From 431b6f242ac919fd9f9923b96d7e7947baaefbae Mon Sep 17 00:00:00 2001 From: Jason Kidd Date: Mon, 12 Jun 2023 16:04:10 -0700 Subject: [PATCH 1/3] Added azure-no-nsg boolean flag to disable network security group --- drivers/azure/azure.go | 15 +++++++++++++-- drivers/azure/azureutil/azureutil.go | 9 ++++++--- 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/azure/azure.go b/drivers/azure/azure.go index dd3016d7c9..ea933229f1 100644 --- a/drivers/azure/azure.go +++ b/drivers/azure/azure.go @@ -58,6 +58,7 @@ const ( flAzureUsePrivateIP = "azure-use-private-ip" flAzureStaticPublicIP = "azure-static-public-ip" flAzureNoPublicIP = "azure-no-public-ip" + flAzureNoNSG = "azure-no-nsg" flAzureDNSLabel = "azure-dns" flAzureStorageType = "azure-storage-type" flAzureCustomData = "azure-custom-data" @@ -112,6 +113,7 @@ type Driver struct { PrivateIPAddr string UsePrivateIP bool NoPublicIP bool + NoNSG bool DNSLabel string StaticPublicIP bool CustomDataFile string // Can provide cloud-config file here @@ -274,6 +276,10 @@ func (d *Driver) GetCreateFlags() []mcnflag.Flag { Name: flAzureNoPublicIP, Usage: "Do not create a public IP address for the machine", }, + mcnflag.BoolFlag{ + Name: flAzureNoNSG, + Usage: "Do not create a network security group for the machine", + }, mcnflag.BoolFlag{ Name: flAzureStaticPublicIP, Usage: "Assign a static public IP address to the machine", @@ -360,6 +366,7 @@ func (d *Driver) SetConfigFromFlags(fl drivers.DriverOptions) error { d.PrivateIPAddr = fl.String(flAzurePrivateIPAddr) d.UsePrivateIP = fl.Bool(flAzureUsePrivateIP) d.NoPublicIP = fl.Bool(flAzureNoPublicIP) + d.NoNSG = fl.Bool(flAzureNoNSG) d.StaticPublicIP = fl.Bool(flAzureStaticPublicIP) d.DockerPort = fl.Int(flAzureDockerPort) d.DNSLabel = fl.String(flAzureDNSLabel) @@ -485,8 +492,12 @@ func (d *Driver) Create() error { return err } } - if err := c.CreateNetworkSecurityGroup(ctx, d.deploymentCtx, d.ResourceGroup, d.nsgResource, d.Location, d.nsgUsedInPool, d.deploymentCtx.FirewallRules); err != nil { - return err + if d.NoNSG { + log.Info("Not creating a network security group.") + } else { + if err := c.CreateNetworkSecurityGroup(ctx, d.deploymentCtx, d.ResourceGroup, d.nsgResource, d.Location, d.nsgUsedInPool, d.deploymentCtx.FirewallRules); err != nil { + return err + } } vnetResourceGroup, vNetName := parseVirtualNetwork(d.VirtualNetwork, d.ResourceGroup) if err := c.CreateVirtualNetworkIfNotExists(ctx, vnetResourceGroup, vNetName, d.Location); err != nil { diff --git a/drivers/azure/azureutil/azureutil.go b/drivers/azure/azureutil/azureutil.go index 5cf7d9b56a..ad596f2fc1 100644 --- a/drivers/azure/azureutil/azureutil.go +++ b/drivers/azure/azureutil/azureutil.go @@ -327,6 +327,11 @@ func (a AzureClient) CreateNetworkInterface(ctx context.Context, deploymentCtx * publicIP = &network.PublicIPAddress{ID: to.StringPtr(publicIPAddressID)} } + var nsg *network.SecurityGroup + if nsgID != "" { + nsg = &network.SecurityGroup{ID: to.StringPtr(nsgID)} + } + var privateIPAllocMethod = network.Dynamic if privateIPAddress != "" { privateIPAllocMethod = network.Static @@ -336,9 +341,7 @@ func (a AzureClient) CreateNetworkInterface(ctx context.Context, deploymentCtx * Location: to.StringPtr(location), InterfacePropertiesFormat: &network.InterfacePropertiesFormat{ EnableAcceleratedNetworking: to.BoolPtr(enabledAcceleratedNetworking), - NetworkSecurityGroup: &network.SecurityGroup{ - ID: to.StringPtr(nsgID), - }, + NetworkSecurityGroup: nsg, IPConfigurations: &[]network.InterfaceIPConfiguration{ { Name: to.StringPtr("ip"), From 153bccc34e7a71836085e72e9c73ded8acd1da22 Mon Sep 17 00:00:00 2001 From: Jason Kidd Date: Tue, 13 Jun 2023 08:15:56 -0700 Subject: [PATCH 2/3] Added azure-no-availability flag to disable availabilitysets and zones. --- drivers/azure/azure.go | 13 ++++++++++--- drivers/azure/azureutil/azureutil.go | 6 +++--- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/azure/azure.go b/drivers/azure/azure.go index ea933229f1..5a34cead1c 100644 --- a/drivers/azure/azure.go +++ b/drivers/azure/azure.go @@ -59,6 +59,7 @@ const ( flAzureStaticPublicIP = "azure-static-public-ip" flAzureNoPublicIP = "azure-no-public-ip" flAzureNoNSG = "azure-no-nsg" + flAzureNoAvailability = "azure-no-availability" flAzureDNSLabel = "azure-dns" flAzureStorageType = "azure-storage-type" flAzureCustomData = "azure-custom-data" @@ -114,6 +115,7 @@ type Driver struct { UsePrivateIP bool NoPublicIP bool NoNSG bool + NoAvailability bool DNSLabel string StaticPublicIP bool CustomDataFile string // Can provide cloud-config file here @@ -280,6 +282,10 @@ func (d *Driver) GetCreateFlags() []mcnflag.Flag { Name: flAzureNoNSG, Usage: "Do not create a network security group for the machine", }, + mcnflag.BoolFlag{ + Name: flAzureNoAvailability, + Usage: "Do not create a AvailabilitySet or AvailabilityZone for the machine", + }, mcnflag.BoolFlag{ Name: flAzureStaticPublicIP, Usage: "Assign a static public IP address to the machine", @@ -367,6 +373,7 @@ func (d *Driver) SetConfigFromFlags(fl drivers.DriverOptions) error { d.UsePrivateIP = fl.Bool(flAzureUsePrivateIP) d.NoPublicIP = fl.Bool(flAzureNoPublicIP) d.NoNSG = fl.Bool(flAzureNoNSG) + d.NoAvailability = fl.Bool(flAzureNoAvailability) d.StaticPublicIP = fl.Bool(flAzureStaticPublicIP) d.DockerPort = fl.Int(flAzureDockerPort) d.DNSLabel = fl.String(flAzureDNSLabel) @@ -401,7 +408,7 @@ func (d *Driver) PreCreateCheck() (err error) { } } - if d.AvailabilityZone != "" { + if d.AvailabilityZone != "" && !d.NoAvailability { if !d.ManagedDisks { return fmt.Errorf("Managed Disks must be used when creating resources in specific Availability Zones (--azure-managed-disks)") } @@ -487,7 +494,7 @@ func (d *Driver) Create() error { return err } // availability sets and availability zones cannot be used together. The presence of an Availability Zone indicates that an Availability set should not be created / used - if d.AvailabilityZone == "" { + if d.AvailabilityZone == "" && !d.NoAvailability { if err := c.CreateAvailabilitySetIfNotExists(ctx, d.deploymentCtx, d.ResourceGroup, d.AvailabilitySet, d.Location, d.ManagedDisks, int32(d.FaultCount), int32(d.UpdateCount)); err != nil { return err } @@ -576,7 +583,7 @@ func (d *Driver) Remove() error { return err } // availability sets and availability zones cannot be used together. The absence of any Availability Zones indicates that an Availability set was created and should be deleted. - if d.AvailabilityZone == "" { + if d.AvailabilityZone == "" && !d.NoAvailability { if err := c.CleanupAvailabilitySetIfExists(ctx, d.ResourceGroup, d.AvailabilitySet); err != nil { return err } diff --git a/drivers/azure/azureutil/azureutil.go b/drivers/azure/azureutil/azureutil.go index ad596f2fc1..eaa07d2ca2 100644 --- a/drivers/azure/azureutil/azureutil.go +++ b/drivers/azure/azureutil/azureutil.go @@ -643,12 +643,12 @@ func (a AzureClient) CreateVirtualMachine(ctx context.Context, resourceGroup, na // in particular Availability Zones - you can only specify one or the other. // if a user has provided an availability zone it is assumed that // no availability sets should be created / used. - if availabilityZone == "" { + if availabilityZone != "" { + vm.Zones = to.StringSlicePtr([]string{availabilityZone}) + } else if availabilitySetID != "" { vm.VirtualMachineProperties.AvailabilitySet = &compute.SubResource{ ID: to.StringPtr(availabilitySetID), } - } else { - vm.Zones = to.StringSlicePtr([]string{availabilityZone}) } future, err := virtualMachinesClient.CreateOrUpdate(ctx, resourceGroup, name, vm) From 8076060b84bc16922e235c372275577b121aa884 Mon Sep 17 00:00:00 2001 From: jk-f5 <103135946+jk-f5@users.noreply.github.com> Date: Thu, 3 Aug 2023 10:16:36 -0700 Subject: [PATCH 3/3] Refactor NSG conditional in drivers/azure/azure.go Co-authored-by: Jiaqi Luo <6218999+jiaqiluo@users.noreply.github.com> --- drivers/azure/azure.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/azure/azure.go b/drivers/azure/azure.go index 5a34cead1c..ec1076fa2c 100644 --- a/drivers/azure/azure.go +++ b/drivers/azure/azure.go @@ -494,9 +494,14 @@ func (d *Driver) Create() error { return err } // availability sets and availability zones cannot be used together. The presence of an Availability Zone indicates that an Availability set should not be created / used - if d.AvailabilityZone == "" && !d.NoAvailability { - if err := c.CreateAvailabilitySetIfNotExists(ctx, d.deploymentCtx, d.ResourceGroup, d.AvailabilitySet, d.Location, d.ManagedDisks, int32(d.FaultCount), int32(d.UpdateCount)); err != nil { - return err + if d.NoAvailability { + log.Info("Not creating an availability zone or availability set.") + } else { + // availability sets and availability zones cannot be used together. The presence of an Availability Zone indicates that an Availability set should not be created / used + if d.AvailabilityZone == "" { + if err := c.CreateAvailabilitySetIfNotExists(ctx, d.deploymentCtx, d.ResourceGroup, d.AvailabilitySet, d.Location, d.ManagedDisks, int32(d.FaultCount), int32(d.UpdateCount)); err != nil { + return err + } } } if d.NoNSG {