✨ Implement allowAllInClusterTraffic flag

[mkjpryor]

What this PR does / why we need it:

This PR implements an additional flag that allows the creation of managed security groups that permit all in-cluster traffic. Note that all traffic from outside the cluster (except API server and NodePort services) is still blocked.

This makes it much easier to deploy a CNI other than Calico while still using managed security groups.

In the future, we could look at maintaining rules for multiple CNIs which can be selected from, or allowing users to specify custom rules for the managed security groups. However I think this represents a good catch-all.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #995

Special notes for your reviewer:

1. Please confirm that if this PR changes any image versions, then that's the sole change this PR makes.

TODOs:

• squashed commits
• if necessary:
  • includes documentation
  • adds unit tests

/hold

[k8s-ci-robot]

Hi @mkjpryor. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[netlify]

✔️ Deploy Preview for kubernetes-sigs-cluster-api-openstack ready!

🔨 Explore the source changes: 614ad18

🔍 Inspect the deploy log: https://app.netlify.com/sites/kubernetes-sigs-cluster-api-openstack/deploys/614a0922e4ebdc0007e9088c

😎 Browse the preview: https://deploy-preview-998--kubernetes-sigs-cluster-api-openstack.netlify.app

[tobiasgiese]

/ok-to-test

[jichenjc]

/lgtm

thanks for the PR ~
I think it's a reasonable change, might need follow up on doc/template etc

[hidekazuna]

/approve

I want to hear other reviewer's opinion so hold for a while.

[tobiasgiese]

I like this feature 👍🏻
And like @jichenjc already mentioned, a brief follow up in the docs would be helpful.

Further, you could maybe implement an e2e test to verify the connectivity.

/lgtm
/approve

[mkjpryor]

@tobiasgiese

Do you want the tests/docs for this PR? The docs should be super-quick. I actually think the current E2E tests would pass if we set this flag to true in the test manifests, because as far as I can see there is no test that checks specifically for Calico connectivity either (other than that the cluster can start). I suppose the test to add would be set the flag and use a different CNI.

[tobiasgiese]

@tobiasgiese

Do you want the tests/docs for this PR? The docs should be super-quick. I actually think the current E2E tests would pass if we set this flag to true in the test manifests, because as far as I can see there is no test that checks specifically for Calico connectivity either (other than that the cluster can start). I suppose the test to add would be set the flag and use a different CNI.

You can add the docs to this PR, sure.
Regarding the e2e tests: I think it's enough to just enable AllowAllInClusterTraffic in one of the e2e templates to verify that the CNI is working. I thought about some connectivity tests, but I think that's not necessary (or a bit overengineered).

[seanschneeweiss]

Great addition to make the use of CAPO and initial setup easier.

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hidekazuna, mkjpryor, seanschneeweiss, tobiasgiese

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [hidekazuna]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mkjpryor]

Added some docs and set the flag in one of the E2E test manifests which still pass.

Let me know ASAP if there is anything else this needs to be merged.

[jichenjc]

/lgtm
/hold cancel