func (b *FirewallModelBuilder) addSSHRules(c *fi.ModelBuilderContext, sgMap map[string]*openstacktasks.SecurityGroup) error {

	masterName := b.SecurityGroupName(kops.InstanceGroupRoleMaster)
	nodeName := b.SecurityGroupName(kops.InstanceGroupRoleNode)
	bastionName := b.SecurityGroupName(kops.InstanceGroupRoleBastion)
	masterSG := sgMap[masterName]
	nodeSG := sgMap[nodeName]
	bastionSG := sgMap[bastionName]

	sshIngress := &openstacktasks.SecurityGroupRule{
		Lifecycle:    b.Lifecycle,
		Direction:    s(string(rules.DirIngress)),
		Protocol:     s(string(rules.ProtocolTCP)),
		EtherType:    s(string(rules.EtherType4)),
		PortRangeMin: i(22),
		PortRangeMax: i(22),
	}

	if b.UsesSSHBastion() {
		for _, sshAccess := range b.Cluster.Spec.SSHAccess {
			sshRule := &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(string(rules.ProtocolTCP)),
				EtherType:      s(string(rules.EtherType4)),
				PortRangeMin:   i(22),
				PortRangeMax:   i(22),
				RemoteIPPrefix: s(sshAccess),
			}
			addDirectionalGroupRule(c, bastionSG, nil, sshRule)
		}
		//Allow ingress ssh from the bastion on the masters and nodes
		addDirectionalGroupRule(c, masterSG, bastionSG, sshIngress)
		addDirectionalGroupRule(c, nodeSG, bastionSG, sshIngress)
	} else {
		for _, sshAccess := range b.Cluster.Spec.SSHAccess {
			sshRule := &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(string(rules.ProtocolTCP)),
				EtherType:      s(string(rules.EtherType4)),
				PortRangeMin:   i(22),
				PortRangeMax:   i(22),
				RemoteIPPrefix: s(sshAccess),
			}
			addDirectionalGroupRule(c, masterSG, nil, sshRule)
			addDirectionalGroupRule(c, nodeSG, nil, sshRule)
		}
	}
	return nil
}
// addSSHRules - sets the ssh rules based on the presence of a bastion
sets the ssh rules based on the presence of a bastion
// addSSHRules - sets the ssh rules based on the presence of a bastion
func (b *FirewallModelBuilder) addSSHRules(c *fi.ModelBuilderContext, sgMap map[string]*openstacktasks.SecurityGroup) error {
	masterName := b.SecurityGroupName(kops.InstanceGroupRoleMaster)
	nodeName := b.SecurityGroupName(kops.InstanceGroupRoleNode)
	bastionName := b.SecurityGroupName(kops.InstanceGroupRoleBastion)
	masterSG := sgMap[masterName]
	nodeSG := sgMap[nodeName]
	bastionSG := sgMap[bastionName]
	sshIngress := &openstacktasks.SecurityGroupRule{
		Lifecycle:    b.Lifecycle,
		Direction:    s(string(rules.DirIngress)),
		Protocol:     s(string(rules.ProtocolTCP)),
		EtherType:    s(string(rules.EtherType4)),
		PortRangeMin: i(22),
		PortRangeMax: i(22),
	}
	if b.UsesSSHBastion() {
		for _, sshAccess := range b.Cluster.Spec.SSHAccess {
			sshRule := &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(string(rules.ProtocolTCP)),
				EtherType:      s(string(rules.EtherType4)),
				PortRangeMin:   i(22),
				PortRangeMax:   i(22),
				RemoteIPPrefix: s(sshAccess),
			}
			addDirectionalGroupRule(c, bastionSG, nil, sshRule)
		}
		addDirectionalGroupRule(c, masterSG, bastionSG, sshIngress)
		addDirectionalGroupRule(c, nodeSG, bastionSG, sshIngress)
	} else {
		for _, sshAccess := range b.Cluster.Spec.SSHAccess {
			sshRule := &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(string(rules.ProtocolTCP)),
				EtherType:      s(string(rules.EtherType4)),
				PortRangeMin:   i(22),
				PortRangeMax:   i(22),
				RemoteIPPrefix: s(sshAccess),
			}
			addDirectionalGroupRule(c, masterSG, nil, sshRule)
			addDirectionalGroupRule(c, nodeSG, nil, sshRule)
		}
	}
	return nil
}
func ( b * FirewallModelBuilder ) addSSHRules ( c * fi . ModelBuilderContext , sgMap map [ string ] * openstacktasks . SecurityGroup ) error { masterName := b . SecurityGroupName ( kops . InstanceGroupRoleMaster ) nodeName := b . SecurityGroupName ( kops . InstanceGroupRoleNode ) bastionName := b . SecurityGroupName ( kops . InstanceGroupRoleBastion ) masterSG := sgMap [ masterName ] nodeSG := sgMap [ nodeName ] bastionSG := sgMap [ bastionName ] sshIngress := & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( string ( rules . ProtocolTCP ) ) , EtherType : s ( string ( rules . EtherType4 ) ) , PortRangeMin : i ( 22 ) , PortRangeMax : i ( 22 ) , } if b . UsesSSHBastion ( ) { for _ , sshAccess := range b . Cluster . Spec . SSHAccess { sshRule := & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( string ( rules . ProtocolTCP ) ) , EtherType : s ( string ( rules . EtherType4 ) ) , PortRangeMin : i ( 22 ) , PortRangeMax : i ( 22 ) , RemoteIPPrefix : s ( sshAccess ) , } addDirectionalGroupRule ( c , bastionSG , nil , sshRule ) } addDirectionalGroupRule ( c , masterSG , bastionSG , sshIngress ) addDirectionalGroupRule ( c , nodeSG , bastionSG , sshIngress ) } else { for _ , sshAccess := range b . Cluster . Spec . SSHAccess { sshRule := & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( string ( rules . ProtocolTCP ) ) , EtherType : s ( string ( rules . EtherType4 ) ) , PortRangeMin : i ( 22 ) , PortRangeMax : i ( 22 ) , RemoteIPPrefix : s ( sshAccess ) , } addDirectionalGroupRule ( c , masterSG , nil , sshRule ) addDirectionalGroupRule ( c , nodeSG , nil , sshRule ) } } return nil }
sets the ssh rules based on the presence of a bastion
sets the ssh rules based on the presence of a bastion
//Allow ingress ssh from the bastion on the masters and nodes