Copilot commented on code in PR #14670:
URL: https://github.com/apache/cloudstack/pull/14670#discussion_r4531554059
##########
plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterScaleWorker.java:
##########
@@ -184,6 +192,10 @@ private void scaleKubernetesClusterVpcTierRules(final
List<Long> clusterVMIds) t
} catch (ResourceUnavailableException | NetworkRuleConflictException
e) {
throw new ManagementServerException(String.format("Failed to
activate SSH port forwarding rules for the Kubernetes cluster : %s",
kubernetesCluster.getName()), e);
}
+ if (vpcFirewallEnabled) {
+ // After the port forwarding rules, as when the cluster is created
+ addFirewallRulesForNodes(publicIp, clusterVMIds.size());
Review Comment:
Scaling up a firewall-enabled VPC cluster after importing a worker can fail
because `removeSshFirewallRule` revokes only one SSH rule, leaving the imported
worker's single-port rule active. For example, expanding the managed-node range
from 2222–2223 to 2222–2224 conflicts with an imported worker's existing rule
on 2224, failing the scale operation after the original range has been revoked.
Reconcile the CKS per-imported-node rules together with the main range before
creating replacements, preserve unrelated rules, and add an import-then-scale
regression test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
