func (b *FirewallModelBuilder) Build(c *fi.ModelBuilderContext) error {

	roles := []kops.InstanceGroupRole{kops.InstanceGroupRoleMaster, kops.InstanceGroupRoleNode}
	if b.UsesSSHBastion() {
		roles = append(roles, kops.InstanceGroupRoleBastion)
	}

	sgMap := make(map[string]*openstacktasks.SecurityGroup)

	if b.UseLoadBalancerForAPI() {
		sg := &openstacktasks.SecurityGroup{
			Name:             s(b.Cluster.Spec.MasterPublicName),
			Lifecycle:        b.Lifecycle,
			RemoveExtraRules: []string{"port=443"},
		}
		c.AddTask(sg)
		sgMap[b.Cluster.Spec.MasterPublicName] = sg
	}
	for _, role := range roles {

		// Create Security Group for Role
		groupName := b.SecurityGroupName(role)
		sg := &openstacktasks.SecurityGroup{
			Name:      s(groupName),
			Lifecycle: b.Lifecycle,
		}
		if role == kops.InstanceGroupRoleBastion {
			sg.RemoveExtraRules = []string{"port=22"}
		} else if role == kops.InstanceGroupRoleNode {
			sg.RemoveExtraRules = []string{"port=22", "port=10250"}
		} else if role == kops.InstanceGroupRoleMaster {
			sg.RemoveExtraRules = []string{"port=22", "port=443", "port=10250"}
		}
		c.AddTask(sg)
		sgMap[groupName] = sg
	}

	//Add API Server Rules
	b.addHTTPSRules(c, sgMap)
	//Add SSH
	b.addSSHRules(c, sgMap)
	//Allow overlay DNS
	b.addDNSRules(c, sgMap)
	//Add Kubelet Rules
	b.addKubeletRules(c, sgMap)
	//Add Node exporter Rules
	b.addNodeExporterRules(c, sgMap)
	// Protokube Rules
	b.addProtokubeRules(c, sgMap)
	//Allow necessary local traffic
	b.addCNIRules(c, sgMap)
	//ETCD Leader Election
	b.addETCDRules(c, sgMap)
	// Add NodePort Rules:
	err := b.addNodePortRules(c, sgMap)
	if err != nil {
		return err
	}

	return nil

}
// Build - schedule security groups and security group rule tasks for Openstack
schedule security groups and security group rule tasks for Openstack
// Build - schedule security groups and security group rule tasks for Openstack
func (b *FirewallModelBuilder) Build(c *fi.ModelBuilderContext) error {
	roles := []kops.InstanceGroupRole{kops.InstanceGroupRoleMaster, kops.InstanceGroupRoleNode}
	if b.UsesSSHBastion() {
		roles = append(roles, kops.InstanceGroupRoleBastion)
	}
	sgMap := make(map[string]*openstacktasks.SecurityGroup)
	if b.UseLoadBalancerForAPI() {
		sg := &openstacktasks.SecurityGroup{
			Name:             s(b.Cluster.Spec.MasterPublicName),
			Lifecycle:        b.Lifecycle,
			RemoveExtraRules: []string{"port=443"},
		}
		c.AddTask(sg)
		sgMap[b.Cluster.Spec.MasterPublicName] = sg
	}
	for _, role := range roles {
		groupName := b.SecurityGroupName(role)
		sg := &openstacktasks.SecurityGroup{
			Name:      s(groupName),
			Lifecycle: b.Lifecycle,
		}
		if role == kops.InstanceGroupRoleBastion {
			sg.RemoveExtraRules = []string{"port=22"}
		} else if role == kops.InstanceGroupRoleNode {
			sg.RemoveExtraRules = []string{"port=22", "port=10250"}
		} else if role == kops.InstanceGroupRoleMaster {
			sg.RemoveExtraRules = []string{"port=22", "port=443", "port=10250"}
		}
		c.AddTask(sg)
		sgMap[groupName] = sg
	}
	b.addHTTPSRules(c, sgMap)
	b.addSSHRules(c, sgMap)
	b.addDNSRules(c, sgMap)
	b.addKubeletRules(c, sgMap)
	b.addNodeExporterRules(c, sgMap)
	b.addProtokubeRules(c, sgMap)
	b.addCNIRules(c, sgMap)
	b.addETCDRules(c, sgMap)
	err := b.addNodePortRules(c, sgMap)
	if err != nil {
		return err
	}
	return nil
}
func ( b * FirewallModelBuilder ) Build ( c * fi . ModelBuilderContext ) error { roles := [ ] kops . InstanceGroupRole { kops . InstanceGroupRoleMaster , kops . InstanceGroupRoleNode } if b . UsesSSHBastion ( ) { roles = append ( roles , kops . InstanceGroupRoleBastion ) } sgMap := make ( map [ string ] * openstacktasks . SecurityGroup ) if b . UseLoadBalancerForAPI ( ) { sg := & openstacktasks . SecurityGroup { Name : s ( b . Cluster . Spec . MasterPublicName ) , Lifecycle : b . Lifecycle , RemoveExtraRules : [ ] string { " " } , } c . AddTask ( sg ) sgMap [ b . Cluster . Spec . MasterPublicName ] = sg } for _ , role := range roles { groupName := b . SecurityGroupName ( role ) sg := & openstacktasks . SecurityGroup { Name : s ( groupName ) , Lifecycle : b . Lifecycle , } if role == kops . InstanceGroupRoleBastion { sg . RemoveExtraRules = [ ] string { " " } } else if role == kops . InstanceGroupRoleNode { sg . RemoveExtraRules = [ ] string { " " , " " } } else if role == kops . InstanceGroupRoleMaster { sg . RemoveExtraRules = [ ] string { " " , " " , " " } } c . AddTask ( sg ) sgMap [ groupName ] = sg } b . addHTTPSRules ( c , sgMap ) b . addSSHRules ( c , sgMap ) b . addDNSRules ( c , sgMap ) b . addKubeletRules ( c , sgMap ) b . addNodeExporterRules ( c , sgMap ) b . addProtokubeRules ( c , sgMap ) b . addCNIRules ( c , sgMap ) b . addETCDRules ( c , sgMap ) err := b . addNodePortRules ( c , sgMap ) if err != nil { return err } return nil }
schedule security groups and security group rule tasks for Openstack
schedule security groups and security group rule tasks for Openstack
// Create Security Group for Role //Add API Server Rules //Add SSH //Allow overlay DNS //Add Kubelet Rules //Add Node exporter Rules // Protokube Rules //Allow necessary local traffic //ETCD Leader Election // Add NodePort Rules: