oxidecomputer / oxidecomputer/oxide-cloud-controller-manager
Stop silently ignoring spec.loadBalancerSourceRanges
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 6
- Forks
- 2
- Avg merge
- 2h 5m
- Merged PRs (30d)
- 14
Description
Context
Users set spec.loadBalancerSourceRanges expecting traffic restriction. The CCM ignores it entirely — a security surprise: the user believes their service is firewalled when it isn't.
Scope
Short term: reject services that set this field, mirroring the existing externalTrafficPolicy check at the top of EnsureLoadBalancer (internal/provider/load_balancer.go).
Long term (file separately if pursued): map source ranges to VPC firewall rules.
Done when
A service setting loadBalancerSourceRanges gets a clear error event instead of silent non-enforcement.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in internal/provider/load_balancer.go at the top of EnsureLoadBalancer, where the existing externalTrafficPolicy check is handled. Follow that pattern for services setting spec.loadBalancerSourceRanges, then run the relevant provider tests and verify that the service receives a clear error event instead of silent non-enforcement.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- backend, cloud
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100