func (b *FirewallModelBuilder) addCNIRules(c *fi.ModelBuilderContext, sgMap map[string]*openstacktasks.SecurityGroup) error {

	udpPorts := []int{}
	tcpPorts := []int{}
	protocols := []string{}

	// allow cadvisor
	tcpPorts = append(tcpPorts, 4194)

	if b.Cluster.Spec.Networking != nil {
		if b.Cluster.Spec.Networking.Kopeio != nil {
			// VXLAN over UDP
			// https://tools.ietf.org/html/rfc7348
			udpPorts = append(udpPorts, 4789)
		}

		if b.Cluster.Spec.Networking.Weave != nil {
			udpPorts = append(udpPorts, 6783)
			tcpPorts = append(tcpPorts, 6783)
			udpPorts = append(udpPorts, 6784)
		}

		if b.Cluster.Spec.Networking.Flannel != nil {
			switch b.Cluster.Spec.Networking.Flannel.Backend {
			case "", "udp":
				udpPorts = append(udpPorts, 8285)
			case "vxlan":
				udpPorts = append(udpPorts, 8472)
			default:
				klog.Warningf("unknown flannel networking backend %q", b.Cluster.Spec.Networking.Flannel.Backend)
			}
		}

		if b.Cluster.Spec.Networking.Calico != nil {
			tcpPorts = append(tcpPorts, 179)
			protocols = append(protocols, ProtocolIPEncap)
		}

		if b.Cluster.Spec.Networking.Romana != nil {
			tcpPorts = append(tcpPorts, 9600)
		}

		if b.Cluster.Spec.Networking.Kuberouter != nil {
			protocols = append(protocols, ProtocolIPEncap)
		}
	}

	masterName := b.SecurityGroupName(kops.InstanceGroupRoleMaster)
	nodeName := b.SecurityGroupName(kops.InstanceGroupRoleNode)
	masterSG := sgMap[masterName]
	nodeSG := sgMap[nodeName]

	for _, udpPort := range udpPorts {
		udpRule := &openstacktasks.SecurityGroupRule{
			Lifecycle:      b.Lifecycle,
			Direction:      s(string(rules.DirIngress)),
			Protocol:       s(string(rules.ProtocolUDP)),
			EtherType:      s(string(rules.EtherType4)),
			PortRangeMin:   i(udpPort),
			PortRangeMax:   i(udpPort),
			RemoteIPPrefix: s(b.Cluster.Spec.NetworkCIDR),
		}
		addDirectionalGroupRule(c, masterSG, nil, udpRule)
		addDirectionalGroupRule(c, nodeSG, nil, udpRule)
	}
	for _, tcpPort := range tcpPorts {
		tcpRule := &openstacktasks.SecurityGroupRule{
			Lifecycle:      b.Lifecycle,
			Direction:      s(string(rules.DirIngress)),
			Protocol:       s(string(rules.ProtocolTCP)),
			EtherType:      s(string(rules.EtherType4)),
			PortRangeMin:   i(tcpPort),
			PortRangeMax:   i(tcpPort),
			RemoteIPPrefix: s(b.Cluster.Spec.NetworkCIDR),
		}
		addDirectionalGroupRule(c, masterSG, nil, tcpRule)
		addDirectionalGroupRule(c, nodeSG, nil, tcpRule)
	}
	for _, protocol := range protocols {
		protocolRule := &openstacktasks.SecurityGroupRule{
			Lifecycle: b.Lifecycle,
			Direction: s(string(rules.DirIngress)),
			Protocol:  s(protocol),
			EtherType: s(string(rules.EtherType4)),
		}
		addDirectionalGroupRule(c, nodeSG, masterSG, protocolRule)
	}

	return nil
}
// addCNIRules - Add ports required for different CNI implementations
Add ports required for different CNI implementations
// addCNIRules - Add ports required for different CNI implementations
func (b *FirewallModelBuilder) addCNIRules(c *fi.ModelBuilderContext, sgMap map[string]*openstacktasks.SecurityGroup) error {
	udpPorts := []int{}
	tcpPorts := []int{}
	protocols := []string{}
	tcpPorts = append(tcpPorts, 4194)
	if b.Cluster.Spec.Networking != nil {
		if b.Cluster.Spec.Networking.Kopeio != nil {
			udpPorts = append(udpPorts, 4789)
		}
		if b.Cluster.Spec.Networking.Weave != nil {
			udpPorts = append(udpPorts, 6783)
			tcpPorts = append(tcpPorts, 6783)
			udpPorts = append(udpPorts, 6784)
		}
		if b.Cluster.Spec.Networking.Flannel != nil {
			switch b.Cluster.Spec.Networking.Flannel.Backend {
			case "", "udp":
				udpPorts = append(udpPorts, 8285)
			case "vxlan":
				udpPorts = append(udpPorts, 8472)
			default:
				klog.Warningf("unknown flannel networking backend %q", b.Cluster.Spec.Networking.Flannel.Backend)
			}
		}
		if b.Cluster.Spec.Networking.Calico != nil {
			tcpPorts = append(tcpPorts, 179)
			protocols = append(protocols, ProtocolIPEncap)
		}
		if b.Cluster.Spec.Networking.Romana != nil {
			tcpPorts = append(tcpPorts, 9600)
		}
		if b.Cluster.Spec.Networking.Kuberouter != nil {
			protocols = append(protocols, ProtocolIPEncap)
		}
	}
	masterName := b.SecurityGroupName(kops.InstanceGroupRoleMaster)
	nodeName := b.SecurityGroupName(kops.InstanceGroupRoleNode)
	masterSG := sgMap[masterName]
	nodeSG := sgMap[nodeName]
	for _, udpPort := range udpPorts {
		udpRule := &openstacktasks.SecurityGroupRule{
			Lifecycle:      b.Lifecycle,
			Direction:      s(string(rules.DirIngress)),
			Protocol:       s(string(rules.ProtocolUDP)),
			EtherType:      s(string(rules.EtherType4)),
			PortRangeMin:   i(udpPort),
			PortRangeMax:   i(udpPort),
			RemoteIPPrefix: s(b.Cluster.Spec.NetworkCIDR),
		}
		addDirectionalGroupRule(c, masterSG, nil, udpRule)
		addDirectionalGroupRule(c, nodeSG, nil, udpRule)
	}
	for _, tcpPort := range tcpPorts {
		tcpRule := &openstacktasks.SecurityGroupRule{
			Lifecycle:      b.Lifecycle,
			Direction:      s(string(rules.DirIngress)),
			Protocol:       s(string(rules.ProtocolTCP)),
			EtherType:      s(string(rules.EtherType4)),
			PortRangeMin:   i(tcpPort),
			PortRangeMax:   i(tcpPort),
			RemoteIPPrefix: s(b.Cluster.Spec.NetworkCIDR),
		}
		addDirectionalGroupRule(c, masterSG, nil, tcpRule)
		addDirectionalGroupRule(c, nodeSG, nil, tcpRule)
	}
	for _, protocol := range protocols {
		protocolRule := &openstacktasks.SecurityGroupRule{
			Lifecycle: b.Lifecycle,
			Direction: s(string(rules.DirIngress)),
			Protocol:  s(protocol),
			EtherType: s(string(rules.EtherType4)),
		}
		addDirectionalGroupRule(c, nodeSG, masterSG, protocolRule)
	}
	return nil
}
func ( b * FirewallModelBuilder ) addCNIRules ( c * fi . ModelBuilderContext , sgMap map [ string ] * openstacktasks . SecurityGroup ) error { udpPorts := [ ] int { } tcpPorts := [ ] int { } protocols := [ ] string { } tcpPorts = append ( tcpPorts , 4194 ) if b . Cluster . Spec . Networking != nil { if b . Cluster . Spec . Networking . Kopeio != nil { udpPorts = append ( udpPorts , 4789 ) } if b . Cluster . Spec . Networking . Weave != nil { udpPorts = append ( udpPorts , 6783 ) tcpPorts = append ( tcpPorts , 6783 ) udpPorts = append ( udpPorts , 6784 ) } if b . Cluster . Spec . Networking . Flannel != nil { switch b . Cluster . Spec . Networking . Flannel . Backend { case " " , " " : udpPorts = append ( udpPorts , 8285 ) case " " : udpPorts = append ( udpPorts , 8472 ) default : klog . Warningf ( " " , b . Cluster . Spec . Networking . Flannel . Backend ) } } if b . Cluster . Spec . Networking . Calico != nil { tcpPorts = append ( tcpPorts , 179 ) protocols = append ( protocols , ProtocolIPEncap ) } if b . Cluster . Spec . Networking . Romana != nil { tcpPorts = append ( tcpPorts , 9600 ) } if b . Cluster . Spec . Networking . Kuberouter != nil { protocols = append ( protocols , ProtocolIPEncap ) } } masterName := b . SecurityGroupName ( kops . InstanceGroupRoleMaster ) nodeName := b . SecurityGroupName ( kops . InstanceGroupRoleNode ) masterSG := sgMap [ masterName ] nodeSG := sgMap [ nodeName ] for _ , udpPort := range udpPorts { udpRule := & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( string ( rules . ProtocolUDP ) ) , EtherType : s ( string ( rules . EtherType4 ) ) , PortRangeMin : i ( udpPort ) , PortRangeMax : i ( udpPort ) , RemoteIPPrefix : s ( b . Cluster . Spec . NetworkCIDR ) , } addDirectionalGroupRule ( c , masterSG , nil , udpRule ) addDirectionalGroupRule ( c , nodeSG , nil , udpRule ) } for _ , tcpPort := range tcpPorts { tcpRule := & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( string ( rules . ProtocolTCP ) ) , EtherType : s ( string ( rules . EtherType4 ) ) , PortRangeMin : i ( tcpPort ) , PortRangeMax : i ( tcpPort ) , RemoteIPPrefix : s ( b . Cluster . Spec . NetworkCIDR ) , } addDirectionalGroupRule ( c , masterSG , nil , tcpRule ) addDirectionalGroupRule ( c , nodeSG , nil , tcpRule ) } for _ , protocol := range protocols { protocolRule := & openstacktasks . SecurityGroupRule { Lifecycle : b . Lifecycle , Direction : s ( string ( rules . DirIngress ) ) , Protocol : s ( protocol ) , EtherType : s ( string ( rules . EtherType4 ) ) , } addDirectionalGroupRule ( c , nodeSG , masterSG , protocolRule ) } return nil }
Add ports required for different CNI implementations
Add ports required for different CNI implementations
// allow cadvisor // VXLAN over UDP // https://tools.ietf.org/html/rfc7348