAUAAA
88
values:
99
image:
1010
tag: latest

‎pkg/controller/actuator.go‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import (
2626

2727
"github.com/gardener/gardener/extensions/pkg/controller"
2828
"github.com/gardener/gardener/extensions/pkg/controller/extension"
29+
gardenercorev1beta1constants "github.com/gardener/gardener/pkg/apis/core/v1beta1/constants"
2930
v1beta1constants "github.com/gardener/gardener/pkg/apis/core/v1beta1/constants"
3031
v1beta1helper "github.com/gardener/gardener/pkg/apis/core/v1beta1/helper"
3132
extensionsv1alpha1 "github.com/gardener/gardener/pkg/apis/extensions/v1alpha1"
@@ -36,6 +37,7 @@ import (
3637
"github.com/pkg/errors"
3738
istionetworkv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
3839
appsv1 "k8s.io/api/apps/v1"
40+
corev1 "k8s.io/api/core/v1"
3941
"k8s.io/apimachinery/pkg/runtime"
4042
"k8s.io/apimachinery/pkg/runtime/serializer"
4143
"k8s.io/client-go/rest"
@@ -48,6 +50,8 @@ import (
4850
"github.com/stackitcloud/gardener-extension-acl/pkg/extensionspec"
4951
"github.com/stackitcloud/gardener-extension-acl/pkg/helper"
5052
"github.com/stackitcloud/gardener-extension-acl/pkg/imagevector"
53+
54+
apierrors "k8s.io/apimachinery/pkg/api/errors"
5155
)
5256

5357
const (
@@ -147,6 +151,14 @@ func (a *actuator) Reconcile(ctx context.Context, log logr.Logger, ex *extension
147151

148152
alwaysAllowedCIDRs = append(alwaysAllowedCIDRs, helper.GetSeedSpecificAllowedCIDRs(cluster.Seed)...)
149153

154+
// On ManagedSeeds the shoot-info ConfigMap contains the egress CIDRs of the cluster
155+
// These CIDRs need to be allowed in order for the external API reachability check to work
156+
egressCIDRs, err := a.getSeedEgressIPOnManagedSeeds(ctx)
157+
if err != nil {
158+
return err
159+
}
160+
alwaysAllowedCIDRs = append(alwaysAllowedCIDRs, egressCIDRs...)
161+
150162
if len(a.extensionConfig.AdditionalAllowedCIDRs) >= 1 {
151163
alwaysAllowedCIDRs = append(alwaysAllowedCIDRs, a.extensionConfig.AdditionalAllowedCIDRs...)
152164
}
@@ -446,3 +458,36 @@ func (a *actuator) findDefaultIstioLabels(
446458

447459
return gw.Spec.Selector, nil
448460
}
461+
462+
// getSeedEgressIPOnManagedSeeds returns the egressIP CIDRs of the ManagedSeed, if the
463+
// Seed is not a shoot, it will return an empty list
464+
func (a *actuator) getSeedEgressIPOnManagedSeeds(ctx context.Context) ([]string, error) {
465+
cm := corev1.ConfigMap{}
466+
if err := a.client.Get(ctx,
467+
client.ObjectKey{
468+
Name: gardenercorev1beta1constants.ConfigMapNameShootInfo,
469+
Namespace: "kube-system",
470+
},
471+
&cm); err != nil {
472+
if apierrors.IsNotFound(err) {
473+
return []string{}, nil
474+
}
475+
return nil, err
476+
}
477+
478+
cidrsStr, ok := cm.Data["egressCIDRs"]
479+
if !ok {
480+
return nil, errors.New("unable to get egress CIDRs from shoot-info ConfigMap")
481+
}
482+
483+
var cidrs []string
484+
for _, i := range strings.Split(cidrsStr, ",") {
485+
_, _, err := net.ParseCIDR(i)
486+
if err != nil {
487+
return nil, err
488+
}
489+
cidrs = append(cidrs, i)
490+
}
491+
492+
return cidrs, nil
493+
}

‎pkg/controller/actuator_test.go‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,60 @@ var _ = Describe("actuator test", func() {
222222
})
223223
})
224224

225+
Describe("reconciliation of an extension object running on a managedSeed", func() {
226+
AfterEach(func() {
227+
deleteShootInfo()
228+
})
229+
230+
It("should return an empty slice of egressIPs if no shoot-info ConfigMap exists", func() {
231+
cidrs, err := a.getSeedEgressIPOnManagedSeeds(ctx)
232+
Expect(err).To(BeNil())
233+
Expect(cidrs).To(BeEmpty())
234+
})
235+
236+
It("should fail to return egressIPs if the shoot-info ConfigMap contains invalid CIDRs", func() {
237+
createShootInfo([]string{"1.1.1.1", "1.1.1.2/32"})
238+
239+
_, err := a.getSeedEgressIPOnManagedSeeds(ctx)
240+
Expect(err).NotTo(BeNil())
241+
})
242+
243+
It("should return the egressIP CIDRs of the shoot-info ConfigMap", func() {
244+
c := []string{"1.1.1.1/32", "1.1.1.2/32"}
245+
createShootInfo(c)
246+
247+
cidrs, err := a.getSeedEgressIPOnManagedSeeds(ctx)
248+
Expect(err).To(BeNil())
249+
Expect(cidrs).To(BeEquivalentTo(c))
250+
})
251+
252+
It("should create ACLs including egressIPs of managedSeed", func() {
253+
createShootInfo([]string{"1.1.1.1/32", "1.1.1.2/32"})
254+
255+
extSpec := extensionspec.ExtensionSpec{
256+
Rule: &envoyfilters.ACLRule{
257+
Cidrs: []string{"1.2.3.4/24"},
258+
Action: "ALLOW",
259+
Type: "remote_ip",
260+
},
261+
}
262+
extSpecJSON, err := json.Marshal(extSpec)
263+
Expect(err).NotTo(HaveOccurred())
264+
ext := createNewExtension(shootNamespace1, extSpecJSON)
265+
Expect(ext).To(Not(BeNil()))
266+
267+
Expect(a.Reconcile(ctx, logger, ext)).To(Succeed())
268+
269+
mr := &v1alpha1.ManagedResource{}
270+
Expect(k8sClient.Get(ctx, types.NamespacedName{Name: ResourceNameSeed, Namespace: shootNamespace1}, mr)).To(Succeed())
271+
secret := &corev1.Secret{}
272+
Expect(k8sClient.Get(ctx, types.NamespacedName{Name: mr.Spec.SecretRefs[0].Name, Namespace: shootNamespace1}, secret)).To(Succeed())
273+
Expect(secret.Data["seed"]).To(ContainSubstring("1.2.3.4"))
274+
Expect(secret.Data["seed"]).To(ContainSubstring("1.1.1.1"))
275+
Expect(secret.Data["seed"]).To(ContainSubstring("1.1.1.2"))
276+
})
277+
})
278+
225279
Describe("a shoot switching the istio namespace (e.g. when being migrated to HA)", func() {
226280
It("should modify the EnvoyFilter objects accordingly", func() {
227281
By("1) creating the EnvoyFilter object correctly in the ORIGINAL namespace")

‎pkg/controller/suite_test.go‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,11 @@ import (
44
"context"
55
"path/filepath"
66
"strconv"
7+
"strings"
78
"testing"
89

910
gardencorev1beta1 "github.com/gardener/gardener/pkg/apis/core/v1beta1"
11+
gardenercorev1beta1constants "github.com/gardener/gardener/pkg/apis/core/v1beta1/constants"
1012
extensionsv1alpha1 "github.com/gardener/gardener/pkg/apis/extensions/v1alpha1"
1113
resourcesv1alpha1 "github.com/gardener/gardener/pkg/apis/resources/v1alpha1"
1214
"github.com/go-logr/logr"
@@ -19,6 +21,7 @@ import (
1921
appsv1 "k8s.io/api/apps/v1"
2022
corev1 "k8s.io/api/core/v1"
2123
"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions"
24+
apierrors "k8s.io/apimachinery/pkg/api/errors"
2225
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2326
"k8s.io/apimachinery/pkg/runtime"
2427
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
@@ -247,6 +250,35 @@ func createNewCluster(shootNamespace string) {
247250
Expect(k8sClient.Create(ctx, cluster)).ShouldNot(HaveOccurred())
248251
}
249252

253+
func createShootInfo(cidrs []string) {
254+
cm := &corev1.ConfigMap{
255+
ObjectMeta: metav1.ObjectMeta{
256+
Name: gardenercorev1beta1constants.ConfigMapNameShootInfo,
257+
Namespace: "kube-system",
258+
},
259+
Data: map[string]string{
260+
"egressCIDRs": strings.Join(cidrs, ","),
261+
},
262+
}
263+
Expect(k8sClient.Create(ctx, cm)).ShouldNot(HaveOccurred())
264+
}
265+
266+
func deleteShootInfo() {
267+
cm := &corev1.ConfigMap{
268+
ObjectMeta: metav1.ObjectMeta{
269+
Name: gardenercorev1beta1constants.ConfigMapNameShootInfo,
270+
Namespace: "kube-system",
271+
},
272+
}
273+
Expect(func() error {
274+
err := k8sClient.Delete(ctx, cm)
275+
if err != nil && !apierrors.IsNotFound(err) {
276+
return err
277+
}
278+
return nil
279+
}()).ShouldNot(HaveOccurred())
280+
}
281+
250282
func deleteNamespace(name string) {
251283
namespace := &corev1.Namespace{
252284
ObjectMeta: metav1.ObjectMeta{

0 commit comments

Comments
 (0)