From b5a07f5868399f619dfecf9f08136ee2defeda34 Mon Sep 17 00:00:00 2001 From: Nathan Button Date: Fri, 28 Jul 2017 11:03:55 -0700 Subject: [PATCH] We never want to modify the globally defined SG --- pkg/cloudprovider/providers/aws/aws.go | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/pkg/cloudprovider/providers/aws/aws.go b/pkg/cloudprovider/providers/aws/aws.go index d5e916a924f8b..04e6421bff644 100644 --- a/pkg/cloudprovider/providers/aws/aws.go +++ b/pkg/cloudprovider/providers/aws/aws.go @@ -2072,6 +2072,11 @@ func isEqualUserGroupPair(l, r *ec2.UserIdGroupPair, compareGroupUserIDs bool) b // Returns true if and only if changes were made // The security group must already exist func (c *Cloud) setSecurityGroupIngress(securityGroupID string, permissions IPPermissionSet) (bool, error) { + // We do not want to make changes to the Global defined SG + if securityGroupID == c.cfg.Global.ElbSecurityGroup { + return false, nil + } + group, err := c.findSecurityGroup(securityGroupID) if err != nil { glog.Warning("Error retrieving security group", err) @@ -2142,6 +2147,11 @@ func (c *Cloud) setSecurityGroupIngress(securityGroupID string, permissions IPPe // Returns true if and only if changes were made // The security group must already exist func (c *Cloud) addSecurityGroupIngress(securityGroupID string, addPermissions []*ec2.IpPermission) (bool, error) { + // We do not want to make changes to the Global defined SG + if securityGroupID == c.cfg.Global.ElbSecurityGroup { + return false, nil + } + group, err := c.findSecurityGroup(securityGroupID) if err != nil { glog.Warningf("Error retrieving security group: %v", err) @@ -2198,6 +2208,11 @@ func (c *Cloud) addSecurityGroupIngress(securityGroupID string, addPermissions [ // Returns true if and only if changes were made // If the security group no longer exists, will return (false, nil) func (c *Cloud) removeSecurityGroupIngress(securityGroupID string, removePermissions []*ec2.IpPermission) (bool, error) { + // We do not want to make changes to the Global defined SG + if securityGroupID == c.cfg.Global.ElbSecurityGroup { + return false, nil + } + group, err := c.findSecurityGroup(securityGroupID) if err != nil { glog.Warningf("Error retrieving security group: %v", err) @@ -2525,7 +2540,7 @@ func getPortSets(annotation string) (ports *portSets) { // buildELBSecurityGroupList returns list of SecurityGroups which should be // attached to ELB created by a service. List always consist of at least -// 1 member which is an SG created for this service. Extra groups can be +// 1 member which is an SG created for this service or a SG from the Global config. Extra groups can be // specified via annotation func (c *Cloud) buildELBSecurityGroupList(serviceName types.NamespacedName, loadBalancerName, annotation string) ([]string, error) { var err error