Merge pull request #3684 from justinsb/delete_firewall_rules_gce

Automatic merge from submit-queue.

Delete firewall rules on GCE

pkg/resources/BUILD.bazel

@@ -37,7 +37,11 @@ go_library(
 
 go_test(
     name = "go_default_test",
-    srcs = ["aws_test.go"],
+    size = "small",
+    srcs = [
+        "aws_test.go",
+        "gce_test.go",
+    ],
     library = ":go_default_library",
     deps = [
         "//cloudmock/aws/mockec2:go_default_library",

pkg/resources/digitalocean/dns/BUILD.bazel

@@ -15,6 +15,7 @@ go_library(
 
 go_test(
     name = "go_default_test",
+    size = "small",
     srcs = ["dns_test.go"],
     library = ":go_default_library",
     deps = [

pkg/resources/gce.go

@@ -39,11 +39,15 @@ const (
 	typeDisk                 = "Disk"
 	typeInstanceGroupManager = "InstanceGroupManager"
 	typeTargetPool           = "TargetPool"
+	typeFirewallRule         = "FirewallRule"
 	typeForwardingRule       = "ForwardingRule"
 	typeAddress              = "Address"
 	typeRoute                = "Route"
 )
 
+// Maximum number of `-` separated tokens in a name
+const maxPrefixTokens = 4
+
 func (c *ClusterResources) listResourcesGCE() (map[string]*tracker.Resource, error) {
 	gceCloud := c.Cloud.(gce.GCECloud)
 	if c.Region == "" {
@@ -85,6 +89,7 @@ func (c *ClusterResources) listResourcesGCE() (map[string]*tracker.Resource, err
 		d.listInstanceGroupManagersAndInstances,
 		d.listTargetPools,
 		d.listForwardingRules,
+		d.listFirewallRules,
 		d.listGCEDisks,
 		d.listGCEDNSZone,
 		// TODO: Find routes via instances (via instance groups)
@@ -476,6 +481,74 @@ func deleteForwardingRule(cloud fi.Cloud, r *tracker.Resource) error {
 	return c.WaitForOp(op)
 }
 
+// listFirewallRules discovers Firewall objects for the cluster
+func (d *clusterDiscoveryGCE) listFirewallRules() ([]*tracker.Resource, error) {
+	c := d.gceCloud
+
+	var resourceTrackers []*tracker.Resource
+
+	ctx := context.Background()
+
+	err := c.Compute().Firewalls.List(c.Project()).Pages(ctx, func(page *compute.FirewallList) error {
+		for _, fr := range page.Items {
+			if !d.matchesClusterNameMultipart(fr.Name, maxPrefixTokens) {
+				continue
+			}
+
+			foundMatchingTarget := false
+			tagPrefix := gce.SafeClusterName(d.clusterName) + "-"
+			for _, target := range fr.TargetTags {
+				if strings.HasPrefix(target, tagPrefix) {
+					foundMatchingTarget = true
+				}
+			}
+			if !foundMatchingTarget {
+				break
+			}
+
+			resourceTracker := &tracker.Resource{
+				Name:    fr.Name,
+				ID:      fr.Name,
+				Type:    typeFirewallRule,
+				Deleter: deleteFirewallRule,
+				Obj:     fr,
+			}
+
+			glog.V(4).Infof("Found resource: %s", fr.SelfLink)
+			resourceTrackers = append(resourceTrackers, resourceTracker)
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error listing FirewallRules: %v", err)
+	}
+
+	return resourceTrackers, nil
+}
+
+// deleteFirewallRule is the helper function to delete a tracker.Resource for a Firewall object
+func deleteFirewallRule(cloud fi.Cloud, r *tracker.Resource) error {
+	c := cloud.(gce.GCECloud)
+	t := r.Obj.(*compute.Firewall)
+
+	glog.V(2).Infof("Deleting GCE FirewallRule %s", t.SelfLink)
+	u, err := gce.ParseGoogleCloudURL(t.SelfLink)
+	if err != nil {
+		return err
+	}
+
+	op, err := c.Compute().Firewalls.Delete(u.Project, u.Name).Do()
+	if err != nil {
+		if gce.IsNotFound(err) {
+			glog.Infof("FirewallRule not found, assuming deleted: %q", t.SelfLink)
+			return nil
+		}
+		return fmt.Errorf("error deleting FirewallRule %s: %v", t.SelfLink, err)
+	}
+
+	return c.WaitForOp(op)
+}
+
 func (d *clusterDiscoveryGCE) listRoutes(resources map[string]*tracker.Resource) ([]*tracker.Resource, error) {
 	c := d.gceCloud
 
@@ -625,13 +698,28 @@ func deleteAddress(cloud fi.Cloud, r *tracker.Resource) error {
 }
 
 func (d *clusterDiscoveryGCE) matchesClusterName(name string) bool {
-	firstDash := strings.Index(name, "-")
-	if firstDash == -1 {
-		return false
-	}
+	return d.matchesClusterNameMultipart(name, 1)
+}
 
-	id := name[:firstDash]
-	return name == gce.SafeObjectName(id, d.clusterName)
+// matchesClusterNameMultipart checks if the name could have been generated by our cluster
+// considering all the prefixes separated by `-`.  maxParts limits the number of parts we consider.
+func (d *clusterDiscoveryGCE) matchesClusterNameMultipart(name string, maxParts int) bool {
+	tokens := strings.Split(name, "-")
+
+	for i := 1; i <= maxParts; i++ {
+		if i > len(tokens) {
+			break
+		}
+
+		id := strings.Join(tokens[:i], "-")
+		if id == "" {
+			continue
+		}
+		if name == gce.SafeObjectName(id, d.clusterName) {
+			return true
+		}
+	}
+	return false
 }
 
 func (d *clusterDiscoveryGCE) listGCEDNSZone() ([]*tracker.Resource, error) {

pkg/resources/gce_test.go

@@ -0,0 +1,64 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resources
+
+import "testing"
+
+func TestNameMatch(t *testing.T) {
+	grid := []struct {
+		Name  string
+		Match bool
+	}{
+		{
+			Name:  "nodeport-external-to-node-cluster-example-com",
+			Match: true,
+		},
+		{
+			Name:  "simple-cluster-example-com",
+			Match: true,
+		},
+		{
+			Name:  "-cluster-example-com",
+			Match: false,
+		},
+		{
+			Name:  "cluster-example-com",
+			Match: false,
+		},
+		{
+			Name:  "a-example-com",
+			Match: false,
+		},
+		{
+			Name:  "-example-com",
+			Match: false,
+		},
+		{
+			Name:  "",
+			Match: false,
+		},
+	}
+	for _, g := range grid {
+		d := &clusterDiscoveryGCE{
+			clusterName: "cluster.example.com",
+		}
+		match := d.matchesClusterNameMultipart(g.Name, maxPrefixTokens)
+		if match != g.Match {
+			t.Errorf("unexpected match value for %q, got %v, expected %v", g.Name, match, g.Match)
+		}
+	}
+}