🌱 AWSManagedMachinePool: Make public access to SSH explicit #2243
Conversation
k8s-ci-robot
added
release-note-none
k8s-ci-robot
added
the
size/M
michaelbeaumont
force-pushed
the
remote_access
branch
from
8ed2180 to
c54dd7a
Compare
|
@michaelbeaumont - i think we a release note here as we are changing behavior from where it would be public if there was an SSH key to even if there is an SSH key they need to set |
| SourceSecurityGroups []string `json:"sourceSecurityGroups,omitempty"` | ||
|
|
||
| // Public specifies whether to open port 22 to the public internet | ||
| Public bool `json:"public,omitempty"` |
There was a problem hiding this comment.
Small nit, in the PR description its publicAccess but here its public. Guessing the preferred naming is public?
There was a problem hiding this comment.
Yes, I switched to public to get rid of the remoteAccess.publicAccess duplication.
|
/test ? |
|
@richardcase: The following commands are available to trigger jobs:
Use
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/test pull-cluster-api-provider-aws-e2e |
k8s-ci-robot
added
release-note-action-required
True, I've now added an |
|
As soon as the e2e tests pass I will approve |
|
/test pull-cluster-api-provider-aws-e2e |
|
Ah, ran the wrong tests: /test pull-cluster-api-provider-aws-e2e-eks |
|
the eks e2e tests passed, so: /lgtm |
k8s-ci-robot
added
the
lgtm
|
@michaelbeaumont: The following test failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: richardcase The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
What this PR does / why we need it:
Restricts access to SSH for
AWSManagedMachinePools to specific security groups by default. Until now the default matches the AWS API defaults where if SSH access is enabled with some SSH key then access is allowed from any IP. Now the user must setpublic: true.Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close the issue(s) when PR gets merged):Fixes #1990
Special notes for your reviewer:
Checklist:
Release note: