k8s.io/kubernetes@v1.29.3/pkg/api/service/util.go (about)

     1  /*
     2  Copyright 2016 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package service
    18  
    19  import (
    20  	"fmt"
    21  	"strings"
    22  
    23  	api "k8s.io/kubernetes/pkg/apis/core"
    24  	utilnet "k8s.io/utils/net"
    25  )
    26  
    27  const (
    28  	defaultLoadBalancerSourceRanges = "0.0.0.0/0"
    29  )
    30  
    31  // IsAllowAll checks whether the utilnet.IPNet allows traffic from 0.0.0.0/0
    32  func IsAllowAll(ipnets utilnet.IPNetSet) bool {
    33  	for _, s := range ipnets.StringSlice() {
    34  		if s == "0.0.0.0/0" {
    35  			return true
    36  		}
    37  	}
    38  	return false
    39  }
    40  
    41  // GetLoadBalancerSourceRanges first try to parse and verify LoadBalancerSourceRanges field from a service.
    42  // If the field is not specified, turn to parse and verify the AnnotationLoadBalancerSourceRangesKey annotation from a service,
    43  // extracting the source ranges to allow, and if not present returns a default (allow-all) value.
    44  func GetLoadBalancerSourceRanges(service *api.Service) (utilnet.IPNetSet, error) {
    45  	var ipnets utilnet.IPNetSet
    46  	var err error
    47  	// if SourceRange field is specified, ignore sourceRange annotation
    48  	if len(service.Spec.LoadBalancerSourceRanges) > 0 {
    49  		specs := service.Spec.LoadBalancerSourceRanges
    50  		ipnets, err = utilnet.ParseIPNets(specs...)
    51  
    52  		if err != nil {
    53  			return nil, fmt.Errorf("service.Spec.LoadBalancerSourceRanges: %v is not valid. Expecting a list of IP ranges. For example, 10.0.0.0/24. Error msg: %v", specs, err)
    54  		}
    55  	} else {
    56  		val := service.Annotations[api.AnnotationLoadBalancerSourceRangesKey]
    57  		val = strings.TrimSpace(val)
    58  		if val == "" {
    59  			val = defaultLoadBalancerSourceRanges
    60  		}
    61  		specs := strings.Split(val, ",")
    62  		ipnets, err = utilnet.ParseIPNets(specs...)
    63  		if err != nil {
    64  			return nil, fmt.Errorf("%s: %s is not valid. Expecting a comma-separated list of source IP ranges. For example, 10.0.0.0/24,192.168.2.0/24", api.AnnotationLoadBalancerSourceRangesKey, val)
    65  		}
    66  	}
    67  	return ipnets, nil
    68  }
    69  
    70  // ExternallyAccessible checks if service is externally accessible.
    71  func ExternallyAccessible(service *api.Service) bool {
    72  	return service.Spec.Type == api.ServiceTypeLoadBalancer ||
    73  		service.Spec.Type == api.ServiceTypeNodePort ||
    74  		(service.Spec.Type == api.ServiceTypeClusterIP && len(service.Spec.ExternalIPs) > 0)
    75  }
    76  
    77  // RequestsOnlyLocalTraffic checks if service requests OnlyLocal traffic.
    78  func RequestsOnlyLocalTraffic(service *api.Service) bool {
    79  	if service.Spec.Type != api.ServiceTypeLoadBalancer &&
    80  		service.Spec.Type != api.ServiceTypeNodePort {
    81  		return false
    82  	}
    83  
    84  	return service.Spec.ExternalTrafficPolicy == api.ServiceExternalTrafficPolicyLocal
    85  }
    86  
    87  // NeedsHealthCheck checks if service needs health check.
    88  func NeedsHealthCheck(service *api.Service) bool {
    89  	if service.Spec.Type != api.ServiceTypeLoadBalancer {
    90  		return false
    91  	}
    92  	return RequestsOnlyLocalTraffic(service)
    93  }