kubernetes-sigs/cluster-api
Add strict validation for CIDR ranges in the Cluster webhook
オープン
#7,538 opened on 2022/11/14
area/apihelp wantedkind/api-changekind/featurepriority/backlogtriage/accepted
Repository metrics
- Stars
- (4,267 個のスター)
- PR merge metrics
- (PR metrics pending)
説明
Add a check in the Cluster webhook to ensure each CIDR block only contains valid CIDR blocks with the following rules:
- No more than two CIDR blocks are specified under Pods or Services
- If two are specified the blocks need to be from different IP families i.e. one IPv4 and one IPv6
- The IPFamily for pods and services must be compatible
- The CIDR ranges are valid CIDR ranges
This change ensures Clusters can not be created or updated with invalid CIDR blocks. This is the value that the Kubernetes control plane components take - e.g. the kube-apiserver flag --service-cluster-ip-range is documented:
A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes or pods. Max of two dual-stack CIDRs is allowed.
Related to: https://github.com/kubernetes-sigs/cluster-api/pull/7420
/kind feature /area api /kind api-change