NVIDIA / holodeck / 23082973500

48%

push

github

feat: separate CP and Worker security groups (#725)

* feat: separate CP and Worker security groups

Split single cluster security group into role-specific SGs with
least-privilege rules:

CP SG: etcd (2379-2380) restricted to CP nodes only, scheduler and
controller-manager ports self-only, API server open to workers and
NLB subnet.

Worker SG: kubelet (10250) from CP only, NodePort range
(30000-32767) open for services.

Both SGs share Calico overlay ports (VXLAN 4789, BGP 179, Typha
5473). Instances launched with role-specific SGs.

Signed-off-by: Eduardo Arango <earango@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

* fix: address CI lint and test failures in SG tests

- Fix gofmt alignment in sgCapture struct
- Fix QF1008: remove redundant embedded Auth field from selector
- Fix TestInstancesUseRoleSpecificSGs: test SG selection logic directly
  instead of calling createInstances (which requires waiter mock setup)
- Add Calico Typha (port 5473) assertion to Worker SG test (DE R2)

Signed-off-by: Eduardo Aguilar <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

---------

Signed-off-by: Eduardo Arango <earango@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Eduardo Aguilar <eduardoa@nvidia.com>

204 of 240 new or added lines in 1 file covered. (85.0%)

3473 of 6461 relevant lines covered (53.75%)

0.6 hits per line