Skip to content

Commit 8ea9435

Browse files
AndiDogAndiDog
committed
Support adding custom secondary VPC CIDR blocks in AWSCluster 
1 parent 0baa03c commit 8ea9435

37 files changed

+535
-93
lines changed

‎api/v1beta1/awscluster_conversion.go

+1
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@ func (src *AWSCluster) ConvertTo(dstRaw conversion.Hub) error {
104104
dst.Spec.NetworkSpec.VPC.EmptyRoutesDefaultVPCSecurityGroup = restored.Spec.NetworkSpec.VPC.EmptyRoutesDefaultVPCSecurityGroup
105105
dst.Spec.NetworkSpec.VPC.PrivateDNSHostnameTypeOnLaunch = restored.Spec.NetworkSpec.VPC.PrivateDNSHostnameTypeOnLaunch
106106
dst.Spec.NetworkSpec.VPC.CarrierGatewayID = restored.Spec.NetworkSpec.VPC.CarrierGatewayID
107+
dst.Spec.NetworkSpec.VPC.SecondaryCidrBlocks = restored.Spec.NetworkSpec.VPC.SecondaryCidrBlocks
107108

108109
// Restore SubnetSpec.ResourceID, SubnetSpec.ParentZoneName, and SubnetSpec.ZoneType fields, if any.
109110
for _, subnet := range restored.Spec.NetworkSpec.Subnets {

‎api/v1beta1/zz_generated.conversion.go

+1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_webhook.go

+8
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,14 @@ func (r *AWSCluster) validateNetwork() field.ErrorList {
269269
}
270270
}
271271

272+
secondaryCidrBlocks := r.Spec.NetworkSpec.VPC.SecondaryCidrBlocks
273+
secondaryCidrBlocksField := field.NewPath("spec", "network", "vpc", "secondaryCidrBlocks")
274+
for _, cidrBlock := range secondaryCidrBlocks {
275+
if r.Spec.NetworkSpec.VPC.CidrBlock != "" && r.Spec.NetworkSpec.VPC.CidrBlock == cidrBlock.IPv4CidrBlock {
276+
allErrs = append(allErrs, field.Invalid(secondaryCidrBlocksField, secondaryCidrBlocks, fmt.Sprintf("AWSCluster.spec.network.vpc.secondaryCidrBlocks must not contain the primary AWSCluster.spec.network.vpc.cidrBlock %v", r.Spec.NetworkSpec.VPC.CidrBlock)))
277+
}
278+
}
279+
272280
return allErrs
273281
}
274282

‎api/v1beta2/network_types.go

+24
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,13 @@ type IPAMPool struct {
388388
NetmaskLength int64 `json:"netmaskLength,omitempty"`
389389
}
390390

391+
// VpcCidrBlock defines the CIDR block and settings to associate with the managed VPC. Currently, only IPv4 is supported.
392+
type VpcCidrBlock struct {
393+
// IPv4CidrBlock is the IPv4 CIDR block to associate with the managed VPC.
394+
// +kubebuilder:validation:MinLength=1
395+
IPv4CidrBlock string `json:"ipv4CidrBlock"`
396+
}
397+
391398
// VPCSpec configures an AWS VPC.
392399
type VPCSpec struct {
393400
// ID is the vpc-id of the VPC this provider should use to create resources.
@@ -398,6 +405,12 @@ type VPCSpec struct {
398405
// Mutually exclusive with IPAMPool.
399406
CidrBlock string `json:"cidrBlock,omitempty"`
400407

408+
// SecondaryCidrBlocks are additional CIDR blocks to be associated when the provider creates a managed VPC.
409+
// Defaults to none. Mutually exclusive with IPAMPool. This makes sense to use if, for example, you want to use
410+
// a separate IP range for pods (e.g. Cilium ENI mode).
411+
// +optional
412+
SecondaryCidrBlocks []VpcCidrBlock `json:"secondaryCidrBlocks,omitempty"`
413+
401414
// IPAMPool defines the IPAMv4 pool to be used for VPC.
402415
// Mutually exclusive with CidrBlock.
403416
IPAMPool *IPAMPool `json:"ipamPool,omitempty"`
@@ -715,6 +728,17 @@ func (s Subnets) FilterPrivate() (res Subnets) {
715728
return
716729
}
717730

731+
// FilterNonCni returns the subnets that are NOT intended for usage with the CNI pod network
732+
// (i.e. do NOT have the `sigs.k8s.io/cluster-api-provider-aws/association=secondary` tag).
733+
func (s Subnets) FilterNonCni() (res Subnets) {
734+
for _, x := range s {
735+
if x.Tags[NameAWSSubnetAssociation] != SecondarySubnetTagValue {
736+
res = append(res, x)
737+
}
738+
}
739+
return
740+
}
741+
718742
// FilterPublic returns a slice containing all subnets marked as public.
719743
func (s Subnets) FilterPublic() (res Subnets) {
720744
for _, x := range s {

‎api/v1beta2/zz_generated.deepcopy.go

+20
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/clusterawsadm/cloudformation/bootstrap/cluster_api_controller.go

+2
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ func (t Template) ControllersPolicy() *iamv1.PolicyDocument {
9090
"ec2:AssignPrivateIpAddresses",
9191
"ec2:UnassignPrivateIpAddresses",
9292
"ec2:AssociateRouteTable",
93+
"ec2:AssociateVpcCidrBlock",
9394
"ec2:AttachInternetGateway",
9495
"ec2:AuthorizeSecurityGroupIngress",
9596
"ec2:CreateCarrierGateway",
@@ -104,6 +105,7 @@ func (t Template) ControllersPolicy() *iamv1.PolicyDocument {
104105
"ec2:CreateTags",
105106
"ec2:CreateVpc",
106107
"ec2:CreateVpcEndpoint",
108+
"ec2:DisassociateVpcCidrBlock",
107109
"ec2:ModifyVpcAttribute",
108110
"ec2:ModifyVpcEndpoint",
109111
"ec2:DeleteCarrierGateway",

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/customsuffix.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/default.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_all_secret_backends.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ Resources:
155155
- ec2:AssignPrivateIpAddresses
156156
- ec2:UnassignPrivateIpAddresses
157157
- ec2:AssociateRouteTable
158+
- ec2:AssociateVpcCidrBlock
158159
- ec2:AttachInternetGateway
159160
- ec2:AuthorizeSecurityGroupIngress
160161
- ec2:CreateCarrierGateway
@@ -169,6 +170,7 @@ Resources:
169170
- ec2:CreateTags
170171
- ec2:CreateVpc
171172
- ec2:CreateVpcEndpoint
173+
- ec2:DisassociateVpcCidrBlock
172174
- ec2:ModifyVpcAttribute
173175
- ec2:ModifyVpcEndpoint
174176
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_allow_assume_role.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_bootstrap_user.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ Resources:
155155
- ec2:AssignPrivateIpAddresses
156156
- ec2:UnassignPrivateIpAddresses
157157
- ec2:AssociateRouteTable
158+
- ec2:AssociateVpcCidrBlock
158159
- ec2:AttachInternetGateway
159160
- ec2:AuthorizeSecurityGroupIngress
160161
- ec2:CreateCarrierGateway
@@ -169,6 +170,7 @@ Resources:
169170
- ec2:CreateTags
170171
- ec2:CreateVpc
171172
- ec2:CreateVpcEndpoint
173+
- ec2:DisassociateVpcCidrBlock
172174
- ec2:ModifyVpcAttribute
173175
- ec2:ModifyVpcEndpoint
174176
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_custom_bootstrap_user.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ Resources:
155155
- ec2:AssignPrivateIpAddresses
156156
- ec2:UnassignPrivateIpAddresses
157157
- ec2:AssociateRouteTable
158+
- ec2:AssociateVpcCidrBlock
158159
- ec2:AttachInternetGateway
159160
- ec2:AuthorizeSecurityGroupIngress
160161
- ec2:CreateCarrierGateway
@@ -169,6 +170,7 @@ Resources:
169170
- ec2:CreateTags
170171
- ec2:CreateVpc
171172
- ec2:CreateVpcEndpoint
173+
- ec2:DisassociateVpcCidrBlock
172174
- ec2:ModifyVpcAttribute
173175
- ec2:ModifyVpcEndpoint
174176
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_different_instance_profiles.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_console.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_default_roles.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_disable.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_kms_prefix.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_extra_statements.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ Resources:
155155
- ec2:AssignPrivateIpAddresses
156156
- ec2:UnassignPrivateIpAddresses
157157
- ec2:AssociateRouteTable
158+
- ec2:AssociateVpcCidrBlock
158159
- ec2:AttachInternetGateway
159160
- ec2:AuthorizeSecurityGroupIngress
160161
- ec2:CreateCarrierGateway
@@ -169,6 +170,7 @@ Resources:
169170
- ec2:CreateTags
170171
- ec2:CreateVpc
171172
- ec2:CreateVpcEndpoint
173+
- ec2:DisassociateVpcCidrBlock
172174
- ec2:ModifyVpcAttribute
173175
- ec2:ModifyVpcEndpoint
174176
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_s3_bucket.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_ssm_secret_backend.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Resources:
149149
- ec2:AssignPrivateIpAddresses
150150
- ec2:UnassignPrivateIpAddresses
151151
- ec2:AssociateRouteTable
152+
- ec2:AssociateVpcCidrBlock
152153
- ec2:AttachInternetGateway
153154
- ec2:AuthorizeSecurityGroupIngress
154155
- ec2:CreateCarrierGateway
@@ -163,6 +164,7 @@ Resources:
163164
- ec2:CreateTags
164165
- ec2:CreateVpc
165166
- ec2:CreateVpcEndpoint
167+
- ec2:DisassociateVpcCidrBlock
166168
- ec2:ModifyVpcAttribute
167169
- ec2:ModifyVpcEndpoint
168170
- ec2:DeleteCarrierGateway

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

+38
Original file line numberDiff line numberDiff line change
@@ -722,6 +722,25 @@ spec:
722722
- ip-name
723723
- resource-name
724724
type: string
725+
secondaryCidrBlocks:
726+
description: |-
727+
SecondaryCidrBlocks are additional CIDR blocks to be associated when the provider creates a managed VPC.
728+
Defaults to none. Mutually exclusive with IPAMPool. This makes sense to use if, for example, you want to use
729+
a separate IP range for pods (e.g. Cilium ENI mode).
730+
items:
731+
description: VpcCidrBlock defines the CIDR block and settings
732+
to associate with the managed VPC. Currently, only IPv4
733+
is supported.
734+
properties:
735+
ipv4CidrBlock:
736+
description: IPv4CidrBlock is the IPv4 CIDR block to
737+
associate with the managed VPC.
738+
minLength: 1
739+
type: string
740+
required:
741+
- ipv4CidrBlock
742+
type: object
743+
type: array
725744
tags:
726745
additionalProperties:
727746
type: string
@@ -2672,6 +2691,25 @@ spec:
26722691
- ip-name
26732692
- resource-name
26742693
type: string
2694+
secondaryCidrBlocks:
2695+
description: |-
2696+
SecondaryCidrBlocks are additional CIDR blocks to be associated when the provider creates a managed VPC.
2697+
Defaults to none. Mutually exclusive with IPAMPool. This makes sense to use if, for example, you want to use
2698+
a separate IP range for pods (e.g. Cilium ENI mode).
2699+
items:
2700+
description: VpcCidrBlock defines the CIDR block and settings
2701+
to associate with the managed VPC. Currently, only IPv4
2702+
is supported.
2703+
properties:
2704+
ipv4CidrBlock:
2705+
description: IPv4CidrBlock is the IPv4 CIDR block to
2706+
associate with the managed VPC.
2707+
minLength: 1
2708+
type: string
2709+
required:
2710+
- ipv4CidrBlock
2711+
type: object
2712+
type: array
26752713
tags:
26762714
additionalProperties:
26772715
type: string

0 commit comments

Comments
 (0)