filter redundant health check SG rules #2006
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
approved
Codecov Report
@@ Coverage Diff @@
## main #2006 +/- ##
==========================================
+ Coverage 49.05% 49.15% +0.10%
==========================================
Files 130 130
Lines 7008 7022 +14
==========================================
+ Hits 3438 3452 +14
Misses 3292 3292
Partials 278 278
Continue to review full report at Codecov.
|
| func (t *defaultModelBuildTask) buildHealthCheckNetworkingIngressRules(trafficSource, hcSource []elbv2model.NetworkingPeer, tgPort, hcPort intstr.IntOrString, | ||
| tgProtocol corev1.Protocol, preserveClientIP, customSoureRanges bool) []elbv2model.NetworkingIngressRule { | ||
| if tgProtocol != corev1.ProtocolUDP && | ||
| (hcPort.String() == healthCheckPortTrafficPort || hcPort.IntValue() == tgPort.IntValue()) { |
There was a problem hiding this comment.
Nit:
hcPort.IntValue() == tgPort.IntValue this check is hacky.
If somehow in the future, both hcPort and tgPort is a string but not equal, this will evaluate to true.
ideally we should check hcPort's type.
There was a problem hiding this comment.
currently health check port is limited to int values. Will revisit this logic when we support named ports as well.
| if !preserveClientIP { | ||
| return []elbv2model.NetworkingIngressRule{} | ||
| } | ||
| if !customSoureRanges { |
There was a problem hiding this comment.
LGTM for this version.
however, this becomes really complicated. we should refactor this logic here by some thing like compare CIDRs in the future.
There was a problem hiding this comment.
once we have SG support for NLB, this wouldn't be a matter of concern.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kishorj, M00nF1sh The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/lgtm |
k8s-ci-robot
added
the
lgtm
Filter out redundant health check security group rules when the following conditions are met
In case of preserve client IP disabled, separate set of health check rules do not get added if traffic and health check ports are the same.