adestis-mf commented on code in PR #14670:
URL: https://github.com/apache/cloudstack/pull/14670#discussion_r4532041040
##########
plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterScaleWorker.java:
##########
@@ -184,6 +192,10 @@ private void scaleKubernetesClusterVpcTierRules(final
List<Long> clusterVMIds) t
} catch (ResourceUnavailableException | NetworkRuleConflictException
e) {
throw new ManagementServerException(String.format("Failed to
activate SSH port forwarding rules for the Kubernetes cluster : %s",
kubernetesCluster.getName()), e);
}
+ if (vpcFirewallEnabled) {
+ // After the port forwarding rules, as when the cluster is created
+ addFirewallRulesForNodes(publicIp, clusterVMIds.size());
Review Comment:
Thanks, the scenario is valid: the imported node's single-port SSH rule
overlaps the rebuilt
range, and `detectRulesConflict` rejects it (same protocol and source CIDR).
Reading the code, isolated networks on `main` behave the same way: the
add-node path creates the
same per-node rule
([KubernetesClusterAddWorker.java#L229](https://github.com/apache/cloudstack/blob/a7be64af7ad8fdefe1948efa175e87d4852d3453/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterAddWorker.java#L229)),
and the isolated scale path also revokes a single rule before recreating the
range
([KubernetesClusterScaleWorker.java#L135-L149](https://github.com/apache/cloudstack/blob/a7be64af7ad8fdefe1948efa175e87d4852d3453/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterScaleWorker.java#L135-L149)).
This PR mirrors that handling for VPC tiers, so the case is not new, it just
becomes reachable on
VPC tiers with the Firewall service.
I'd prefer to keep this PR to the missing rules and fix the
import-then-scale case for both
network types in #14673, since it also touches `removeSshFirewallRule`, which
#14165 is changing. If you'd rather have it here, I'll add it to this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
