一、定义 XRD
首先需要创建自定义 API，即为后面创建的复合资源，定义该复合资源对应的参数和类型。
在 xrd.yaml 定义安全组的入站和出站配置。其中 sgIngress，sgEgress 为必选参数。
# xrd.yamlapiVersion: apiextensions.crossplane.io/v1kind: CompositeResourceDefinitionmetadata: name: xsecuritygroups.crd.tencentcloud.crossplane.iospec: group: crd.tencentcloud.crossplane.io names: kind: XSecurityGroup plural: xsecuritygroups versions: – name: v1alpha1 served: true referenceable: true schema: openAPIV3Schema: type: object properties: spec: type: object properties: sgIngress: # 定义入站规则 type: array items: type: string sgEgress: # 定义出站规则 type: array items: type: string required: – sgIngress – sgEgress status: description: A Status represents the observed state properties: share: description: Freeform field containing status information type: object x-kubernetes-preserve-unknown-fields: true type: object
二、定义 Composition
接着，在 composition.yaml 中定义复合资源，包括一个安全组和安全组规则。
用户可在资源创建后，通过 status.share.sgId 获取安全组 Id。
# composition.yamlapiVersion: apiextensions.crossplane.io/v1kind: Compositionmetadata: name: composition-sgspec: compositeTypeRef: apiVersion: crd.tencentcloud.crossplane.io/v1alpha1 kind: XSecurityGroup resources: # 定义安全组 – name: sg base: apiVersion: vpc.tencentcloud.crossplane.io/v1alpha1 kind: SecurityGroup spec: forProvider: name: test-crossplane-sg # 安全组名称 description: Security Group for the XSecurityGroup. patches: – type: ToCompositeFieldPath fromFieldPath: status.atProvider.id toFieldPath: status.share.sgId # 定义安全组规则 – name: sgrules base: apiVersion: vpc.tencentcloud.crossplane.io/v1alpha1 kind: SecurityGroupLiteRule spec: patches: – fromFieldPath: status.share.sgId toFieldPath: spec.forProvider.securityGroupId – fromFieldPath: spec.sgIngress toFieldPath: spec.forProvider.ingress – fromFieldPath: spec.sgEgress toFieldPath: spec.forProvider.egress – type: ToCompositeFieldPath fromFieldPath: status.atProvider.id toFieldPath: status.share.sgruleId
三、创建 XSecurityGroup 资源
现在，在 xsecuritygroup.yaml 中为复合资源设置具体的安全组规则。
# xsecuritygroup.yamlapiVersion: crd.tencentcloud.crossplane.io/v1alpha1kind: XSecurityGroupmetadata: name: xsg-examplespec:# 入站规则 sgIngress: – "DROP#0.0.0.0/0#ALL#ALL" # 根据需求设置规则# 出站规则 sgEgress: – "DROP#0.0.0.0/0#ALL#ALL" # 根据需求设置规则
使用 kubectl apply 命令依次执行上述配置文件，完成资源的创建。
kubectl apply -f xrd.yamlkubectl apply -f composition.yamlkubectl apply -f xsecuritygroup.yaml
执行结果如下：
创建了前缀为 xsg-example- 的安全组实例。
❯ kubectl get managedNAME READY SYNCED EXTERNAL-NAME AGEsecuritygroupliterule.vpc.tencentcloud.crossplane.io/xsg-example-bks7q True True sg-3o46faav 5h48mNAME READY SYNCED EXTERNAL-NAME AGEsecuritygroup.vpc.tencentcloud.crossplane.io/xsg-example-j6fxz True True sg-3o46faav 5h48m
此时，你可以在控制台查看创建的安全组资源。