ODF has an urgent need to be able to add security group filters to worker MachineSets for "day 0" – i.e. initial cluster installation. This is currently only supported by the installer by editing the MachineSet manifests between openshift-install create manifests and openshift-install create cluster. HIVE-1793 is going to track designing a (hopefully elegant) supported way to make arbitrary edits to manifests via the API. This card is for a short-term workaround to satisfy the immediate need.

A more detailed design will be forthcoming shortly, but what we're thinking at the moment is:

An annotation on MachinePool whose value is the string to be added to (take a deep breath) MachineSet.Spec.Template.Spec.ProviderSpec.Value.Object.SecurityGroups[].Filters[].Values.

This will also be plumbed into the "day 2" side so it will also affect new MachineSets when scaling.

The annotation will be undocumented and officially unsupported, to be replaced by a better solution that comes out of HIVE-1793, or the installer, or ODF itself.

abutcher@redhat.com igoihman@redhat.com vkarehfa omitrani