@spinnaker/amazon 0.0.0-2025.1-0

package/src/securityGroup/configure/ingressRuleGroupSelector.component.html

@@ -0,0 +1,77 @@
+<span class="form-control-static" ng-if="$ctrl.rule.existing">
+  <account-tag
+    account="$ctrl.rule.accountName"
+    ng-if="$ctrl.rule.accountName !== $ctrl.securityGroup.accountName"
+  ></account-tag>
+  {{ $ctrl.rule.name || $ctrl.rule.id }}
+</span>
+
+<div ng-if="$ctrl.rule.crossAccountEnabled && $ctrl.securityGroup.regions.length === 1" class="cross-account-select">
+  <div class="row">
+    <div class="col-md-3"><span class="small">Account</span></div>
+    <div class="col-md-9">
+      <account-select-field
+        component="$ctrl.rule"
+        field="accountName"
+        accounts="$ctrl.crossAccountAccounts"
+        provider="'aws'"
+        on-change="$ctrl.setAvailableSecurityGroups()"
+      ></account-select-field>
+    </div>
+  </div>
+  <div class="row" ng-if="$ctrl.securityGroup.vpcId">
+    <div class="col-md-3"><span class="small">VPC</span></div>
+    <div class="col-md-9">
+      <select class="form-control input-sm" ng-model="$ctrl.rule.vpcId" ng-change="$ctrl.setAvailableSecurityGroups()">
+        <option
+          ng-repeat="vpc in $ctrl.regionalVpcs[$ctrl.rule.accountName]"
+          value="{{ vpc.id }}"
+          ng-selected="$ctrl.rule.vpcId === vpc.id"
+        >
+          {{ vpc.label }}
+        </option>
+      </select>
+    </div>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-md-3">
+    <span class="small" ng-if="$ctrl.rule.crossAccountEnabled">Group</span>
+  </div>
+  <div class="col-md-{{ $ctrl.rule.crossAccountEnabled ? 9 : 12 }}">
+    <ui-select
+      ng-if="!$ctrl.rule.existing"
+      ng-model="$ctrl.rule.name"
+      uis-open-close="$ctrl.resetCurrentItems()"
+      class="form-control input-sm"
+      required
+      style="width: 100%"
+    >
+      <ui-select-match>{{ $select.selected }}</ui-select-match>
+      <ui-select-choices
+        repeat="securityGroup as securityGroup in $ctrl.availableSecurityGroups | filter: $select.search | limitTo: $ctrl.infiniteScroll.currentItems"
+        infinite-scroll="$ctrl.addMoreItems()"
+        infinite-scroll-distance="4"
+      >
+        <span ng-bind-html="securityGroup | highlight: $select.search"></span>
+      </ui-select-choices>
+    </ui-select>
+  </div>
+</div>
+
+<a
+  href
+  class="small"
+  ng-if="!$ctrl.rule.existing && $ctrl.securityGroup.regions.length === 1 && !$ctrl.rule.crossAccountEnabled"
+  ng-click="$ctrl.enableCrossAccount($index)"
+>
+  Select from a different account <span ng-if="$ctrl.securityGroup.vpcId">or VPC</span>
+</a>
+
+<div ng-if="$ctrl.crossAccountAccounts && $ctrl.crossAccountAccounts.length !== $ctrl.accounts.length">
+  <help-field key="aws.securityGroup.cross.account.ingress.help" expand="true"></help-field>
+</div>
+<span ng-if="$ctrl.securityGroup.regions.length > 1" class="small">
+  Cross-account rules disabled when 2+ regions selected
+</span>

package/src/securityGroup/configure/ingressRuleGroupSelector.component.less

@@ -0,0 +1,6 @@
+ingress-rule-group-selector {
+  .col-md-3 {
+    padding-right: 0;
+    font-weight: 600;
+  }
+}

package/src/securityGroup/configure/ingressRuleGroupSelector.component.ts

@@ -0,0 +1,190 @@
+import type { IComponentOptions, IController } from 'angular';
+import { module } from 'angular';
+import { intersection, uniq } from 'lodash';
+import type { Subject, Subscription } from 'rxjs';
+
+import type {
+  IAccountDetails,
+  ISecurityGroup,
+  ISecurityGroupRule,
+  ISecurityGroupsByAccountSourceData,
+  IVpc,
+} from '@spinnaker/core';
+import { AWSProviderSettings } from '../../aws.settings';
+
+interface IInfiniteScroll {
+  currentItems: number;
+}
+
+interface IRuleCommand extends ISecurityGroupRule {
+  crossAccountEnabled?: boolean;
+  accountName?: string;
+  vpcId?: string;
+  existing: boolean;
+  name: string;
+}
+
+interface ISecurityGroupCommand extends ISecurityGroup {
+  regions: string[];
+  credentials: string;
+}
+
+class IngressRuleSelectorController implements IController {
+  public rule: IRuleCommand;
+  public securityGroup: ISecurityGroupCommand;
+  public accounts: IAccountDetails[];
+  public crossAccountAccounts: IAccountDetails[];
+  public vpcs: IVpc[];
+  public regionalVpcs: { [region: string]: IVpc[] };
+  public allSecurityGroups: ISecurityGroupsByAccountSourceData;
+  public coordinatesChanged: Subject<void>;
+  public allSecurityGroupsUpdated: Subject<void>;
+  public availableSecurityGroups: string[];
+  public coordinatesChangedListener: Subscription;
+  public securityGroupsUpdatedListener: Subscription;
+
+  public infiniteScroll: IInfiniteScroll = {
+    currentItems: 20,
+  };
+
+  public addMoreItems(): void {
+    this.infiniteScroll.currentItems += 20;
+  }
+
+  public resetCurrentItems(): void {
+    this.infiniteScroll.currentItems = 20;
+  }
+
+  public addRegionalVpc(vpc: IVpc): void {
+    const account = vpc.account;
+    if (!this.regionalVpcs[account]) {
+      this.regionalVpcs[account] = [];
+    }
+    this.regionalVpcs[account].push({
+      name: vpc.name,
+      region: vpc.region,
+      account,
+      id: vpc.id,
+      label: vpc.label,
+      deprecated: vpc.deprecated,
+      cloudProvider: vpc.cloudProvider,
+    });
+  }
+
+  public enableCrossAccount(): void {
+    this.rule.crossAccountEnabled = true;
+    this.crossAccountAccounts = this.accounts;
+    const exclusions = AWSProviderSettings?.crossAccountIngressExclusions[this.securityGroup.credentials];
+    if (exclusions && Array.isArray(exclusions)) {
+      this.crossAccountAccounts = this.accounts.filter((account) => !exclusions.includes(account.name));
+    }
+    this.rule.accountName = this.securityGroup.credentials;
+    this.rule.vpcId = this.securityGroup.vpcId;
+  }
+
+  public disableCrossAccount(): void {
+    this.rule.crossAccountEnabled = false;
+    this.rule.accountName = undefined;
+    this.rule.vpcId = undefined;
+  }
+
+  public $onInit(): void {
+    this.setAvailableSecurityGroups();
+    this.coordinatesChangedListener = this.coordinatesChanged.subscribe(() => this.setAvailableSecurityGroups());
+    this.securityGroupsUpdatedListener = this.allSecurityGroupsUpdated.subscribe(() =>
+      this.setAvailableSecurityGroups(),
+    );
+  }
+
+  public $onDestroy() {
+    this.coordinatesChangedListener.unsubscribe();
+    this.securityGroupsUpdatedListener.unsubscribe();
+  }
+
+  public setAvailableSecurityGroups(): void {
+    const account = this.rule.accountName || this.securityGroup.credentials;
+    const regions = this.securityGroup.regions;
+    const vpcId = this.rule.vpcId || this.securityGroup.vpcId || null;
+
+    let existingSecurityGroupNames: string[] = [];
+    let availableSecurityGroups: string[] = [];
+
+    if (regions.length > 1) {
+      this.disableCrossAccount();
+    }
+
+    regions.forEach((region) => {
+      let regionalVpcId: string = null;
+      if (vpcId) {
+        const baseVpc: IVpc = this.vpcs.find((vpc) => vpc.id === vpcId);
+        const regionalVpc: IVpc = this.vpcs.find(
+          (vpc) => vpc.account === account && vpc.region === region && vpc.name === baseVpc.name,
+        );
+        regionalVpcId = regionalVpc ? regionalVpc.id : undefined;
+      }
+
+      const regionalGroupNames = (this.allSecurityGroups?.[account]?.aws?.[region] ?? [])
+        .filter((sg) => sg.vpcId === regionalVpcId)
+        .map((sg) => sg.name);
+
+      existingSecurityGroupNames = uniq(existingSecurityGroupNames.concat(regionalGroupNames));
+
+      if (!availableSecurityGroups.length) {
+        availableSecurityGroups = existingSecurityGroupNames;
+      } else {
+        availableSecurityGroups = intersection(availableSecurityGroups, regionalGroupNames);
+      }
+    });
+    if (regions.length === 1) {
+      this.configureAvailableVpcs();
+    }
+    this.availableSecurityGroups = availableSecurityGroups;
+    if (!availableSecurityGroups.includes(this.rule.name) && !this.rule.existing) {
+      this.rule.name = null;
+    }
+  }
+
+  public configureAvailableVpcs(): void {
+    const region = this.securityGroup.regions[0];
+    const filtered = this.vpcs.filter((vpc) => vpc.region === region);
+    this.regionalVpcs = {};
+    filtered.forEach((vpc) => this.addRegionalVpc(vpc));
+    this.reconcileRuleVpc(filtered);
+  }
+
+  private reconcileRuleVpc(filtered: IVpc[]): void {
+    if (this.rule.vpcId && !this.rule.existing) {
+      if (!this.securityGroup.vpcId) {
+        this.rule.vpcId = null;
+        this.rule.name = null;
+        return;
+      }
+      const baseVpc = filtered.find((vpc) => vpc.id === this.rule.vpcId);
+      const regionalVpc = filtered.find((vpc) => vpc.account === this.rule.accountName && vpc.name === baseVpc.name);
+      if (regionalVpc) {
+        this.rule.vpcId = regionalVpc.id;
+      } else {
+        this.rule.vpcId = null;
+        this.rule.name = null;
+      }
+    }
+  }
+}
+
+const ingressRuleSelector: IComponentOptions = {
+  bindings: {
+    rule: '=',
+    securityGroup: '=',
+    accounts: '=',
+    vpcs: '=',
+    allSecurityGroups: '=',
+    coordinatesChanged: '=',
+    allSecurityGroupsUpdated: '=',
+  },
+  templateUrl: require('./ingressRuleGroupSelector.component.html'),
+  controller: IngressRuleSelectorController,
+};
+
+export const INGRESS_RULE_GROUP_SELECTOR_COMPONENT =
+  'spinnaker.amazon.securityGroup.configure.ingressRuleGroupSelector';
+module(INGRESS_RULE_GROUP_SELECTOR_COMPONENT, []).component('ingressRuleGroupSelector', ingressRuleSelector);

package/src/securityGroup/configure/securityGroupDetailsCustom.component.ts

@@ -0,0 +1,16 @@
+import { module } from 'angular';
+import { react2angular } from 'react2angular';
+
+import { withErrorBoundary } from '@spinnaker/core';
+
+import { SecurityGroupDetailsCustom } from './securityGroupDetailsCustom';
+
+export const AWS_SECURITY_GROUP_DETAILS_CUSTOM = 'spinnaker.amazon.securityGroups.details.custom.component';
+module(AWS_SECURITY_GROUP_DETAILS_CUSTOM, []).component(
+  'securityGroupDetailsCustom',
+  react2angular(withErrorBoundary(SecurityGroupDetailsCustom, 'securityGroupDetailsCustom'), [
+    'securityGroupDetails',
+    'ctrl',
+    'scope',
+  ]),
+);

package/src/securityGroup/configure/securityGroupDetailsCustom.tsx

@@ -0,0 +1,16 @@
+import React from 'react';
+import { Overridable } from '@spinnaker/core';
+import type { ISecurityGroupDetail } from '@spinnaker/core';
+
+export interface IAdditionalIpRulesProps {
+  securityGroupDetails: ISecurityGroupDetail;
+  ctrl: any;
+  scope: any;
+}
+
+@Overridable('aws.securityGroup.details.custom')
+export class SecurityGroupDetailsCustom extends React.Component<IAdditionalIpRulesProps> {
+  public render(): any {
+    return null;
+  }
+}

package/src/securityGroup/details/IPRangeRules.tsx

@@ -0,0 +1,56 @@
+import React from 'react';
+
+import { CollapsibleSection, LabeledValue, LabeledValueList, Overridable } from '@spinnaker/core';
+
+export interface IIPRangeRulesProps {
+  ipRules: IIPRangeRulesDetails[];
+}
+export interface IIPRangeRulesDetails {
+  rules: IRangeRule[];
+  address: string;
+}
+
+export interface IRangeRule {
+  startPort: number;
+  endPort: number;
+  protocol: string;
+  description: string;
+}
+
+@Overridable('aws.securityGroup.ip.rules')
+export class IPRangeRules extends React.Component<IIPRangeRulesProps> {
+  public render() {
+    const ipRules = this.props.ipRules || [];
+    const heading = `IP Range Rules (${ipRules.length})`;
+    return (
+      <CollapsibleSection heading={heading}>
+        {ipRules.map((rule) => (
+          <LabeledValueList className="horizontal-when-filters-collapsed">
+            <LabeledValue label="IP Range" value={rule.address} />
+            <LabeledValue
+              label="Port Ranges"
+              value={rule.rules.map((r) =>
+                r.protocol === '-1' ? (
+                  <span>
+                    All ports and protocols
+                    {rule.rules.length > 1 ? (
+                      <div>
+                        <em>Additional port ranges are specified, but redundant:</em>
+                      </div>
+                    ) : null}
+                  </span>
+                ) : (
+                  <div>
+                    <span>
+                      {r.protocol}:{r.startPort} &rarr; {r.endPort}
+                    </span>
+                  </div>
+                ),
+              )}
+            />
+          </LabeledValueList>
+        ))}
+      </CollapsibleSection>
+    );
+  }
+}

package/src/securityGroup/details/index.ts

@@ -0,0 +1 @@
+export * from './IPRangeRules';

package/src/securityGroup/details/securityGroupDetail.controller.js

@@ -0,0 +1,249 @@
+'use strict';
+
+import UIROUTER_ANGULARJS from '@uirouter/angularjs';
+import * as angular from 'angular';
+import _ from 'lodash';
+
+import {
+  CloudProviderRegistry,
+  ConfirmationModalService,
+  confirmNotManaged,
+  FirewallLabels,
+  MANAGED_RESOURCE_DETAILS_INDICATOR,
+  noop,
+  RecentHistoryService,
+  SECURITY_GROUP_READER,
+  SecurityGroupWriter,
+  SETTINGS,
+} from '@spinnaker/core';
+
+import { AWSProviderSettings } from '../../aws.settings';
+import { AMAZON_SECURITYGROUP_CLONE_CLONESECURITYGROUP_CONTROLLER } from '../clone/cloneSecurityGroup.controller';
+import { VpcReader } from '../../vpc/VpcReader';
+
+export const AMAZON_SECURITYGROUP_DETAILS_SECURITYGROUPDETAIL_CONTROLLER =
+  'spinnaker.amazon.securityGroup.details.controller';
+export const name = AMAZON_SECURITYGROUP_DETAILS_SECURITYGROUPDETAIL_CONTROLLER; // for backwards compatibility
+angular
+  .module(AMAZON_SECURITYGROUP_DETAILS_SECURITYGROUPDETAIL_CONTROLLER, [
+    UIROUTER_ANGULARJS,
+    SECURITY_GROUP_READER,
+    AMAZON_SECURITYGROUP_CLONE_CLONESECURITYGROUP_CONTROLLER,
+    MANAGED_RESOURCE_DETAILS_INDICATOR,
+  ])
+  .controller('awsSecurityGroupDetailsCtrl', [
+    '$scope',
+    '$state',
+    'resolvedSecurityGroup',
+    'app',
+    'securityGroupReader',
+    '$uibModal',
+    function ($scope, $state, resolvedSecurityGroup, app, securityGroupReader, $uibModal) {
+      this.application = app;
+      const application = app;
+      const securityGroup = resolvedSecurityGroup;
+      this.firewallLabel = FirewallLabels.get('Firewall');
+
+      // needed for standalone instances
+      $scope.detailsTemplateUrl = CloudProviderRegistry.getValue('aws', 'securityGroup.detailsTemplateUrl');
+
+      $scope.isDisabled = !AWSProviderSettings.adHocInfraWritesEnabled;
+
+      $scope.state = {
+        loading: true,
+        standalone: app.isStandalone,
+      };
+
+      function extractSecurityGroup() {
+        return securityGroupReader
+          .getSecurityGroupDetails(
+            application,
+            securityGroup.accountId,
+            securityGroup.provider,
+            securityGroup.region,
+            securityGroup.vpcId,
+            securityGroup.name,
+          )
+          .then(function (details) {
+            return VpcReader.getVpcName(details.vpcId).then((name) => {
+              details.vpcName = name;
+              return details;
+            });
+          })
+          .then(function (details) {
+            $scope.state.loading = false;
+
+            if (!details || _.isEmpty(details)) {
+              fourOhFour();
+            } else {
+              const applicationSecurityGroup = securityGroupReader.getApplicationSecurityGroup(
+                application,
+                securityGroup.accountId,
+                securityGroup.region,
+                securityGroup.name,
+              );
+
+              angular.extend(securityGroup, applicationSecurityGroup, details);
+              $scope.securityGroup = securityGroup;
+              $scope.ipRules = buildIpRulesModel(securityGroup);
+              $scope.securityGroupRules = buildSecurityGroupRulesModel(securityGroup);
+            }
+          }, fourOhFour);
+      }
+
+      function buildIpRulesModel(details) {
+        const groupedRangeRules = _.groupBy(details.ipRangeRules, (rule) => rule.range.ip + rule.range.cidr);
+        return Object.keys(groupedRangeRules)
+          .map((addr) => {
+            return {
+              address: addr,
+              rules: buildRuleModel(groupedRangeRules, addr),
+            };
+          })
+          .filter((rule) => rule.rules.length);
+      }
+
+      function buildSecurityGroupRulesModel(details) {
+        const groupedRangeRules = _.groupBy(details.securityGroupRules, (rule) => rule.securityGroup.id);
+        return Object.keys(groupedRangeRules)
+          .map((addr) => {
+            return {
+              securityGroup: groupedRangeRules[addr][0].securityGroup,
+              rules: buildRuleModel(groupedRangeRules, addr),
+            };
+          })
+          .filter((rule) => rule.rules.length);
+      }
+
+      function buildRuleModel(groupedRangeRules, addr) {
+        const rules = [];
+        groupedRangeRules[addr].forEach((rule) => {
+          (rule.portRanges || []).forEach((range) => {
+            if (rule.protocol === '-1' || (range.startPort !== undefined && range.endPort !== undefined)) {
+              rules.push({
+                startPort: range.startPort,
+                endPort: range.endPort,
+                protocol: rule.protocol,
+                description: rule.description,
+              });
+            }
+          });
+        });
+        return rules;
+      }
+
+      function fourOhFour() {
+        if ($scope.$$destroyed) {
+          return;
+        }
+        if (app.isStandalone) {
+          $scope.group = securityGroup.name;
+          $scope.state.notFound = true;
+          $scope.state.loading = false;
+          RecentHistoryService.removeLastItem('securityGroups');
+        } else {
+          $state.go('^', { allowModalToStayOpen: true }, { location: 'replace' });
+        }
+      }
+
+      extractSecurityGroup().then(() => {
+        // If the user navigates away from the view before the initial extractSecurityGroup call completes,
+        // do not bother subscribing to the refresh
+        if (!$scope.$$destroyed && !app.isStandalone) {
+          app.securityGroups.onRefresh($scope, extractSecurityGroup);
+        }
+      });
+
+      function checkManagement() {
+        return confirmNotManaged($scope.securityGroup, application);
+      }
+
+      this.editInboundRules = function editInboundRules() {
+        confirmNotManaged($scope.securityGroup, application).then((notManaged) => {
+          // Wait for the MD confirmation modal to go away first to avoid react/angular bootstrap fighting over the body.modal-open class
+          return new Promise((resolve) => setTimeout(resolve, 500)).then(() => {
+            if (notManaged) {
+              $uibModal.open({
+                templateUrl: require('../configure/editSecurityGroup.html'),
+                controller: 'awsEditSecurityGroupCtrl as ctrl',
+                size: 'lg',
+                resolve: {
+                  securityGroup: function () {
+                    return angular.copy($scope.securityGroup);
+                  },
+                  application: function () {
+                    return application;
+                  },
+                },
+              });
+            }
+          });
+        });
+      };
+
+      this.cloneSecurityGroup = function cloneSecurityGroup() {
+        $uibModal.open({
+          templateUrl: require('../clone/cloneSecurityGroup.html'),
+          controller: 'awsCloneSecurityGroupController as ctrl',
+          size: 'lg',
+          resolve: {
+            securityGroup: function () {
+              const securityGroup = angular.copy($scope.securityGroup);
+              if (securityGroup.region) {
+                securityGroup.regions = [securityGroup.region];
+              }
+              return securityGroup;
+            },
+            application: function () {
+              return application;
+            },
+          },
+        });
+      };
+
+      this.deleteSecurityGroup = function deleteSecurityGroup() {
+        let isRetry = false;
+        const retryParams = { removeDependencies: true };
+
+        const taskMonitor = {
+          application: application,
+          title: 'Deleting ' + securityGroup.name,
+          onTaskRetry: () => {
+            isRetry = true;
+          },
+        };
+
+        const submitMethod = () => {
+          const params = {
+            cloudProvider: securityGroup.provider,
+            vpcId: securityGroup.vpcId,
+          };
+          if (isRetry) {
+            Object.assign(params, retryParams);
+          }
+          return SecurityGroupWriter.deleteSecurityGroup(securityGroup, application, params);
+        };
+
+        confirmNotManaged($scope.securityGroup, application).then((notManaged) => {
+          notManaged &&
+            ConfirmationModalService.confirm({
+              header: 'Really delete ' + securityGroup.name + '?',
+              buttonText: 'Delete ' + securityGroup.name,
+              account: securityGroup.accountId,
+              taskMonitorConfig: taskMonitor,
+              submitMethod: submitMethod,
+              retryBody: `<div><p>Retry deleting the ${FirewallLabels.get(
+                'firewall',
+              )} and revoke any dependent ingress rules?</p><p>Any instance or load balancer associations will have to removed manually.</p></div>`,
+            });
+        });
+      };
+
+      if (app.isStandalone) {
+        // we still want the edit to refresh the firewall details when the modal closes
+        app.securityGroups = {
+          refresh: extractSecurityGroup,
+        };
+      }
+    },
+  ]);