Replace NLBs on subnets change

Signed-off-by: Mikkel Oscar Lyderik Larsen <[email protected]>

Author: mikkeloscar

aws/cf.go

@@ -35,6 +35,7 @@ type Stack struct {
 	WAFWebACLID       string
 	CertificateARNs   map[string]time.Time
 	tags              map[string]string
+	Subnets           []string
 }
 
 // IsComplete returns true if the stack status is a complete state.
@@ -480,6 +481,11 @@ func mapToManagedStack(stack *cloudformation.Stack) *Stack {
 		http2 = false
 	}
 
+	var subnets []string
+	if parameters[parameterLoadBalancerSubnetsParameter] != "" {
+		subnets = strings.Split(parameters[parameterLoadBalancerSubnetsParameter], ",")
+	}
+
 	return &Stack{
 		Name:              aws.StringValue(stack.StackName),
 		DNSName:           outputs.dnsName(),
@@ -497,6 +503,7 @@ func mapToManagedStack(stack *cloudformation.Stack) *Stack {
 		statusReason:      aws.StringValue(stack.StackStatusReason),
 		CWAlarmConfigHash: tags[cwAlarmConfigHashTag],
 		WAFWebACLID:       parameters[parameterLoadBalancerWAFWebACLIDParameter],
+		Subnets:           subnets,
 	}
 }
 

worker.go

@@ -333,7 +333,7 @@ func doWork(
 	awsAdapter.UpdateTargetGroupsAndAutoScalingGroups(stacks, problems)
 
 	certs := NewCertificates(certificateSummaries)
-	model := buildManagedModel(certs, certsPerALB, certTTL, ingresses, stacks, cwAlarms, globalWAFACL)
+	model := buildManagedModel(certs, certsPerALB, certTTL, ingresses, stacks, cwAlarms, globalWAFACL, awsAdapter.FindLBSubnets)
 	log.Debugf("Have %d model(s)", len(model))
 	for _, loadBalancer := range model {
 		switch loadBalancer.Status() {
@@ -408,6 +408,7 @@ func matchIngressesToLoadBalancers(
 	certs CertificatesFinder,
 	certsPerALB int,
 	ingresses []*kubernetes.Ingress,
+	subnetsByScheme func(scheme string) []string,
 ) []*loadBalancer {
 	clusterLocalLB := &loadBalancer{
 		clusterLocal: true,
@@ -451,6 +452,15 @@ func matchIngressesToLoadBalancers(
 				continue
 			}
 
+			// Ignore NLBs with a wrong set of subnets
+			if lb.loadBalancerType == aws.LoadBalancerTypeNetwork {
+				subnets := subnetsByScheme(lb.scheme)
+
+				if !equalSlices[string](lb.stack.Subnets, subnets) {
+					continue
+				}
+			}
+
 			if lb.addIngress(certificateARNs, ingress, certsPerALB) {
 				added = true
 				break
@@ -516,11 +526,12 @@ func buildManagedModel(
 	stacks []*aws.Stack,
 	cwAlarms aws.CloudWatchAlarmList,
 	globalWAFACL string,
+	subnetsByScheme func(scheme string) []string,
 ) []*loadBalancer {
 	sortStacks(stacks)
 	attachGlobalWAFACL(ingresses, globalWAFACL)
 	model := getAllLoadBalancers(certs, certTTL, stacks)
-	model = matchIngressesToLoadBalancers(model, certs, certsPerALB, ingresses)
+	model = matchIngressesToLoadBalancers(model, certs, certsPerALB, ingresses, subnetsByScheme)
 	attachCloudWatchAlarms(model, cwAlarms)
 
 	return model
@@ -710,3 +721,25 @@ func cniEventHandler(ctx context.Context, targetCNIcfg *aws.TargetCNIconfig,
 		}
 	}
 }
+
+func equalSlices[T comparable](a, b []T) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	for _, aElem := range a {
+		found := false
+		for _, bElem := range b {
+			if aElem == bElem {
+				found = true
+				break
+			}
+		}
+
+		if !found {
+			return false
+		}
+	}
+
+	return true
+}

worker_test.go

@@ -18,6 +18,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/zalando-incubator/kube-ingress-aws-controller/aws"
 	awsAdapter "github.com/zalando-incubator/kube-ingress-aws-controller/aws"
 	"github.com/zalando-incubator/kube-ingress-aws-controller/certs"
 	"github.com/zalando-incubator/kube-ingress-aws-controller/kubernetes"
@@ -1179,6 +1180,7 @@ func TestMatchIngressesToLoadbalancers(t *testing.T) {
 		maxCertsPerLB int
 		lbs           []*loadBalancer
 		ingresses     []*kubernetes.Ingress
+		subnets       []string
 		validate      func(*testing.T, []*loadBalancer)
 	}{{
 		title: "only cluster local",
@@ -1361,6 +1363,37 @@ func TestMatchIngressesToLoadbalancers(t *testing.T) {
 				require.Equal(t, 1, len(lb.ingresses["foo"]))
 			}
 		},
+	}, {
+		title: "load balancer with invalid subnets",
+		ingresses: []*kubernetes.Ingress{{
+			Name: "foo-ingress",
+			Hostnames: []string{
+				"foo.org",
+				"bar.org",
+			},
+			LoadBalancerType: awsAdapter.LoadBalancerTypeNetwork,
+			Shared:           true,
+		}},
+		lbs: []*loadBalancer{{
+			loadBalancerType: awsAdapter.LoadBalancerTypeNetwork,
+			ingresses:        make(map[string][]*kubernetes.Ingress),
+			stack:            &aws.Stack{Subnets: []string{"a", "b", "c"}},
+		}},
+		validate: func(t *testing.T, lbs []*loadBalancer) {
+			require.Equal(t, 3, len(lbs))
+			for _, lb := range lbs {
+				if lb.clusterLocal {
+					continue
+				}
+
+				if lb.stack != nil && equalSlices[string](lb.stack.Subnets, []string{"a", "b", "c"}) {
+					require.Len(t, lb.ingresses, 0)
+				} else {
+					require.Len(t, lb.ingresses, 1)
+				}
+			}
+		},
+		subnets: []string{"x", "y", "z"},
 	}} {
 		t.Run(test.title, func(t *testing.T) {
 			var certs CertificatesFinder = defaultCerts
@@ -1373,7 +1406,11 @@ func TestMatchIngressesToLoadbalancers(t *testing.T) {
 				maxCertsPerLB = test.maxCertsPerLB
 			}
 
-			lbs := matchIngressesToLoadBalancers(test.lbs, certs, maxCertsPerLB, test.ingresses)
+			subnetsByScheme := func(scheme string) []string {
+				return test.subnets
+			}
+
+			lbs := matchIngressesToLoadBalancers(test.lbs, certs, maxCertsPerLB, test.ingresses, subnetsByScheme)
 			test.validate(t, lbs)
 		})
 	}
@@ -1403,6 +1440,7 @@ func TestBuildModel(t *testing.T) {
 		stacks        []*awsAdapter.Stack
 		alarms        awsAdapter.CloudWatchAlarmList
 		globalWAFACL  string
+		subnets       []string
 		validate      func(*testing.T, []*loadBalancer)
 	}{{
 		title: "no alarm, no waf",
@@ -1549,6 +1587,10 @@ func TestBuildModel(t *testing.T) {
 				maxCertsPerLB = test.maxCertsPerLB
 			}
 
+			subnetsByScheme := func(scheme string) []string {
+				return test.subnets
+			}
+
 			m := buildManagedModel(
 				certs,
 				maxCertsPerLB,
@@ -1557,6 +1599,7 @@ func TestBuildModel(t *testing.T) {
 				test.stacks,
 				test.alarms,
 				test.globalWAFACL,
+				subnetsByScheme,
 			)
 
 			test.validate(t, m)