fix firewalls for openstack

kubernetes · Oct 27, 2019 · a09a920 · a09a920
1 parent 1c37a32
commit a09a920
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/pkg/model/openstackmodel/firewall.go b/pkg/model/openstackmodel/firewall.go
@@ -151,6 +151,18 @@ func (b *FirewallModelBuilder) addETCDRules(c *fi.ModelBuilderContext, sgMap map
 	addDirectionalGroupRule(c, masterSG, masterSG, etcdRule)
 	addDirectionalGroupRule(c, masterSG, masterSG, etcdPeerRule)
 
+	for _, portRange := range wellknownports.ETCDPortRanges() {
+		etcdMgmrRule := &openstacktasks.SecurityGroupRule{
+			Lifecycle:    b.Lifecycle,
+			Direction:    s(string(rules.DirIngress)),
+			Protocol:     s(string(rules.ProtocolTCP)),
+			EtherType:    s(string(rules.EtherType4)),
+			PortRangeMin: i(portRange.Min),
+			PortRangeMax: i(portRange.Max),
+		}
+		addDirectionalGroupRule(c, masterSG, masterSG, etcdMgmrRule)
+	}
+
 	if b.Cluster.Spec.Networking.Romana != nil ||
 		b.Cluster.Spec.Networking.Calico != nil {
 

diff --git a/pkg/wellknownports/wellknownports.go b/pkg/wellknownports/wellknownports.go
@@ -54,3 +54,9 @@ func DNSGossipPortRanges() []PortRange {
 		{Min: 3998, Max: 4000},
 	}
 }
+
+func ETCDPortRanges() []PortRange {
+	return []PortRange{
+		{Min: 3994, Max: 3997},
+	}
+}