Merge pull request #7829 from zetaab/fixport

fix firewalls for OpenStack
kubernetes · Oct 28, 2019 · cbb14f3 · cbb14f3
2 parents ff29cab + a09a920
commit cbb14f3
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/pkg/model/openstackmodel/firewall.go b/pkg/model/openstackmodel/firewall.go
@@ -151,6 +151,18 @@ func (b *FirewallModelBuilder) addETCDRules(c *fi.ModelBuilderContext, sgMap map
 	addDirectionalGroupRule(c, masterSG, masterSG, etcdRule)
 	addDirectionalGroupRule(c, masterSG, masterSG, etcdPeerRule)
 
+	for _, portRange := range wellknownports.ETCDPortRanges() {
+		etcdMgmrRule := &openstacktasks.SecurityGroupRule{
+			Lifecycle:    b.Lifecycle,
+			Direction:    s(string(rules.DirIngress)),
+			Protocol:     s(string(rules.ProtocolTCP)),
+			EtherType:    s(string(rules.EtherType4)),
+			PortRangeMin: i(portRange.Min),
+			PortRangeMax: i(portRange.Max),
+		}
+		addDirectionalGroupRule(c, masterSG, masterSG, etcdMgmrRule)
+	}
+
 	if b.Cluster.Spec.Networking.Romana != nil ||
 		b.Cluster.Spec.Networking.Calico != nil {
 

diff --git a/pkg/wellknownports/wellknownports.go b/pkg/wellknownports/wellknownports.go
@@ -54,3 +54,9 @@ func DNSGossipPortRanges() []PortRange {
 		{Min: 3998, Max: 4000},
 	}
 }
+
+func ETCDPortRanges() []PortRange {
+	return []PortRange{
+		{Min: 3994, Max: 3997},
+	}
+}