-
Notifications
You must be signed in to change notification settings - Fork 31
Allow setting of source CIDR for LB rule #78
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
CodeBleu
commented
Jun 9, 2025

* Annotation added to allow setting of Source CIDR for Load Balancer
rule
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Tested by building a docker image based on the pr
Before the fix
After you expose a service, there is no source cidr list populated
k expose deploy/nginx-deployment --port=80 --type=LoadBalancer
After fix, there is source cidr populated on the loadbalancer rule
Tested with normal service.yaml
apiVersion: v1
kind: Service
metadata:
name: nginx-deployment2
namespace: default
annotations:
service.beta.kubernetes.io/cloudstack-load-balancer-source-cidrs: "1.2.3.4/32,5.6.7.8/32"
spec:
type: LoadBalancer
selector:
app: nginx
ports:
- port: 80
targetPort: 80
protocol: TCP
nodePort: 30558
externalTrafficPolicy: Cluster
allocateLoadBalancerNodePorts: true
sessionAffinity: None
|
@Pearl1594 Do you mind doing a quick review of this? I believe I need 2 approvals and a test output before I can merge. |
DaanHoogland
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
clgtm
| // Read the source CIDR annotation | ||
| sourceCIDRs, ok := service.Annotations[ServiceAnnotationLoadBalancerSourceCidrs] | ||
| var cidrList []string | ||
| if ok && sourceCIDRs != "" { | ||
| cidrList = strings.Split(sourceCIDRs, ",") | ||
| for i, cidr := range cidrList { | ||
| cidr = strings.TrimSpace(cidr) | ||
| if _, _, err := net.ParseCIDR(cidr); err != nil { | ||
| return nil, fmt.Errorf("invalid CIDR in annotation %s: %s", ServiceAnnotationLoadBalancerSourceCidrs, cidr) | ||
| } | ||
| cidrList[i] = cidr | ||
| } | ||
| } else { | ||
| cidrList = []string{defaultAllowedCIDR} | ||
| } | ||
|
|
||
| // Set the CIDR list in the parameters | ||
| p.SetCidrlist(cidrList) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i’d rather see
| // Read the source CIDR annotation | |
| sourceCIDRs, ok := service.Annotations[ServiceAnnotationLoadBalancerSourceCidrs] | |
| var cidrList []string | |
| if ok && sourceCIDRs != "" { | |
| cidrList = strings.Split(sourceCIDRs, ",") | |
| for i, cidr := range cidrList { | |
| cidr = strings.TrimSpace(cidr) | |
| if _, _, err := net.ParseCIDR(cidr); err != nil { | |
| return nil, fmt.Errorf("invalid CIDR in annotation %s: %s", ServiceAnnotationLoadBalancerSourceCidrs, cidr) | |
| } | |
| cidrList[i] = cidr | |
| } | |
| } else { | |
| cidrList = []string{defaultAllowedCIDR} | |
| } | |
| // Set the CIDR list in the parameters | |
| p.SetCidrlist(cidrList) | |
| // Set the CIDR list in the parameters | |
| p.SetCidrlist(readTheSourceCidrAnnotation(service)) |
and
func readTheSourceCidrAnnotation(service *corev1.Service) []string {
// Read the source CIDR annotation
sourceCIDRs, ok := service.Annotations[ServiceAnnotationLoadBalancerSourceCidrs]
var cidrList []string
if ok && sourceCIDRs != "" {
cidrList = strings.Split(sourceCIDRs, ",")
for i, cidr := range cidrList {
cidr = strings.TrimSpace(cidr)
if _, _, err := net.ParseCIDR(cidr); err != nil {
return nil, fmt.Errorf("invalid CIDR in annotation %s: %s", ServiceAnnotationLoadBalancerSourceCidrs, cidr)
}
cidrList[i] = cidr
}
} else {
cidrList = []string{defaultAllowedCIDR}
}
return cidrList
}
(no waranty on the syntax)