Merge pull request kubernetes#3730 from iterion/add-ipip-to-kuberouter

Automatic merge from submit-queue.

Add node-to-master IPIP to kuberouter

Like Calico and Romana, Kube Router needs IPIP traffic from nodes to masters to be allowed. This adds that firewall rule for all clusters set up with Kube Router.

See:
cloudnativelabs/kube-router#208

pkg/model/firewall.go

@@ -155,6 +155,10 @@ func (b *FirewallModelBuilder) applyNodeToMasterAllowSpecificPorts(c *fi.ModelBu
 			tcpPorts = append(tcpPorts, 4001)
 			tcpPorts = append(tcpPorts, 9600)
 		}
+
+		if b.Cluster.Spec.Networking.Kuberouter != nil {
+			protocols = append(protocols, ProtocolIPIP)
+		}
 	}
 
 	for _, udpPort := range udpPorts {
@@ -226,6 +230,10 @@ func (b *FirewallModelBuilder) applyNodeToMasterBlockSpecificPorts(c *fi.ModelBu
 		protocols = append(protocols, ProtocolIPIP)
 	}
 
+	if b.Cluster.Spec.Networking.Kuberouter != nil {
+		protocols = append(protocols, ProtocolIPIP)
+	}
+
 	for _, r := range udpRanges {
 		c.AddTask(&awstasks.SecurityGroupRule{
 			Name:          s(fmt.Sprintf("node-to-master-udp-%d-%d", r.From, r.To)),