Skip to content

Commit 50effa6

Browse files
sl1pm4tsl1pm4t
committed
Create firewall rules for secondary ranges
1 parent a25d801 commit 50effa6

File tree

2 files changed

+161
-0
lines changed

2 files changed

+161
-0
lines changed

‎cloud/scope/cluster.go

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,28 @@ func (s *ClusterScope) FirewallRulesSpec() []*compute.Firewall {
315315
},
316316
}
317317

318+
for i, subnet := range s.GCPCluster.Spec.Network.Subnets {
319+
for k, cidr := range subnet.SecondaryCidrBlocks {
320+
firewallRules = append(firewallRules, &compute.Firewall{
321+
Name: fmt.Sprintf("allow-%s-%d-%s", s.Name(), i, k),
322+
Network: s.NetworkLink(),
323+
Allowed: []*compute.FirewallAllowed{
324+
{
325+
IPProtocol: "all",
326+
},
327+
},
328+
Direction: "INGRESS",
329+
SourceRanges: []string{
330+
cidr,
331+
},
332+
TargetTags: []string{
333+
s.Name() + "-control-plane",
334+
s.Name() + "-node",
335+
},
336+
})
337+
}
338+
}
339+
318340
return firewallRules
319341
}
320342

‎templates/cluster-template-ip-aliases.yaml

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
---
2+
apiVersion: cluster.x-k8s.io/v1beta1
3+
kind: Cluster
4+
metadata:
5+
name: "${CLUSTER_NAME}"
6+
spec:
7+
clusterNetwork:
8+
pods:
9+
cidrBlocks: ["100.88.0.0/16"]
10+
infrastructureRef:
11+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
12+
kind: GCPCluster
13+
name: "${CLUSTER_NAME}"
14+
controlPlaneRef:
15+
kind: KubeadmControlPlane
16+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
17+
name: "${CLUSTER_NAME}-control-plane"
18+
---
19+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
20+
kind: GCPCluster
21+
metadata:
22+
name: "${CLUSTER_NAME}"
23+
spec:
24+
project: "${GCP_PROJECT}"
25+
region: "${GCP_REGION}"
26+
network:
27+
name: "${GCP_NETWORK_NAME}"
28+
autoCreateSubnetworks: false
29+
subnets:
30+
- name: "${GCP_NETWORK_NAME}"
31+
region: "${GCP_REGION}"
32+
description: Subnet for Ditto Cluster ${GCP_NETWORK_NAME}"
33+
cidrBlock: "10.22.0.0/20"
34+
privateGoogleAccess: true
35+
purpose: PRIVATE
36+
secondaryCidrBlocks:
37+
pods: "100.88.0.0/16"
38+
---
39+
kind: KubeadmControlPlane
40+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
41+
metadata:
42+
name: "${CLUSTER_NAME}-control-plane"
43+
spec:
44+
replicas: ${CONTROL_PLANE_MACHINE_COUNT}
45+
machineTemplate:
46+
infrastructureRef:
47+
kind: GCPMachineTemplate
48+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
49+
name: "${CLUSTER_NAME}-control-plane"
50+
kubeadmConfigSpec:
51+
initConfiguration:
52+
nodeRegistration:
53+
name: '{{ ds.meta_data.local_hostname.split(".")[0] }}'
54+
kubeletExtraArgs:
55+
cloud-provider: gce
56+
feature-gates: "DisableCloudProviders=false,DisableKubeletCloudCredentialProviders=false"
57+
clusterConfiguration:
58+
apiServer:
59+
timeoutForControlPlane: 20m
60+
extraArgs:
61+
cloud-provider: gce
62+
feature-gates: "DisableCloudProviders=false,DisableKubeletCloudCredentialProviders=false"
63+
controllerManager:
64+
extraArgs:
65+
cloud-provider: gce
66+
feature-gates: "DisableCloudProviders=false,DisableKubeletCloudCredentialProviders=false"
67+
allocate-node-cidrs: "false"
68+
joinConfiguration:
69+
nodeRegistration:
70+
name: '{{ ds.meta_data.local_hostname.split(".")[0] }}'
71+
kubeletExtraArgs:
72+
cloud-provider: gce
73+
feature-gates: "DisableCloudProviders=false,DisableKubeletCloudCredentialProviders=false"
74+
version: "${KUBERNETES_VERSION}"
75+
---
76+
kind: GCPMachineTemplate
77+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
78+
metadata:
79+
name: "${CLUSTER_NAME}-control-plane"
80+
spec:
81+
template:
82+
spec:
83+
instanceType: "${GCP_CONTROL_PLANE_MACHINE_TYPE}"
84+
image: "${IMAGE_ID}"
85+
subnet: "${CLUSTER_NAME}"
86+
aliasIPRanges:
87+
- ipCidrRange: /25
88+
subnetworkRangeName: pods
89+
---
90+
apiVersion: cluster.x-k8s.io/v1beta1
91+
kind: MachineDeployment
92+
metadata:
93+
name: "${CLUSTER_NAME}-md-0"
94+
spec:
95+
clusterName: "${CLUSTER_NAME}"
96+
replicas: ${WORKER_MACHINE_COUNT}
97+
selector:
98+
matchLabels:
99+
template:
100+
spec:
101+
clusterName: "${CLUSTER_NAME}"
102+
version: "${KUBERNETES_VERSION}"
103+
bootstrap:
104+
configRef:
105+
name: "${CLUSTER_NAME}-md-0"
106+
apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
107+
kind: KubeadmConfigTemplate
108+
infrastructureRef:
109+
name: "${CLUSTER_NAME}-md-0"
110+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
111+
kind: GCPMachineTemplate
112+
---
113+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
114+
kind: GCPMachineTemplate
115+
metadata:
116+
name: "${CLUSTER_NAME}-md-0"
117+
spec:
118+
template:
119+
spec:
120+
instanceType: "${GCP_NODE_MACHINE_TYPE}"
121+
image: "${IMAGE_ID}"
122+
subnet: "${CLUSTER_NAME}"
123+
aliasIPRanges:
124+
- ipCidrRange: /25
125+
subnetworkRangeName: pods
126+
---
127+
apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
128+
kind: KubeadmConfigTemplate
129+
metadata:
130+
name: "${CLUSTER_NAME}-md-0"
131+
spec:
132+
template:
133+
spec:
134+
joinConfiguration:
135+
nodeRegistration:
136+
name: '{{ ds.meta_data.local_hostname.split(".")[0] }}'
137+
kubeletExtraArgs:
138+
cloud-provider: gce
139+
feature-gates: "DisableCloudProviders=false,DisableKubeletCloudCredentialProviders=false"

0 commit comments

Comments
 (0)