func (b *FirewallModelBuilder) addETCDRules(c *fi.ModelBuilderContext, sgMap map[string]*openstacktasks.SecurityGroup) error {

	masterName := b.SecurityGroupName(kops.InstanceGroupRoleMaster)
	nodeName := b.SecurityGroupName(kops.InstanceGroupRoleNode)
	masterSG := sgMap[masterName]
	nodeSG := sgMap[nodeName]

	// ETCD Peer Discovery
	etcdRule := &openstacktasks.SecurityGroupRule{
		Lifecycle:    b.Lifecycle,
		Direction:    s(string(rules.DirIngress)),
		Protocol:     s(string(rules.ProtocolTCP)),
		EtherType:    s(IPV4),
		PortRangeMin: i(4001),
		PortRangeMax: i(4002),
	}
	etcdPeerRule := &openstacktasks.SecurityGroupRule{
		Lifecycle:    b.Lifecycle,
		Direction:    s(string(rules.DirIngress)),
		Protocol:     s(string(rules.ProtocolTCP)),
		EtherType:    s(IPV4),
		PortRangeMin: i(2380),
		PortRangeMax: i(2381),
	}
	addDirectionalGroupRule(c, masterSG, masterSG, etcdRule)
	addDirectionalGroupRule(c, masterSG, masterSG, etcdPeerRule)

	if b.Cluster.Spec.Networking.Romana != nil ||
		b.Cluster.Spec.Networking.Calico != nil {

		etcdCNIRule := &openstacktasks.SecurityGroupRule{
			Lifecycle:    b.Lifecycle,
			Direction:    s(string(rules.DirIngress)),
			Protocol:     s(string(rules.ProtocolTCP)),
			EtherType:    s(IPV4),
			PortRangeMin: i(4001),
			PortRangeMax: i(4001),
		}
		// Master access from other masters covered above
		// Allow nodes to reach ETCD endpoints
		addDirectionalGroupRule(c, masterSG, nodeSG, etcdCNIRule)
	}
	return nil
}
// addETCDRules - Add ETCD access rules based on which CNI might need to access __ETCD_ENDPOINTS__
Add ETCD access rules based on which CNI might need to access __ETCD_ENDPOINTS
// addETCDRules - Add ETCD access rules based on which CNI might need to access __ETCD_ENDPOINTS__
func (b *FirewallModelBuilder) addETCDRules(c *fi.ModelBuilderContext, sgMap map[string]*openstacktasks.SecurityGroup) error {
	masterName := b.SecurityGroupName(kops.InstanceGroupRoleMaster)
	nodeName := b.SecurityGroupName(kops.InstanceGroupRoleNode)
	masterSG := sgMap[masterName]
	nodeSG := sgMap[nodeName]
	etcdRule := &openstacktasks.SecurityGroupRule{
		Lifecycle:    b.Lifecycle,
		Direction:    s(string(rules.DirIngress)),
		Protocol:     s(string(rules.ProtocolTCP)),
		EtherType:    s(IPV4),
		PortRangeMin: i(4001),
		PortRangeMax: i(4002),
	}
	etcdPeerRule := &openstacktasks.SecurityGroupRule{
		Lifecycle:    b.Lifecycle,
		Direction:    s(string(rules.DirIngress)),
		Protocol:     s(string(rules.ProtocolTCP)),
		EtherType:    s(IPV4),
		PortRangeMin: i(2380),
		PortRangeMax: i(2381),
	}
	addDirectionalGroupRule(c, masterSG, masterSG, etcdRule)
	addDirectionalGroupRule(c, masterSG, masterSG, etcdPeerRule)
	if b.Cluster.Spec.Networking.Romana != nil ||
		b.Cluster.Spec.Networking.Calico != nil {
		etcdCNIRule := &openstacktasks.SecurityGroupRule{
			Lifecycle:    b.Lifecycle,
			Direction:    s(string(rules.DirIngress)),
			Protocol:     s(string(rules.ProtocolTCP)),
			EtherType:    s(IPV4),
			PortRangeMin: i(4001),
			PortRangeMax: i(4001),
		}
		addDirectionalGroupRule(c, masterSG, nodeSG, etcdCNIRule)
	}
	return nil
}
func ( b * FirewallModelBuilder ) addETCDRules ( c * fi . ModelBuilderContext , sgMap map [ string ] * openstacktasks . SecurityGroup ) error { masterName := b . SecurityGroupName ( kops . InstanceGroupRoleMaster ) nodeName := b . SecurityGroupName ( kops . InstanceGroupRoleNode ) masterSG := sgMap [ masterName ] nodeSG := sgMap [ nodeName ] etcdRule := & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( string ( rules . ProtocolTCP ) ) , EtherType : s ( IPV4 ) , PortRangeMin : i ( 4001 ) , PortRangeMax : i ( 4002 ) , } etcdPeerRule := & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( string ( rules . ProtocolTCP ) ) , EtherType : s ( IPV4 ) , PortRangeMin : i ( 2380 ) , PortRangeMax : i ( 2381 ) , } addDirectionalGroupRule ( c , masterSG , masterSG , etcdRule ) addDirectionalGroupRule ( c , masterSG , masterSG , etcdPeerRule ) if b . Cluster . Spec . Networking . Romana != nil || b . Cluster . Spec . Networking . Calico != nil { etcdCNIRule := & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( string ( rules . ProtocolTCP ) ) , EtherType : s ( IPV4 ) , PortRangeMin : i ( 4001 ) , PortRangeMax : i ( 4001 ) , } addDirectionalGroupRule ( c , masterSG , nodeSG , etcdCNIRule ) } return nil }
Add ETCD access rules based on which CNI might need to access __ETCD_ENDPOINTS
Add ETCD access rules based on which CNI might need to access __ETCD_ENDPOINTS
// ETCD Peer Discovery // Master access from other masters covered above // Allow nodes to reach ETCD endpoints