Skip to content

Conversation

@CodeBleu
Copy link

@CodeBleu CodeBleu commented Jun 9, 2025

* Annotation added to allow setting of Source CIDR for Load Balancer rule

Adding annotation like the following will create the rule with source CIDR set:
    annotations:
        service.beta.kubernetes.io/cloudstack-load-balancer-source-cidrs: "1.2.3.4/32,5.6.7.8/32"

image

    * Annotation added to allow setting of Source CIDR for Load Balancer
      rule
@CodeBleu CodeBleu requested a review from Pearl1594 June 9, 2025 18:23
@CodeBleu CodeBleu added the enhancement New feature or request label Oct 10, 2025
Copy link

@kiranchavala kiranchavala left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Tested by building a docker image based on the pr

Before the fix

After you expose a service, there is no source cidr list populated

k expose deploy/nginx-deployment --port=80 --type=LoadBalancer

Screenshot 2025-10-15 at 1 00 08 PM

After fix, there is source cidr populated on the loadbalancer rule

Screenshot 2025-10-15 at 12 59 42 PM

Tested with normal service.yaml

apiVersion: v1
kind: Service
metadata:
  name: nginx-deployment2
  namespace: default
  annotations:
    service.beta.kubernetes.io/cloudstack-load-balancer-source-cidrs: "1.2.3.4/32,5.6.7.8/32"
spec:
  type: LoadBalancer
  selector:
    app: nginx
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
      nodePort: 30558
  externalTrafficPolicy: Cluster
  allocateLoadBalancerNodePorts: true
  sessionAffinity: None
Screenshot 2025-10-15 at 1 26 53 PM

@CodeBleu
Copy link
Author

@Pearl1594 Do you mind doing a quick review of this? I believe I need 2 approvals and a test output before I can merge.

Copy link

@DaanHoogland DaanHoogland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clgtm

Comment on lines +615 to +632
// Read the source CIDR annotation
sourceCIDRs, ok := service.Annotations[ServiceAnnotationLoadBalancerSourceCidrs]
var cidrList []string
if ok && sourceCIDRs != "" {
cidrList = strings.Split(sourceCIDRs, ",")
for i, cidr := range cidrList {
cidr = strings.TrimSpace(cidr)
if _, _, err := net.ParseCIDR(cidr); err != nil {
return nil, fmt.Errorf("invalid CIDR in annotation %s: %s", ServiceAnnotationLoadBalancerSourceCidrs, cidr)
}
cidrList[i] = cidr
}
} else {
cidrList = []string{defaultAllowedCIDR}
}

// Set the CIDR list in the parameters
p.SetCidrlist(cidrList)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i’d rather see

Suggested change
// Read the source CIDR annotation
sourceCIDRs, ok := service.Annotations[ServiceAnnotationLoadBalancerSourceCidrs]
var cidrList []string
if ok && sourceCIDRs != "" {
cidrList = strings.Split(sourceCIDRs, ",")
for i, cidr := range cidrList {
cidr = strings.TrimSpace(cidr)
if _, _, err := net.ParseCIDR(cidr); err != nil {
return nil, fmt.Errorf("invalid CIDR in annotation %s: %s", ServiceAnnotationLoadBalancerSourceCidrs, cidr)
}
cidrList[i] = cidr
}
} else {
cidrList = []string{defaultAllowedCIDR}
}
// Set the CIDR list in the parameters
p.SetCidrlist(cidrList)
// Set the CIDR list in the parameters
p.SetCidrlist(readTheSourceCidrAnnotation(service))

and

func readTheSourceCidrAnnotation(service *corev1.Service) []string {
	// Read the source CIDR annotation
	sourceCIDRs, ok := service.Annotations[ServiceAnnotationLoadBalancerSourceCidrs]
	var cidrList []string
	if ok && sourceCIDRs != "" {
		cidrList = strings.Split(sourceCIDRs, ",")
		for i, cidr := range cidrList {
			cidr = strings.TrimSpace(cidr)
			if _, _, err := net.ParseCIDR(cidr); err != nil {
				return nil, fmt.Errorf("invalid CIDR in annotation %s: %s", ServiceAnnotationLoadBalancerSourceCidrs, cidr)
			}
			cidrList[i] = cidr
		}
	} else {
		cidrList = []string{defaultAllowedCIDR}
	}
    return cidrList
}

(no waranty on the syntax)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants