Repository: zalando-incubator/kube-ingress-aws-controller
Pull request #537 (2022-08-25 15:39:02)

Bump github.com/aws/aws-sdk-go from 1.44.66 to 1.44.84
Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.44.66 to 1.44.84.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/aws/aws-sdk-go/releases">github.com/aws/aws-sdk-go's releases</a>.</em></p>
<blockquote>
<h1>Release v1.44.84 (2022-08-24)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/cloudfront</code>: Updates service API and documentation
<ul>
<li>Adds support for CloudFront origin access control (OAC), making it possible to restrict public access to S3 bucket origins in all AWS Regions, those with SSE-KMS, and more.</li>
</ul>
</li>
<li><code>service/config</code>: Updates service API and documentation</li>
<li><code>service/iam</code>: Updates service documentation
<ul>
<li>Documentation updates for AWS Identity and Access Management (IAM).</li>
</ul>
</li>
<li><code>service/ivs</code>: Updates service documentation</li>
<li><code>service/quicksight</code>: Updates service API and documentation
<ul>
<li>Added a new optional property DashboardVisual under ExperienceConfiguration parameter of GenerateEmbedUrlForAnonymousUser and GenerateEmbedUrlForRegisteredUser API operations. This supports embedding of specific visuals in QuickSight dashboards.</li>
</ul>
</li>
<li><code>service/transfer</code>: Updates service documentation
<ul>
<li>Documentation updates for AWS Transfer Family</li>
</ul>
</li>
</ul>
<h1>Release v1.44.83 (2022-08-23)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/rds</code>: Updates service API, documentation, waiters, paginators, and examples
<ul>
<li>RDS for Oracle supports Oracle Data Guard switchover and read replica backups.</li>
</ul>
</li>
<li><code>service/sso-admin</code>: Updates service documentation</li>
</ul>
<h1>Release v1.44.82 (2022-08-22)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/docdb</code>: Updates service documentation
<ul>
<li>Update document for volume clone</li>
</ul>
</li>
<li><code>service/ec2</code>: Updates service API
<ul>
<li>R6a instances are powered by 3rd generation AMD EPYC (Milan) processors delivering all-core turbo frequency of 3.6 GHz. C6id, M6id, and R6id instances are powered by 3rd generation Intel Xeon Scalable processor (Ice Lake) delivering all-core turbo frequency of 3.5 GHz.</li>
</ul>
</li>
<li><code>service/forecast</code>: Updates service API, documentation, and paginators</li>
<li><code>service/forecastquery</code>: Updates service API and documentation</li>
<li><code>service/iotsitewise</code>: Updates service API</li>
<li><code>service/models.lex.v2</code>: Updates service API and documentation</li>
<li><code>service/securityhub</code>: Updates service API and documentation</li>
<li><code>service/support-app</code>: Adds new service</li>
</ul>
<h1>Release v1.44.81 (2022-08-19)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/connect</code>: Updates service API, documentation, and paginators</li>
<li><code>service/ivschat</code>: Updates service documentation</li>
<li><code>service/kendra</code>: Updates service API and documentation
<ul>
<li>This release adds support for a new authentication type - Personal Access Token (PAT) for confluence server.</li>
</ul>
</li>
<li><code>service/lookoutmetrics</code>: Updates service API and documentation</li>
</ul>
<h1>Release v1.44.80 (2022-08-18)</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/aws/aws-sdk-go/blob/main/CHANGELOG.md">github.com/aws/aws-sdk-go's changelog</a>.</em></p>
<blockquote>
<h1>Release v1.44.84 (2022-08-24)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/cloudfront</code>: Updates service API and documentation
<ul>
<li>Adds support for CloudFront origin access control (OAC), making it possible to restrict public access to S3 bucket origins in all AWS Regions, those with SSE-KMS, and more.</li>
</ul>
</li>
<li><code>service/config</code>: Updates service API and documentation</li>
<li><code>service/iam</code>: Updates service documentation
<ul>
<li>Documentation updates for AWS Identity and Access Management (IAM).</li>
</ul>
</li>
<li><code>service/ivs</code>: Updates service documentation</li>
<li><code>service/quicksight</code>: Updates service API and documentation
<ul>
<li>Added a new optional property DashboardVisual under ExperienceConfiguration parameter of GenerateEmbedUrlForAnonymousUser and GenerateEmbedUrlForRegisteredUser API operations. This supports embedding of specific visuals in QuickSight dashboards.</li>
</ul>
</li>
<li><code>service/transfer</code>: Updates service documentation
<ul>
<li>Documentation updates for AWS Transfer Family</li>
</ul>
</li>
</ul>
<h1>Release v1.44.83 (2022-08-23)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/rds</code>: Updates service API, documentation, waiters, paginators, and examples
<ul>
<li>RDS for Oracle supports Oracle Data Guard switchover and read replica backups.</li>
</ul>
</li>
<li><code>service/sso-admin</code>: Updates service documentation</li>
</ul>
<h1>Release v1.44.82 (2022-08-22)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/docdb</code>: Updates service documentation
<ul>
<li>Update document for volume clone</li>
</ul>
</li>
<li><code>service/ec2</code>: Updates service API
<ul>
<li>R6a instances are powered by 3rd generation AMD EPYC (Milan) processors delivering all-core turbo frequency of 3.6 GHz. C6id, M6id, and R6id instances are powered by 3rd generation Intel Xeon Scalable processor (Ice Lake) delivering all-core turbo frequency of 3.5 GHz.</li>
</ul>
</li>
<li><code>service/forecast</code>: Updates service API, documentation, and paginators</li>
<li><code>service/forecastquery</code>: Updates service API and documentation</li>
<li><code>service/iotsitewise</code>: Updates service API</li>
<li><code>service/models.lex.v2</code>: Updates service API and documentation</li>
<li><code>service/securityhub</code>: Updates service API and documentation</li>
<li><code>service/support-app</code>: Adds new service</li>
</ul>
<h1>Release v1.44.81 (2022-08-19)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/connect</code>: Updates service API, documentation, and paginators</li>
<li><code>service/ivschat</code>: Updates service documentation</li>
<li><code>service/kendra</code>: Updates service API and documentation
<ul>
<li>This release adds support for a new authentication type - Personal Access Token (PAT) for confluence server.</li>
</ul>
</li>
<li><code>service/lookoutmetrics</code>: Updates service API and documentation</li>
</ul>
<h1>Release v1.44.80 (2022-08-18)</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/aws/aws-sdk-go/commit/3f8783fa36cdea2ac5507b6463c66ed1f14138a9"><code>3f8783f</code></a> Release v1.44.84 (2022-08-24) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4534">#4534</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/d4f5f556a9fb0bdca8da5e52f752b7fba6bedce5"><code>d4f5f55</code></a> Release v1.44.83 (2022-08-23) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4533">#4533</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/33def9f04017a2ae7fdd50e857c8016194523f7c"><code>33def9f</code></a> Release v1.44.82 (2022-08-22) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4531">#4531</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/8abdb48787ec427caed9794d56a367df4483b976"><code>8abdb48</code></a> Release v1.44.81 (2022-08-19) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4529">#4529</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/b28bc2fb2763de116b097ba97ea2834f38280be5"><code>b28bc2f</code></a> Release v1.44.80 (2022-08-18) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4527">#4527</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/ad2ea9bba8734c8981bcda3e2a1b4761bf537c3d"><code>ad2ea9b</code></a> private/protocol/query: Fix deserialize error code with spaces (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4525">#4525</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/f519aeb233918ee2564f35a6cb8a6b30f332ee6e"><code>f519aeb</code></a> Release v1.44.79 (2022-08-17) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4524">#4524</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/44a448b106c7ea2793d8bf873fac912cfa414860"><code>44a448b</code></a> Release v1.44.78 (2022-08-16) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4521">#4521</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/0ba6387991e7c60aeee588c666a41e6e71d04114"><code>0ba6387</code></a> Release v1.44.77 (2022-08-15) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4520">#4520</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/05571237baddd448a5ed32516d3e0b84d54733f4"><code>0557123</code></a> Release v1.44.76 (2022-08-12) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4518">#4518</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go/compare/v1.44.66...v1.44.84">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go&package-manager=go_modules&previous-version=1.44.66&new-version=1.44.84)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/go.mod b/go.mod
index 27fa3f6..273666e 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.16
 
 require (
 	github.com/alecthomas/units v0.0.0-20210208195552-ff826a37aa15 // indirect
-	github.com/aws/aws-sdk-go v1.44.66
+	github.com/aws/aws-sdk-go v1.44.84
 	github.com/dchest/siphash v1.2.3 // indirect
 	github.com/ghodss/yaml v1.0.0
 	github.com/go-playground/universal-translator v0.17.0 // indirect
@@ -20,7 +20,7 @@ require (
 	github.com/opencontainers/runc v1.1.3 // indirect
 	github.com/power-devops/perfstat v0.0.0-20220216144756-c35f1ee13d7c // indirect
 	github.com/pquerna/cachecontrol v0.1.0 // indirect
-	github.com/prometheus/client_golang v1.12.1
+	github.com/prometheus/client_golang v1.12.2
 	github.com/prometheus/common v0.33.0 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/shirou/gopsutil/v3 v3.22.3 // indirect
diff --git a/go.sum b/go.sum
index 39e1351..652ccd9 100644
--- a/go.sum
+++ b/go.sum
@@ -134,8 +134,8 @@ github.com/aryszka/jobqueue v0.0.2/go.mod h1:SdxqI6HZ4E1Lss94tey5OfjcAu3bdCDWS1A
 github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/aws/aws-sdk-go v1.15.11/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
-github.com/aws/aws-sdk-go v1.44.66 h1:xdH4EvHyUnkm4I8d536ui7yMQKYzrkbSDQ2LvRRHqsg=
-github.com/aws/aws-sdk-go v1.44.66/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/aws/aws-sdk-go v1.44.84 h1:orGogGRrizQSqn3lBnaP/FQIcjPMLf9azDO0h+oTJr0=
+github.com/aws/aws-sdk-go v1.44.84/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
 github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -655,7 +655,6 @@ github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ
 github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
 github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/instana/go-sensor v1.38.3/go.mod h1:E42MelHWFz11qqaLwvgt0j98v2s2O/bq22UDkGaG0Gg=
@@ -906,8 +905,9 @@ github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQ
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.12.1 h1:ZiaPsmm9uiBeaSMRznKsCDNtPCS0T3JVDGF+06gjBzk=
 github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
+github.com/prometheus/client_golang v1.12.2 h1:51L9cDoUHVrXx4zWYlcLQIZ+d+VXHgqnYKkIuq4g/34=
+github.com/prometheus/client_golang v1.12.2/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
diff --git a/worker.go b/worker.go
index 09b890d..ddba79e 100644
--- a/worker.go
+++ b/worker.go
@@ -88,16 +88,6 @@ func (l *loadBalancer) addIngress(certificateARNs []string, ingress *kubernetes.
 		return true
 	}
 
-	if l.ipAddressType != ingress.IPAddressType ||
-		l.scheme != ingress.Scheme ||
-		l.securityGroup != ingress.SecurityGroup ||
-		l.sslPolicy != ingress.SSLPolicy ||
-		l.loadBalancerType != ingress.LoadBalancerType ||
-		l.http2 != ingress.HTTP2 ||
-		l.wafWebACLID != ingress.WAFWebACLID {
-		return false
-	}
-
 	resourceName := fmt.Sprintf("%s/%s", ingress.Namespace, ingress.Name)
 
 	owner := ""
@@ -113,6 +103,23 @@ func (l *loadBalancer) addIngress(certificateARNs []string, ingress *kubernetes.
 		return false
 	}
 
+	// settings that would require a new load balancer no matter if it's
+	// shared or not.
+	if l.ipAddressType != ingress.IPAddressType ||
+		l.scheme != ingress.Scheme ||
+		l.loadBalancerType != ingress.LoadBalancerType ||
+		l.http2 != ingress.HTTP2 {
+		return false
+	}
+
+	// settings that can be changed on an existing load balancer if it's
+	// NOT shared.
+	if ingress.Shared && (l.securityGroup != ingress.SecurityGroup ||
+		l.sslPolicy != ingress.SSLPolicy ||
+		l.wafWebACLID != ingress.WAFWebACLID) {
+		return false
+	}
+
 	// check if we can fit the ingress on the load balancer based on
 	// maxCerts
 	newCerts := 0


Test patch:
diff --git a/worker_test.go b/worker_test.go
index 87abccb..17022a4 100644
--- a/worker_test.go
+++ b/worker_test.go
@@ -169,12 +169,31 @@ func TestAddIngress(tt *testing.T) {
 			},
 			added: false,
 		},
+		{
+			name: "Adding/changing WAF, SG or TLS settings on non-shared LB should work",
+			loadBalancer: &loadBalancer{
+				ingresses: make(map[string][]*kubernetes.Ingress),
+				stack: &aws.Stack{
+					OwnerIngress: "foo/bar",
+				},
+				sslPolicy: "ELBSecurityPolicy-2016-08",
+			},
+			ingress: &kubernetes.Ingress{
+				Name:          "bar",
+				Namespace:     "foo",
+				WAFWebACLID:   "WAFZXX",
+				SecurityGroup: "bar",
+				SSLPolicy:     "ELBSecurityPolicy-FS-2018-06",
+				Shared:        false,
+			},
+			added: true,
+		},
 	} {
 		tt.Run(test.name, func(t *testing.T) {
 			assert.Equal(
 				t,
-				test.loadBalancer.addIngress(test.certificateARNs, test.ingress, test.maxCerts),
 				test.added,
+				test.loadBalancer.addIngress(test.certificateARNs, test.ingress, test.maxCerts),
 			)
 		})
 	}