@@ -19,6 +19,7 @@ package scaleway
1919import (
2020 "context"
2121 "fmt"
22+ "math"
2223 "os"
2324 "strconv"
2425 "strings"
@@ -153,6 +154,8 @@ const (
153154 serviceAnnotationLoadBalancerCertificateIDs = "service.beta.kubernetes.io/scw-loadbalancer-certificate-ids"
154155)
155156
157+ const MaxEntriesPerACL = 60
158+
156159type loadbalancers struct {
157160 api LoadBalancerAPI
158161 client * client // for patcher
@@ -180,6 +183,7 @@ type LoadBalancerAPI interface {
180183 CreateACL (req * scwlb.ZonedAPICreateACLRequest , opts ... scw.RequestOption ) (* scwlb.ACL , error )
181184 DeleteACL (req * scwlb.ZonedAPIDeleteACLRequest , opts ... scw.RequestOption ) error
182185 UpdateACL (req * scwlb.ZonedAPIUpdateACLRequest , opts ... scw.RequestOption ) (* scwlb.ACL , error )
186+ SetACLs (req * scwlb.ZonedAPISetACLsRequest , opts ... scw.RequestOption ) (* scwlb.SetACLsResponse , error )
183187}
184188
185189func newLoadbalancers (client * client , defaultLBType string ) * loadbalancers {
@@ -771,48 +775,50 @@ func (l *loadbalancers) updateLoadBalancer(ctx context.Context, loadbalancer *sc
771775 aclIPs := extractNodesInternalIps (nodes )
772776 aclIPs = append (aclIPs , extractNodesExternalIps (nodes )... )
773777 aclIPs = append (aclIPs , service .Spec .LoadBalancerSourceRanges ... )
774- aclIPsPtr := make ([]* string , len (aclIPs ))
778+ aclIPsPtr := []* string {}
779+ newAcls := []* scwlb.ACLSpec {}
780+
781+ // Loop through all addresses and make sure to split ACLs every MaxEntriesPerACL.
775782 for i := range aclIPs {
776- aclIPsPtr [i ] = & aclIPs [i ]
783+ if i != 0 && i % MaxEntriesPerACL == 0 {
784+ aclIndex := int32 ((i / MaxEntriesPerACL ) - 1 )
785+ newAcls = append (newAcls , & scwlb.ACLSpec {
786+ Name : fmt .Sprintf ("%v-%d" , aclName , aclIndex ),
787+ Action : & scwlb.ACLAction {
788+ Type : scwlb .ACLActionTypeAllow ,
789+ },
790+ Index : aclIndex ,
791+ Match : & scwlb.ACLMatch {
792+ IPSubnet : aclIPsPtr ,
793+ },
794+ })
795+
796+ aclIPsPtr = []* string {}
797+ }
798+ aclIPsPtr = append (aclIPsPtr , & aclIPs [i ])
777799 }
778800
779- if len (acls .ACLs ) != 1 {
780- _ , err := l .api .CreateACL (& scwlb.ZonedAPICreateACLRequest {
781- Zone : loadbalancer .Zone ,
782- FrontendID : frontendID ,
783- Name : aclName ,
784- Action : & scwlb.ACLAction {
785- Type : scwlb .ACLActionTypeDeny ,
786- },
787- Index : 0 ,
788- Match : & scwlb.ACLMatch {
789- IPSubnet : aclIPsPtr ,
790- Invert : true ,
791- },
792- })
793- if err != nil {
794- return err
795- }
796- } else if len (acls .ACLs ) == 1 {
797- _ , err := l .api .UpdateACL (& scwlb.ZonedAPIUpdateACLRequest {
798- Zone : loadbalancer .Zone ,
799- ACLID : acls .ACLs [0 ].ID ,
800- Action : & scwlb.ACLAction {
801- Type : scwlb .ACLActionTypeDeny ,
802- },
803- Index : 0 ,
804- Match : & scwlb.ACLMatch {
805- Invert : true ,
806- IPSubnet : aclIPsPtr ,
807- },
808- Name : aclName ,
809- })
810- if err != nil {
811- return err
812- }
801+ // Add last ACL with remaining addresses.
802+ newAcls = append (newAcls , & scwlb.ACLSpec {
803+ Name : aclName + "-end" ,
804+ Action : & scwlb.ACLAction {
805+ Type : scwlb .ACLActionTypeDeny ,
806+ },
807+ Index : math .MaxInt32 ,
808+ Match : & scwlb.ACLMatch {
809+ IPSubnet : aclIPsPtr ,
810+ Invert : true ,
811+ },
812+ })
813813
814+ _ , err := l .api .SetACLs (& scwlb.ZonedAPISetACLsRequest {
815+ Zone : loadbalancer .Zone ,
816+ FrontendID : frontendID ,
817+ ACLs : newAcls ,
818+ })
819+ if err != nil {
820+ return err
814821 }
815-
816822 }
817823 }
818824
0 commit comments