Introduction

Use Case

Administrators would want to block a list of routes so that they are not assigned to any of the VPC Private Gateways.

Architecture and Design description

  • Each zone will get a new config parameter - blacklistedRoutes. By default this parameter will be null, which means no routes will be blacklisted.
  • While creating Static Routes on VPC Private Gateways within this zone (using createStaticRoute API), if the Static Route is part of the blacklist, route creation will not be allowed. The verification will be done using NetUtils.isNetworksOverlap() method
  • Parameter update will affect only new Static Route creation. If there was an existing Static Route with the route that was blacklisted some time after, it will remain intact and functioning. 

API changes

Parameter update will be done using new APIs for updating Zone level parameters. For the details, refer to FS for Granular Global Configuration Parameters

updateConfiguration&scope=zone&id=<zone_id> will accept a new parameter - blacklisted.routes. It's going to accept list of routes separated by comma in format of x.x.x.x/x. Example: "10.10.10.0/24,172.16.1.0/24"

DB changes

  • No new tables are added. The entry with name=blacklisted.routes and value=null will be added to the cloud.configuration table.

QA

  • Verify that you can't add static route if its exists as blacklisted route for the zone. It will apply only to the newly created static routes; if the static route was created before the blacklist route was updated for the zone with the same IP - it's ok.
  • Verify that blacklisted route accepts only valid IP addresses.
  • No labels