func (b *FirewallModelBuilder) addHTTPSRules(c *fi.ModelBuilderContext, sgMap map[string]*openstacktasks.SecurityGroup) error {

	masterName := b.SecurityGroupName(kops.InstanceGroupRoleMaster)
	nodeName := b.SecurityGroupName(kops.InstanceGroupRoleNode)
	lbSGName := b.Cluster.Spec.MasterPublicName
	lbSG := sgMap[lbSGName]
	masterSG := sgMap[masterName]
	nodeSG := sgMap[nodeName]

	httpsIngress := &openstacktasks.SecurityGroupRule{
		Lifecycle:    b.Lifecycle,
		Direction:    s(string(rules.DirIngress)),
		Protocol:     s(IPProtocolTCP),
		EtherType:    s(IPV4),
		PortRangeMin: i(443),
		PortRangeMax: i(443),
	}

	//Allow all local communication for kubernetes.svc and to the api.internal lb/gossip for kubelet's
	addDirectionalGroupRule(c, masterSG, nodeSG, httpsIngress)
	addDirectionalGroupRule(c, masterSG, masterSG, httpsIngress)

	if b.UseLoadBalancerForAPI() {
		//Allow API Access to the lb sg
		for _, apiAccess := range b.Cluster.Spec.KubernetesAPIAccess {
			addDirectionalGroupRule(c, lbSG, nil, &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(IPProtocolTCP),
				EtherType:      s(IPV4),
				PortRangeMin:   i(443),
				PortRangeMax:   i(443),
				RemoteIPPrefix: s(apiAccess),
			})
		}
		//Allow masters ingress from the sg
		addDirectionalGroupRule(c, masterSG, lbSG, httpsIngress)

		//FIXME: Octavia port traffic appears to be denied though its port is in lbSG
		if b.usesOctavia() {
			addDirectionalGroupRule(c, masterSG, nil, &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(IPProtocolTCP),
				EtherType:      s(IPV4),
				PortRangeMin:   i(443),
				PortRangeMax:   i(443),
				RemoteIPPrefix: s(b.Cluster.Spec.NetworkCIDR),
			})
		}

	} else {
		// Allow the masters to receive connections from KubernetesAPIAccess
		for _, apiAccess := range b.Cluster.Spec.KubernetesAPIAccess {

			addDirectionalGroupRule(c, masterSG, nil, &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(IPProtocolTCP),
				EtherType:      s(IPV4),
				PortRangeMin:   i(443),
				PortRangeMax:   i(443),
				RemoteIPPrefix: s(apiAccess),
			})
		}
	}

	return nil
}
// addHTTPSRules - Add rules to 443 access given the presence of a loadbalancer or not
Add rules to 443 access given the presence of a loadbalancer or not
// addHTTPSRules - Add rules to 443 access given the presence of a loadbalancer or not
func (b *FirewallModelBuilder) addHTTPSRules(c *fi.ModelBuilderContext, sgMap map[string]*openstacktasks.SecurityGroup) error {
	masterName := b.SecurityGroupName(kops.InstanceGroupRoleMaster)
	nodeName := b.SecurityGroupName(kops.InstanceGroupRoleNode)
	lbSGName := b.Cluster.Spec.MasterPublicName
	lbSG := sgMap[lbSGName]
	masterSG := sgMap[masterName]
	nodeSG := sgMap[nodeName]
	httpsIngress := &openstacktasks.SecurityGroupRule{
		Lifecycle:    b.Lifecycle,
		Direction:    s(string(rules.DirIngress)),
		Protocol:     s(IPProtocolTCP),
		EtherType:    s(IPV4),
		PortRangeMin: i(443),
		PortRangeMax: i(443),
	}
	addDirectionalGroupRule(c, masterSG, nodeSG, httpsIngress)
	addDirectionalGroupRule(c, masterSG, masterSG, httpsIngress)
	if b.UseLoadBalancerForAPI() {
		for _, apiAccess := range b.Cluster.Spec.KubernetesAPIAccess {
			addDirectionalGroupRule(c, lbSG, nil, &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(IPProtocolTCP),
				EtherType:      s(IPV4),
				PortRangeMin:   i(443),
				PortRangeMax:   i(443),
				RemoteIPPrefix: s(apiAccess),
			})
		}
		addDirectionalGroupRule(c, masterSG, lbSG, httpsIngress)
		if b.usesOctavia() {
			addDirectionalGroupRule(c, masterSG, nil, &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(IPProtocolTCP),
				EtherType:      s(IPV4),
				PortRangeMin:   i(443),
				PortRangeMax:   i(443),
				RemoteIPPrefix: s(b.Cluster.Spec.NetworkCIDR),
			})
		}
	} else {
		for _, apiAccess := range b.Cluster.Spec.KubernetesAPIAccess {
			addDirectionalGroupRule(c, masterSG, nil, &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(IPProtocolTCP),
				EtherType:      s(IPV4),
				PortRangeMin:   i(443),
				PortRangeMax:   i(443),
				RemoteIPPrefix: s(apiAccess),
			})
		}
	}
	return nil
}
func ( b * FirewallModelBuilder ) addHTTPSRules ( c * fi . ModelBuilderContext , sgMap map [ string ] * openstacktasks . SecurityGroup ) error { masterName := b . SecurityGroupName ( kops . InstanceGroupRoleMaster ) nodeName := b . SecurityGroupName ( kops . InstanceGroupRoleNode ) lbSGName := b . Cluster . Spec . MasterPublicName lbSG := sgMap [ lbSGName ] masterSG := sgMap [ masterName ] nodeSG := sgMap [ nodeName ] httpsIngress := & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( IPProtocolTCP ) , EtherType : s ( IPV4 ) , PortRangeMin : i ( 443 ) , PortRangeMax : i ( 443 ) , } addDirectionalGroupRule ( c , masterSG , nodeSG , httpsIngress ) addDirectionalGroupRule ( c , masterSG , masterSG , httpsIngress ) if b . UseLoadBalancerForAPI ( ) { for _ , apiAccess := range b . Cluster . Spec . KubernetesAPIAccess { addDirectionalGroupRule ( c , lbSG , nil , & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( IPProtocolTCP ) , EtherType : s ( IPV4 ) , PortRangeMin : i ( 443 ) , PortRangeMax : i ( 443 ) , RemoteIPPrefix : s ( apiAccess ) , } ) } addDirectionalGroupRule ( c , masterSG , lbSG , httpsIngress ) if b . usesOctavia ( ) { addDirectionalGroupRule ( c , masterSG , nil , & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( IPProtocolTCP ) , EtherType : s ( IPV4 ) , PortRangeMin : i ( 443 ) , PortRangeMax : i ( 443 ) , RemoteIPPrefix : s ( b . Cluster . Spec . NetworkCIDR ) , } ) } } else { for _ , apiAccess := range b . Cluster . Spec . KubernetesAPIAccess { addDirectionalGroupRule ( c , masterSG , nil , & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( IPProtocolTCP ) , EtherType : s ( IPV4 ) , PortRangeMin : i ( 443 ) , PortRangeMax : i ( 443 ) , RemoteIPPrefix : s ( apiAccess ) , } ) } } return nil }
Add rules to 443 access given the presence of a loadbalancer or not
Add rules to 443 access given the presence of a loadbalancer or not
//Allow all local communication for kubernetes.svc and to the api.internal lb/gossip for kubelet's //Allow API Access to the lb sg //Allow masters ingress from the sg //FIXME: Octavia port traffic appears to be denied though its port is in lbSG // Allow the masters to receive connections from KubernetesAPIAccess