From 060b8d11bb30a67277b184b73188ecd64dc21e1c Mon Sep 17 00:00:00 2001 From: Wanxian Yang <79273084+Lou1415926@users.noreply.github.com> Date: Wed, 26 Jan 2022 12:22:07 -0600 Subject: [PATCH] chore: remove udp and tcp_udp for LBWS (#3224) By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the Apache 2.0 License. --- internal/pkg/cli/svc_deploy_test.go | 2 +- .../deploy/cloudformation/stack/transformers.go | 2 +- internal/pkg/manifest/validate.go | 10 ++++------ internal/pkg/manifest/validate_test.go | 10 ++++++---- .../templates/workloads/partials/cf/nlb.yml | 15 --------------- 5 files changed, 12 insertions(+), 27 deletions(-) diff --git a/internal/pkg/cli/svc_deploy_test.go b/internal/pkg/cli/svc_deploy_test.go index 5fc72f510db..ca7d07d439f 100644 --- a/internal/pkg/cli/svc_deploy_test.go +++ b/internal/pkg/cli/svc_deploy_test.go @@ -645,7 +645,7 @@ func TestSvcDeployOpts_deploySvc(t *testing.T) { "fail to get public CIDR blocks": { inBuildRequire: false, inNLB: manifest.NetworkLoadBalancerConfiguration{ - Port: aws.String("443/udp"), + Port: aws.String("443/tls"), }, inEnvironment: &config.Environment{ Name: mockEnvName, diff --git a/internal/pkg/deploy/cloudformation/stack/transformers.go b/internal/pkg/deploy/cloudformation/stack/transformers.go index 165e4e394e8..ef9ec053582 100644 --- a/internal/pkg/deploy/cloudformation/stack/transformers.go +++ b/internal/pkg/deploy/cloudformation/stack/transformers.go @@ -34,7 +34,7 @@ const ( defaultIAM = disabled defaultReadOnly = true defaultWritePermission = false - defaultNLBProtocol = manifest.TCPUDP + defaultNLBProtocol = manifest.TCP ) // Supported capacityproviders for Fargate services diff --git a/internal/pkg/manifest/validate.go b/internal/pkg/manifest/validate.go index f300c961df0..60b8a357256 100644 --- a/internal/pkg/manifest/validate.go +++ b/internal/pkg/manifest/validate.go @@ -33,13 +33,11 @@ const ( ) const ( - TCPUDP = "TCP_UDP" - tcp = "TCP" - udp = "UDP" - tls = "TLS" + TCP = "TCP" + tls = "TLS" ) -var validProtocols = []string{TCPUDP, tcp, udp, tls} +var validProtocols = []string{TCP, tls} var ( intRangeBandRegexp = regexp.MustCompile(`^(\d+)-(\d+)$`) @@ -671,7 +669,7 @@ func validateNLBPort(port *string) error { } } if !isValidProtocol { - return fmt.Errorf(`unrecognized protocol %s`, protocolVal) + return fmt.Errorf(`invalid protocol %s; valid protocols include %s`, protocolVal, english.WordSeries(validProtocols, "and")) } return nil } diff --git a/internal/pkg/manifest/validate_test.go b/internal/pkg/manifest/validate_test.go index c45de384981..8b6c934dff5 100644 --- a/internal/pkg/manifest/validate_test.go +++ b/internal/pkg/manifest/validate_test.go @@ -1102,32 +1102,34 @@ func TestNetworkLoadBalancerConfiguration_Validate(t *testing.T) { Port: aws.String("443"), }, }, - "error if protocol is not recognized": { + "fail if protocol is not recognized": { nlb: NetworkLoadBalancerConfiguration{ Port: aws.String("443/tps"), }, wantedErrorMsgPrefix: `validate "nlb": `, - wantedError: fmt.Errorf(`validate "port": unrecognized protocol tps`), + wantedError: fmt.Errorf(`validate "port": invalid protocol tps; valid protocols include TCP and TLS`), }, "success if tcp": { nlb: NetworkLoadBalancerConfiguration{ Port: aws.String("443/tcp"), }, }, - "success if udp": { + "error if udp": { nlb: NetworkLoadBalancerConfiguration{ Port: aws.String("161/udp"), }, + wantedError: fmt.Errorf(`validate "port": invalid protocol udp; valid protocols include TCP and TLS`), }, "success if tls": { nlb: NetworkLoadBalancerConfiguration{ Port: aws.String("443/tls"), }, }, - "success if tcp_udp": { + "error if tcp_udp": { nlb: NetworkLoadBalancerConfiguration{ Port: aws.String("443/TCP_udp"), }, + wantedError: fmt.Errorf(`validate "port": invalid protocol TCP_udp; valid protocols include TCP and TLS`), }, } diff --git a/internal/pkg/template/templates/workloads/partials/cf/nlb.yml b/internal/pkg/template/templates/workloads/partials/cf/nlb.yml index 3bd472978b5..7a5aed9aed6 100644 --- a/internal/pkg/template/templates/workloads/partials/cf/nlb.yml +++ b/internal/pkg/template/templates/workloads/partials/cf/nlb.yml @@ -57,8 +57,6 @@ NLBTargetGroup: Value: {{ .NLB.Listener.Stickiness }} {{- end}} {{- end}} - - Key: deregistration_delay.connection_termination.enabled {{/* It is recommended to have this enabled for UDP and TCP_UDP target groups */}} - Value: {{- if or (eq $.NLB.Listener.Protocol "UDP") (eq $.NLB.Listener.Protocol "TCP_UDP") }} true {{- else}} false {{- end}} TargetType: ip VpcId: Fn::ImportValue: @@ -72,24 +70,11 @@ NLBSecurityGroup: GroupDescription: Allow access from the network load balancer to service SecurityGroupIngress: {{range $cidr := .NLB.PublicSubnetCIDRs}} - {{- if eq $.NLB.Listener.Protocol "TCP_UDP" }} - - CidrIp: {{$cidr}} - Description: Ingress to allow access from Network Load Balancer subnet - FromPort: {{ $.NLB.Listener.TargetPort }} - IpProtocol: TCP - ToPort: {{ $.NLB.Listener.TargetPort }} - - CidrIp: {{$cidr}} - Description: Ingress to allow access from Network Load Balancer subnet - FromPort: {{ $.NLB.Listener.TargetPort }} - IpProtocol: UDP - ToPort: {{ $.NLB.Listener.TargetPort }} - {{- else }} - CidrIp: {{$cidr}} Description: Ingress to allow access from Network Load Balancer subnet FromPort: {{ $.NLB.Listener.TargetPort }} IpProtocol: {{- if eq $.NLB.Listener.Protocol "TLS" }} TCP {{- else }} {{ $.NLB.Listener.Protocol }} {{- end}} ToPort: {{ $.NLB.Listener.TargetPort }} - {{- end }} {{- if $.NLB.Listener.HealthCheck.Port}}{{- if ne $.NLB.Listener.HealthCheck.Port $.NLB.Listener.Port}} - CidrIp: {{$cidr}} Description: Ingress to allow access from Network Load Balancer subnet for health check