Fix setting single dst prefix for NSG rule #6258
Conversation
|
Hi @zarvd. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
| @@ -379,41 +379,6 @@ func (helper *RuleHelper) removeDestinationFromRule(rule *network.SecurityRule, | |||
| return helper.addAllowRule(rule.Protocol, ipFamily, ListSourcePrefixes(rule), prefixes, expectedPorts) | |||
| } | |||
|
|
|||
| // RemoveDestinationPrefixesFromRules removes the given destination addresses from all rules. | |||
| func (helper *RuleHelper) RemoveDestinationPrefixesFromRules(prefixes []string) { | |||
There was a problem hiding this comment.
Is this function only used in tests?
There was a problem hiding this comment.
Yes, it has been replaced with RemoveDestinationFromRules in LC306
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jwtty, zarvd The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/test |
|
@zarvd: The
Use
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/test pull-cloud-provider-azure-e2e-ccm-dualstack-capz |
| @@ -107,6 +107,17 @@ func ListDestinationPrefixes(r *network.SecurityRule) []string { | |||
| return rv | |||
| } | |||
|
|
|||
| func SetDestinationPrefixes(r *network.SecurityRule, prefixes []string) { | |||
There was a problem hiding this comment.
Not related to the change but it should not be exported since there is no usage outside.
There was a problem hiding this comment.
Could we fix these style issues in the other PRs later? It may also need a dedicated issue to discuss these best practices, including the package structure.
|
Generally looks good. Is it worth an e2e test? |
I think this case is quite tricky as listing all invalid inputs in an E2E test is hard. I prefer to use unit tests for this one. I am thinking of adding a NSG checker to simulate ARM validation in UT (maybe could also send the real ARM request to validate further for integration testing), hoping it could help us identify more issues and fix them sooner. |
|
/test pull-cloud-provider-azure-e2e-ccm-dualstack-capz |
|
/test pull-cloud-provider-azure-e2e-ccm-dualstack-capz |
|
/retest |
|
/lgtm |
|
rebased again... |
|
/retest |
|
/lgtm |
What type of PR is this?
/kind bug
What this PR does / why we need it:
If you’ve got NSG rules set up like the one below, trying to apply a service will throw an error because you can’t set
destinationAddressPrefixesto["*"]. This PR fixes that by usingdestinationAddressPrefixwhen there’s just one destination prefix.{ "id": "/subscriptions/b48b8ebc-3e57-47ff-8603-408c05a7f2ba/resourceGroups/mc_e2erg-runner-pkqtqwafxgdpcaish_e2eaks-tgc_eastus/providers/Microsoft.Network/networkSecurityGroups/aks-agentpool-40253661-nsg/securityRules/NRMS-Rule-105", "name": "NRMS-Rule-105", "properties": { "access": "Deny", "description": "DO NOT DELETE - Will result in ICM Sev 2 - Azure Core Security, see aka.ms/cainsgpolicy", "destinationAddressPrefix": "*", "destinationPortRanges": [ "1433", "1434", "3306", "4333", "5432", "6379", "7000", "7001", "7199", "9042", "9160", "9300", "16379", "26379", "27017" ], "direction": "Inbound", "priority": 105, "protocol": "*", "sourceAddressPrefix": "Internet", "sourceAddressPrefixes": [], "sourcePortRange": "*", "sourcePortRanges": [] }, "type": "Microsoft.Network/networkSecurityGroups/securityRules" }Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?
Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.: