Change:
Is this a BUG REPORT or FEATURE REQUEST?: /kind feature What happened: When using the loadBalancerSourceRanges property of a service in a manifest, we are force to use a CIDR block. This was discovered while debugging the following issue. What you expected to happen: Azure allows us to use Service Tags (e.g. VirtualNetwork, Internet, etc) WE should be able to specify them form a k8s service manifest. How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): 1.7.11 Cloud provider or hardware configuration: Azure OS (e.g. from /etc/os-release): centOS 7.3 Kernel (e.g. ): 3.10 Install tools: Others:
/sig azure
Here's the requested Feature.
SourceRanges is part of service spec, while serviceTag is azure specific. I think we don't expect to add cloud-specific features into Kubernetes API. What about adding a new annotation for this? e.g.
I believe that at this stage, (no out of tree cloud provider logic), using an annotation would be the only way to go unfortunately.
/priority important-soon
/status approved-for-milestone
[MILESTONENOTIFIER] Milestone Issue: Up-to-date for process <details open<summaryIssue Labels</summary- : Issue will be escalated to these SIGs if needed. : Escalate to the issue owners and SIG owner; move out of milestone after several unsuccessful escalation attempts. : New functionality. </details<details<summaryHelp</summary<ul<li<a href=""Additional instructions</a</li<li<a href=""Commands for setting labels</a</li</ul</details

Discussion:
// ServiceAnnotationLoadBalancerResourceGroup is the annotation used on the service // to specify the resource group of load balancer objects that are not in the same resource group as the cluster. ServiceAnnotationLoadBalancerResourceGroup = "service.beta.kubernetes.io/azure-load-balancer-resource-group" <ins> // ServiceAnnotationAllowedServiceTag is the annotation used on the service // to specify a list of allowed service tags separated by comma ServiceAnnotationAllowedServiceTag = "service.beta.kubernetes.io/azure-allowed-service-tags" ) var ( // supportedServiceTags holds a list of supported service tags on Azure. // Refer https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#service-tags for more information. supportedServiceTags = sets.NewString("VirtualNetwork", "VIRTUAL_NETWORK", "AzureLoadBalancer", "AZURE_LOADBALANCER", "Internet", "INTERNET", "AzureTrafficManager", "Storage", "Sql") </ins> ) // GetLoadBalancer returns whether the specified load balancer exists, and

if err != nil { return nil, err } <ins> serviceTags, err := getServiceTags(service) if err != nil { return nil, err } </ins> var sourceAddressPrefixes []string <del> if sourceRanges == nil || serviceapi.IsAllowAll(sourceRanges) { </del> <ins> if (sourceRanges == nil || serviceapi.IsAllowAll(sourceRanges)) && len(serviceTags) == 0 { </ins> if !requiresInternalLoadBalancer(service) { sourceAddressPrefixes = []string{"Internet"} }

for _, ip := range sourceRanges { sourceAddressPrefixes = append(sourceAddressPrefixes, ip.String()) } <ins> for _, serviceTag := range serviceTags { sourceAddressPrefixes = append(sourceAddressPrefixes, serviceTag) } </ins> } expectedSecurityRules := []network.SecurityRule{}

return false } <ins> func getServiceTags(service *v1.Service) ([]string, error) { if serviceTags, found := service.Annotations[ServiceAnnotationAllowedServiceTag]; found { tags := strings.Split(strings.TrimSpace(serviceTags), ",") for _, tag := range tags { // Storage and Sql service tags support setting regions with suffix ".Region" if strings.HasPrefix(tag, "Storage.") || strings.HasPrefix(tag, "Sql.") { continue } if !supportedServiceTags.Has(tag) { return nil, fmt.Errorf("only %q are allowed in service tags", supportedServiceTags.List()) } } return tags, nil } return nil, nil } </ins>