Merge pull request #15189 from hakman/automated-cherry-pick-of-#15040…

…-upstream-release-1.25 Automated cherry pick of #15040: gce: When using network native pod IPs, open firewall to
kubernetes · Mar 3, 2023 · 55c2d03 · 55c2d03
2 parents cfd98bb + 776802a
commit 55c2d03
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 0 deletions.
diff --git a/pkg/model/gcemodel/api_loadbalancer.go b/pkg/model/gcemodel/api_loadbalancer.go
@@ -18,6 +18,7 @@ package gcemodel
 
 import (
 	"fmt"
+	"strconv"
 
 	"k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/pkg/wellknownports"
@@ -95,6 +96,18 @@ func createPublicLB(b *APILoadBalancerBuilder, c *fi.ModelBuilderContext) error
 			TargetTags:   []string{b.GCETagForRole(kops.InstanceGroupRoleMaster)},
 			Allowed:      []string{"tcp:443"},
 		})
+
+		if b.NetworkingIsIPAlias() {
+			c.AddTask(&gcetasks.FirewallRule{
+				Name:         s(b.NameForFirewallRule("pod-cidrs-to-https-api")),
+				Lifecycle:    b.Lifecycle,
+				Network:      network,
+				SourceRanges: []string{b.Cluster.Spec.PodCIDR},
+				TargetTags:   []string{b.GCETagForRole(kops.InstanceGroupRoleMaster)},
+				Allowed:      []string{"tcp:" + strconv.Itoa(wellknownports.KubeAPIServer)},
+			})
+		}
+
 	}
 	return nil
 

diff --git a/pkg/model/gcemodel/external_access.go b/pkg/model/gcemodel/external_access.go
@@ -17,8 +17,11 @@ limitations under the License.
 package gcemodel
 
 import (
+	"strconv"
+
 	"k8s.io/klog/v2"
 	"k8s.io/kops/pkg/apis/kops"
+	"k8s.io/kops/pkg/wellknownports"
 	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kops/upup/pkg/fi/cloudup/gcetasks"
 )
@@ -112,6 +115,17 @@ func (b *ExternalAccessModelBuilder) Build(c *fi.ModelBuilderContext) error {
 			SourceRanges: b.Cluster.Spec.KubernetesAPIAccess,
 			Network:      network,
 		})
+
+		if b.NetworkingIsIPAlias() {
+			c.AddTask(&gcetasks.FirewallRule{
+				Name:         s(b.NameForFirewallRule("pod-cidrs-to-https-api")),
+				Lifecycle:    b.Lifecycle,
+				Network:      network,
+				SourceRanges: []string{b.Cluster.Spec.PodCIDR},
+				TargetTags:   []string{b.GCETagForRole(kops.InstanceGroupRoleMaster)},
+				Allowed:      []string{"tcp:" + strconv.Itoa(wellknownports.KubeAPIServer)},
+			})
+		}
 	}
 
 	return nil