diff --git a/features.md b/features.md index 69850063561..42759a89748 100644 --- a/features.md +++ b/features.md @@ -67,7 +67,6 @@ | HyperShiftOnlyDynamicResourceAllocation| Enabled | | Enabled | | Enabled | | Enabled | | | ImageModeStatusReporting| | | Enabled | Enabled | | | Enabled | Enabled | | IngressComponentRouteLabels| | | Enabled | Enabled | | | Enabled | Enabled | -| IngressControllerLBSecurityGroupsAWS| | | Enabled | Enabled | | | Enabled | Enabled | | KMSEncryption| | | Enabled | Enabled | | | Enabled | Enabled | | MachineAPIMigration| | | Enabled | Enabled | | | Enabled | Enabled | | MachineAPIMigrationAWS| | | Enabled | Enabled | | | Enabled | Enabled | @@ -107,6 +106,7 @@ | GatewayAPIWithoutOLM| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ImageStreamImportMode| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | IngressControllerDynamicConfigurationManager| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| IngressControllerLBSecurityGroupsAWS| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | IngressControllerMultipleHAProxyVersions| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | InsightsConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | InsightsOnDemandDataGather| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | diff --git a/features/features.go b/features/features.go index 48d883fcb86..1bd4dcbd21e 100644 --- a/features/features.go +++ b/features/features.go @@ -986,7 +986,7 @@ var ( contactPerson("miciah"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/2037"). - enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() FeatureGateTLSAdherence = newFeatureGate("TLSAdherence"). diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml index 85ff60dbf83..acfaf69cb5d 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml @@ -544,6 +544,46 @@ spec: - TCP - PROXY type: string + securityGroups: + description: |- + securityGroups is a list of security group IDs to attach to the + Network Load Balancer. When specified, these security groups replace + the managed security group that the Cloud Controller Manager would + otherwise create automatically. The user is responsible for + configuring the ingress and egress rules on the specified security + groups. + + The specified security groups must exist in the same VPC as the + cluster and must allow the necessary traffic for the + IngressController to function. + + When this field is omitted, the Cloud Controller Manager + automatically creates and manages a security group for the NLB. + + Each security group ID must be unique and must begin with "sg-" + followed by 8 or 17 lowercase hexadecimal characters + (e.g. "sg-abcd1234" or "sg-abcd1234abcd12345"). At least 1 and + at most 5 security groups can be specified. + items: + description: |- + SecurityGroupID is an AWS EC2 security group ID. + Values must begin with "sg-" followed by 8 or 17 lowercase + hexadecimal characters (e.g. "sg-abcd1234" or + "sg-abcd1234abcd12345"). + maxLength: 20 + minLength: 11 + type: string + x-kubernetes-validations: + - message: securityGroups must be 'sg-' followed + by 8 or 17 lowercase hexadecimal characters + rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-f]{8}$|^[0-9a-f]{17}$') + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: securityGroups cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) subnets: description: |- subnets specifies the subnets to which the load balancer will @@ -2902,6 +2942,46 @@ spec: - TCP - PROXY type: string + securityGroups: + description: |- + securityGroups is a list of security group IDs to attach to the + Network Load Balancer. When specified, these security groups replace + the managed security group that the Cloud Controller Manager would + otherwise create automatically. The user is responsible for + configuring the ingress and egress rules on the specified security + groups. + + The specified security groups must exist in the same VPC as the + cluster and must allow the necessary traffic for the + IngressController to function. + + When this field is omitted, the Cloud Controller Manager + automatically creates and manages a security group for the NLB. + + Each security group ID must be unique and must begin with "sg-" + followed by 8 or 17 lowercase hexadecimal characters + (e.g. "sg-abcd1234" or "sg-abcd1234abcd12345"). At least 1 and + at most 5 security groups can be specified. + items: + description: |- + SecurityGroupID is an AWS EC2 security group ID. + Values must begin with "sg-" followed by 8 or 17 lowercase + hexadecimal characters (e.g. "sg-abcd1234" or + "sg-abcd1234abcd12345"). + maxLength: 20 + minLength: 11 + type: string + x-kubernetes-validations: + - message: securityGroups must be 'sg-' followed + by 8 or 17 lowercase hexadecimal characters + rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-f]{8}$|^[0-9a-f]{17}$') + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: securityGroups cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml index 8220b5b91e4..3697a7cd6cd 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml @@ -544,6 +544,46 @@ spec: - TCP - PROXY type: string + securityGroups: + description: |- + securityGroups is a list of security group IDs to attach to the + Network Load Balancer. When specified, these security groups replace + the managed security group that the Cloud Controller Manager would + otherwise create automatically. The user is responsible for + configuring the ingress and egress rules on the specified security + groups. + + The specified security groups must exist in the same VPC as the + cluster and must allow the necessary traffic for the + IngressController to function. + + When this field is omitted, the Cloud Controller Manager + automatically creates and manages a security group for the NLB. + + Each security group ID must be unique and must begin with "sg-" + followed by 8 or 17 lowercase hexadecimal characters + (e.g. "sg-abcd1234" or "sg-abcd1234abcd12345"). At least 1 and + at most 5 security groups can be specified. + items: + description: |- + SecurityGroupID is an AWS EC2 security group ID. + Values must begin with "sg-" followed by 8 or 17 lowercase + hexadecimal characters (e.g. "sg-abcd1234" or + "sg-abcd1234abcd12345"). + maxLength: 20 + minLength: 11 + type: string + x-kubernetes-validations: + - message: securityGroups must be 'sg-' followed + by 8 or 17 lowercase hexadecimal characters + rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-f]{8}$|^[0-9a-f]{17}$') + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: securityGroups cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) subnets: description: |- subnets specifies the subnets to which the load balancer will @@ -2902,6 +2942,46 @@ spec: - TCP - PROXY type: string + securityGroups: + description: |- + securityGroups is a list of security group IDs to attach to the + Network Load Balancer. When specified, these security groups replace + the managed security group that the Cloud Controller Manager would + otherwise create automatically. The user is responsible for + configuring the ingress and egress rules on the specified security + groups. + + The specified security groups must exist in the same VPC as the + cluster and must allow the necessary traffic for the + IngressController to function. + + When this field is omitted, the Cloud Controller Manager + automatically creates and manages a security group for the NLB. + + Each security group ID must be unique and must begin with "sg-" + followed by 8 or 17 lowercase hexadecimal characters + (e.g. "sg-abcd1234" or "sg-abcd1234abcd12345"). At least 1 and + at most 5 security groups can be specified. + items: + description: |- + SecurityGroupID is an AWS EC2 security group ID. + Values must begin with "sg-" followed by 8 or 17 lowercase + hexadecimal characters (e.g. "sg-abcd1234" or + "sg-abcd1234abcd12345"). + maxLength: 20 + minLength: 11 + type: string + x-kubernetes-validations: + - message: securityGroups must be 'sg-' followed + by 8 or 17 lowercase hexadecimal characters + rule: self.startsWith('sg-') && self.substring(3).matches('^[0-9a-f]{8}$|^[0-9a-f]{17}$') + maxItems: 5 + minItems: 1 + type: array + x-kubernetes-list-type: atomic + x-kubernetes-validations: + - message: securityGroups cannot contain duplicates + rule: self.all(x, self.exists_one(y, x == y)) subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml index e7b69279928..ba69e45b5bc 100644 --- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml @@ -161,9 +161,6 @@ { "name": "IngressComponentRouteLabels" }, - { - "name": "IngressControllerLBSecurityGroupsAWS" - }, { "name": "KMSEncryption" }, @@ -337,6 +334,9 @@ { "name": "IngressControllerDynamicConfigurationManager" }, + { + "name": "IngressControllerLBSecurityGroupsAWS" + }, { "name": "IngressControllerMultipleHAProxyVersions" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml index 3f76c126dbb..d7ebf7a5bda 100644 --- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml @@ -163,9 +163,6 @@ { "name": "IngressComponentRouteLabels" }, - { - "name": "IngressControllerLBSecurityGroupsAWS" - }, { "name": "KMSEncryption" }, @@ -336,6 +333,9 @@ { "name": "IngressControllerDynamicConfigurationManager" }, + { + "name": "IngressControllerLBSecurityGroupsAWS" + }, { "name": "IngressControllerMultipleHAProxyVersions" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml index d002b39eb0d..3f70151b383 100644 --- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml @@ -161,9 +161,6 @@ { "name": "IngressComponentRouteLabels" }, - { - "name": "IngressControllerLBSecurityGroupsAWS" - }, { "name": "KMSEncryption" }, @@ -325,6 +322,9 @@ { "name": "IngressControllerDynamicConfigurationManager" }, + { + "name": "IngressControllerLBSecurityGroupsAWS" + }, { "name": "IngressControllerMultipleHAProxyVersions" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml index fa81ea89124..5a2958852e0 100644 --- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml @@ -163,9 +163,6 @@ { "name": "IngressComponentRouteLabels" }, - { - "name": "IngressControllerLBSecurityGroupsAWS" - }, { "name": "KMSEncryption" }, @@ -324,6 +321,9 @@ { "name": "IngressControllerDynamicConfigurationManager" }, + { + "name": "IngressControllerLBSecurityGroupsAWS" + }, { "name": "IngressControllerMultipleHAProxyVersions" },