Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

De-dupe additional source ranges for firewall #851

Merged
merged 1 commit into from
Sep 14, 2019
Merged

De-dupe additional source ranges for firewall #851

merged 1 commit into from
Sep 14, 2019

Conversation

spencerhance
Copy link
Contributor

@spencerhance spencerhance commented Sep 11, 2019 •
edited
Loading

  • Fixes a bug where ILB subnet range is added multiple times
  • Fixes a bug where empty ilb subnet is added to firewall

/assign @rramkumar1

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 11, 2019
@k8s-ci-robot
Copy link
Contributor

Hi @spencerhance. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Sep 11, 2019
@k8s-ci-robot k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Sep 11, 2019
@MrHohn
Copy link
Member

MrHohn commented Sep 12, 2019

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 12, 2019
bowei
bowei reviewed Sep 13, 2019
View reviewed changes
pkg/firewalls/firewalls.go
@@ -77,13 +77,18 @@ func (fr *FirewallRules) Sync(nodeNames, additionalPorts, additionalRanges []str
}
sort.Strings(targetTags)

// De-dupe ports
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's better to have the permanent ones first and the additional adds after.

ports := sets.NewString(fr.portRanges...)
ports.Insert(additionalPorts...)

ranges := sets.NewString(fr.srcRanges...)
ranges.Insert(additionalRanges)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

bowei
bowei reviewed Sep 13, 2019
View reviewed changes
pkg/firewalls/controller.go Outdated
@@ -172,7 +172,9 @@ func (fwc *FirewallController) sync(key string) error {
if err != nil {
return err
}
additionalRanges = append(additionalRanges, ilbRange)
if ilbRange != "" {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

return a precise err

errNoILBSubnetFound

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Sep 13, 2019
@spencerhance
Fix ILB bugs in syncing firewall
a52a0c6 
Fixes a bug where ilb subnet is added multiple times to firewall and causes syncing failures
Fixes a bug where ilb is enabled + no ilb ingress leads to appending multiple empty strings to firewall and cases syncing failures
De-dupes firewall src ranges
@spencerhance
Copy link
Contributor Author

@bowei Ready for another review

@bowei
Copy link
Member

bowei commented Sep 14, 2019

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 14, 2019
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bowei, spencerhance

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 14, 2019
@k8s-ci-robot k8s-ci-robot merged commit 8e35505 into kubernetes:master Sep 14, 2019
@spencerhance spencerhance deleted the fix-ilb-firewall branch September 14, 2019 01:20
k8s-ci-robot added a commit that referenced this pull request Sep 15, 2019
@k8s-ci-robot
Merge pull request #853 from spencerhance/cherry-pick-firewall-fix
3cb2384 
Cherry pick #851
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bowei bowei bowei left review comments

@rramkumar1 rramkumar1 Awaiting requested review from rramkumar1

Assignees

@bowei bowei

@rramkumar1 rramkumar1

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@spencerhance @k8s-ci-robot @MrHohn @bowei @rramkumar1