Skip to content

ylee/mega target group v2.9.2 #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 7, 2025
Merged

ylee/mega target group v2.9.2 #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1870f66
try setting up permission selection based on cluster name
dlmather May 19, 2023
da13a93
mega-target-group: support for 2.9.2 using annotations
ylee-figma Mar 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions pkg/backend/endpoint_resolver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package backend
import (
"context"
"fmt"
"net/netip"

awssdk "github.com/aws/aws-sdk-go-v2/aws"
"github.com/go-logr/logr"
Expand All @@ -13,6 +14,7 @@ import (
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/intstr"
"sigs.k8s.io/aws-load-balancer-controller/pkg/k8s"
"sigs.k8s.io/aws-load-balancer-controller/pkg/networking"
"sigs.k8s.io/controller-runtime/pkg/client"
)

Expand Down Expand Up @@ -72,7 +74,7 @@ func (r *defaultEndpointResolver) ResolvePodEndpoints(ctx context.Context, svcKe
if err != nil {
return nil, false, err
}
return r.resolvePodEndpointsWithEndpointsData(ctx, svcKey, svcPort, endpointsDataList, resolveOpts.PodReadinessGates)
return r.resolvePodEndpointsWithEndpointsData(ctx, svcKey, svcPort, endpointsDataList, resolveOpts.PodReadinessGates, resolveOpts.cidrs)
}

func (r *defaultEndpointResolver) ResolveNodePortEndpoints(ctx context.Context, svcKey types.NamespacedName, port intstr.IntOrString, opts ...EndpointResolveOption) ([]NodePortEndpoint, error) {
Expand Down Expand Up @@ -140,7 +142,7 @@ func (r *defaultEndpointResolver) computeServiceEndpointsData(ctx context.Contex
return endpointsDataList, nil
}

func (r *defaultEndpointResolver) resolvePodEndpointsWithEndpointsData(ctx context.Context, svcKey types.NamespacedName, svcPort corev1.ServicePort, endpointsDataList []EndpointsData, podReadinessGates []corev1.PodConditionType) ([]PodEndpoint, bool, error) {
func (r *defaultEndpointResolver) resolvePodEndpointsWithEndpointsData(ctx context.Context, svcKey types.NamespacedName, svcPort corev1.ServicePort, endpointsDataList []EndpointsData, podReadinessGates []corev1.PodConditionType, cidrs []netip.Prefix) ([]PodEndpoint, bool, error) {
var readyPodEndpoints []PodEndpoint
var unknownPodEndpoints []PodEndpoint
containsPotentialReadyEndpoints := false
Expand Down Expand Up @@ -171,6 +173,19 @@ func (r *defaultEndpointResolver) resolvePodEndpointsWithEndpointsData(ctx conte
continue
}

if len(cidrs) > 0 {
ip, err := netip.ParseAddr(epAddr)
if err != nil {
return nil, false, fmt.Errorf("parse ip addr: %w", err)
}
if !networking.IsIPWithinCIDRs(ip, cidrs) {
// this condition should never hit as long as cidrs are configured properly. if hit, then look at the cidr configured
// and make sure podIPs are within the range passed in.
r.logger.Error(fmt.Errorf("ip from endpoints being filtered"), fmt.Sprintf("unexpected condition hit for %s and ip: %s and cidrs: %s", svcKey.Name, epAddr, cidrs))
continue
}
}

podEndpoint := buildPodEndpoint(pod, epAddr, epPort)
// Recommendation from Kubernetes is to consider unknown ready status as ready (ready == nil)
if ep.Conditions.Ready == nil || *ep.Conditions.Ready {
Expand Down
13 changes: 13 additions & 0 deletions pkg/backend/endpoint_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ package backend

import (
"fmt"
"net/netip"

corev1 "k8s.io/api/core/v1"
discv1 "k8s.io/api/discovery/v1"
"k8s.io/apimachinery/pkg/labels"
Expand Down Expand Up @@ -54,6 +56,9 @@ type EndpointResolveOptions struct {
// [Pod Endpoint] if pod readinessGates is defined, then pods from unready addresses with any of these readinessGates and containersReady condition will be included as well.
// By default, no readinessGate is specified.
PodReadinessGates []corev1.PodConditionType

// cidrs will be used to filter out the list of IPs returned by the resolver
cidrs []netip.Prefix
}

func (opts *EndpointResolveOptions) ApplyOptions(options []EndpointResolveOption) {
Expand All @@ -78,6 +83,14 @@ func WithPodReadinessGate(cond corev1.PodConditionType) EndpointResolveOption {
}
}

// WithCIDRRanges is an option that appends cidrs into EndpointResolveOptions to filter
// out the set of IPs to register
func WithCIDRRanges(cidrs []netip.Prefix) EndpointResolveOption {
return func(opts *EndpointResolveOptions) {
opts.cidrs = cidrs
}
}

// defaultEndpointResolveOptions returns the default value for EndpointResolveOptions.
func defaultEndpointResolveOptions() EndpointResolveOptions {
return EndpointResolveOptions{
Expand Down
6 changes: 3 additions & 3 deletions pkg/targetgroupbinding/networking_manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,7 +202,7 @@ func (m *defaultNetworkingManager) reconcileWithIngressPermissionsPerSG(ctx cont
computedForAllTGBs := m.consolidateIngressPermissionsPerSGByTGB(ctx, tgbsWithNetworking)
aggregatedIngressPermissionsPerSG := m.computeAggregatedIngressPermissionsPerSG(ctx)

permissionSelector := labels.SelectorFromSet(labels.Set{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue})
permissionSelector := labels.SelectorFromSet(labels.Set{tgbNetworkingIPPermissionLabelKey: m.clusterName})
var sgReconciliationErrors []error
for sgID, permissions := range aggregatedIngressPermissionsPerSG {
if err := m.sgReconciler.ReconcileIngress(ctx, sgID, permissions,
Expand Down Expand Up @@ -421,7 +421,7 @@ func (m *defaultNetworkingManager) computePermissionsForPeerPort(ctx context.Con
})
}

permissionLabels := map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue}
permissionLabels := map[string]string{tgbNetworkingIPPermissionLabelKey: m.clusterName}
if peer.SecurityGroup != nil {
groupID := peer.SecurityGroup.GroupID
permissions := make([]networking.IPPermissionInfo, 0, len(sdkFromToPortPairs))
Expand Down Expand Up @@ -484,7 +484,7 @@ func (m *defaultNetworkingManager) gcIngressPermissionsFromUnusedEndpointSGs(ctx
usedEndpointSGs := sets.StringKeySet(ingressPermissionsPerSG)
unusedEndpointSGs := endpointSGs.Difference(usedEndpointSGs)

permissionSelector := labels.SelectorFromSet(labels.Set{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue})
permissionSelector := labels.SelectorFromSet(labels.Set{tgbNetworkingIPPermissionLabelKey: m.clusterName})
for sgID := range unusedEndpointSGs {
err := m.sgReconciler.ReconcileIngress(ctx, sgID, nil,
networking.WithPermissionSelector(permissionSelector))
Expand Down
66 changes: 36 additions & 30 deletions pkg/targetgroupbinding/networking_manager_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ import (
"sigs.k8s.io/aws-load-balancer-controller/pkg/networking"
)

const testClusterName = "test-123"

func Test_defaultNetworkingManager_computeIngressPermissionsForTGBNetworking(t *testing.T) {
port8080 := intstr.FromInt(8080)
port8443 := intstr.FromInt(8443)
Expand Down Expand Up @@ -60,12 +62,12 @@ func Test_defaultNetworkingManager_computeIngressPermissionsForTGBNetworking(t *
ToPort: awssdk.Int32(8080),
UserIdGroupPairs: []ec2types.UserIdGroupPair{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
GroupId: awssdk.String("sg-abcdefg"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
},
},
Expand Down Expand Up @@ -107,12 +109,12 @@ func Test_defaultNetworkingManager_computeIngressPermissionsForTGBNetworking(t *
ToPort: awssdk.Int32(8080),
UserIdGroupPairs: []ec2types.UserIdGroupPair{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
GroupId: awssdk.String("sg-abcdefg"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
{
Permission: ec2types.IpPermission{
Expand All @@ -121,12 +123,12 @@ func Test_defaultNetworkingManager_computeIngressPermissionsForTGBNetworking(t *
ToPort: awssdk.Int32(8443),
UserIdGroupPairs: []ec2types.UserIdGroupPair{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
GroupId: awssdk.String("sg-abcdefg"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
{
Permission: ec2types.IpPermission{
Expand All @@ -135,12 +137,12 @@ func Test_defaultNetworkingManager_computeIngressPermissionsForTGBNetworking(t *
ToPort: awssdk.Int32(8080),
IpRanges: []ec2types.IpRange{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
CidrIp: awssdk.String("192.168.1.1/16"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
{
Permission: ec2types.IpPermission{
Expand All @@ -149,12 +151,12 @@ func Test_defaultNetworkingManager_computeIngressPermissionsForTGBNetworking(t *
ToPort: awssdk.Int32(8443),
IpRanges: []ec2types.IpRange{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
CidrIp: awssdk.String("192.168.1.1/16"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
},
},
Expand Down Expand Up @@ -202,12 +204,12 @@ func Test_defaultNetworkingManager_computeIngressPermissionsForTGBNetworking(t *
ToPort: awssdk.Int32(8080),
UserIdGroupPairs: []ec2types.UserIdGroupPair{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
GroupId: awssdk.String("sg-abcdefg"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
{
Permission: ec2types.IpPermission{
Expand All @@ -216,19 +218,21 @@ func Test_defaultNetworkingManager_computeIngressPermissionsForTGBNetworking(t *
ToPort: awssdk.Int32(8443),
IpRanges: []ec2types.IpRange{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
CidrIp: awssdk.String("192.168.1.1/16"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
m := &defaultNetworkingManager{}
m := &defaultNetworkingManager{
clusterName: testClusterName,
}
got, err := m.computeIngressPermissionsForTGBNetworking(context.Background(), tt.args.tgbNetworking, tt.args.pods)
if tt.wantErr != nil {
assert.EqualError(t, err, tt.wantErr.Error())
Expand Down Expand Up @@ -277,12 +281,12 @@ func Test_defaultNetworkingManager_computePermissionsForPeerPort(t *testing.T) {
ToPort: awssdk.Int32(8080),
UserIdGroupPairs: []ec2types.UserIdGroupPair{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
GroupId: awssdk.String("sg-abcdefg"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
},
},
Expand All @@ -309,11 +313,11 @@ func Test_defaultNetworkingManager_computePermissionsForPeerPort(t *testing.T) {
IpRanges: []ec2types.IpRange{
{
CidrIp: awssdk.String("192.168.1.1/16"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
},
},
Expand All @@ -340,11 +344,11 @@ func Test_defaultNetworkingManager_computePermissionsForPeerPort(t *testing.T) {
Ipv6Ranges: []ec2types.Ipv6Range{
{
CidrIpv6: awssdk.String("2002::1234:abcd:ffff:c0a8:101/64"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
},
},
Expand Down Expand Up @@ -389,12 +393,12 @@ func Test_defaultNetworkingManager_computePermissionsForPeerPort(t *testing.T) {
ToPort: awssdk.Int32(80),
UserIdGroupPairs: []ec2types.UserIdGroupPair{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
GroupId: awssdk.String("sg-abcdefg"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
{
Permission: ec2types.IpPermission{
Expand All @@ -403,12 +407,12 @@ func Test_defaultNetworkingManager_computePermissionsForPeerPort(t *testing.T) {
ToPort: awssdk.Int32(8080),
UserIdGroupPairs: []ec2types.UserIdGroupPair{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
GroupId: awssdk.String("sg-abcdefg"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
},
},
Expand All @@ -434,12 +438,12 @@ func Test_defaultNetworkingManager_computePermissionsForPeerPort(t *testing.T) {
ToPort: awssdk.Int32(8080),
UserIdGroupPairs: []ec2types.UserIdGroupPair{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
GroupId: awssdk.String("sg-abcdefg"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
},
},
Expand All @@ -464,19 +468,21 @@ func Test_defaultNetworkingManager_computePermissionsForPeerPort(t *testing.T) {
ToPort: awssdk.Int32(65535),
UserIdGroupPairs: []ec2types.UserIdGroupPair{
{
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=shared"),
Description: awssdk.String("elbv2.k8s.aws/targetGroupBinding=test-123"),
GroupId: awssdk.String("sg-abcdefg"),
},
},
},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: tgbNetworkingIPPermissionLabelValue},
Labels: map[string]string{tgbNetworkingIPPermissionLabelKey: testClusterName},
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
m := &defaultNetworkingManager{}
m := &defaultNetworkingManager{
clusterName: testClusterName,
}
got, err := m.computePermissionsForPeerPort(context.Background(), tt.args.peer, tt.args.port, tt.args.pods)
if tt.wantErr != nil {
assert.EqualError(t, err, tt.wantErr.Error())
Expand Down
Loading
Loading