You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dlab.apache.org by lf...@apache.org on 2020/09/25 12:56:20 UTC
[incubator-dlab] branch DLAB-1911 updated: [DLAB-1911]: changed how
allowed IPs are added to firewall rules in case if conf_allowed_ip_cidr is
predefined. for edge firewall rules ssn public ip is added to
conf_allowed_ip_cidr
This is an automated email from the ASF dual-hosted git repository.
lfrolov pushed a commit to branch DLAB-1911
in repository https://gitbox.apache.org/repos/asf/incubator-dlab.git
The following commit(s) were added to refs/heads/DLAB-1911 by this push:
new fc289c9 [DLAB-1911]: changed how allowed IPs are added to firewall rules in case if conf_allowed_ip_cidr is predefined. for edge firewall rules ssn public ip is added to conf_allowed_ip_cidr
fc289c9 is described below
commit fc289c9bc9c7c6d7b6607d1eea6b60954490b837
Author: leonidfrolov <fr...@gmail.com>
AuthorDate: Fri Sep 25 15:56:00 2020 +0300
[DLAB-1911]: changed how allowed IPs are added to firewall rules in case if conf_allowed_ip_cidr is predefined. for edge firewall rules ssn public ip is added to conf_allowed_ip_cidr
---
.../src/general/scripts/gcp/project_prepare.py | 13 ++++++++-----
.../src/general/scripts/gcp/ssn_prepare.py | 8 ++++++--
2 files changed, 14 insertions(+), 7 deletions(-)
diff --git a/infrastructure-provisioning/src/general/scripts/gcp/project_prepare.py b/infrastructure-provisioning/src/general/scripts/gcp/project_prepare.py
index d42ffdf..d65e8b6 100644
--- a/infrastructure-provisioning/src/general/scripts/gcp/project_prepare.py
+++ b/infrastructure-provisioning/src/general/scripts/gcp/project_prepare.py
@@ -222,17 +222,20 @@ if __name__ == "__main__":
sys.exit(1)
try:
- pre_defined_firewall = True
logging.info('[CREATE FIREWALL FOR EDGE NODE]')
print('[CREATE FIREWALL FOR EDGE NODE]')
firewall_rules = dict()
firewall_rules['ingress'] = []
firewall_rules['egress'] = []
-
ingress_rule = dict()
+ if os.environ['conf_allowed_ip_cidr'] != '0.0.0.0/0':
+ ssn_public_ip = GCPMeta.get_instance_public_ip_by_name('{}-ssn'.format(project_conf['service_base_name']))
+ project_conf['allowed_ip_cidr'] = '{}, {}/32'.format(project_conf['allowed_ip_cidr'], ssn_public_ip).split(', ')
+ else:
+ project_conf['allowed_ip_cidr'] = [project_conf['allowed_ip_cidr']]
ingress_rule['name'] = project_conf['fw_edge_ingress_public']
ingress_rule['targetTags'] = [project_conf['network_tag']]
- ingress_rule['sourceRanges'] = [project_conf['allowed_ip_cidr']]
+ ingress_rule['sourceRanges'] = project_conf['allowed_ip_cidr']
rules = [
{
'IPProtocol': 'tcp',
@@ -261,7 +264,7 @@ if __name__ == "__main__":
egress_rule = dict()
egress_rule['name'] = project_conf['fw_edge_egress_public']
egress_rule['targetTags'] = [project_conf['network_tag']]
- egress_rule['destinationRanges'] = [project_conf['allowed_ip_cidr']]
+ egress_rule['destinationRanges'] = project_conf['allowed_ip_cidr']
rules = [
{
'IPProtocol': 'udp',
@@ -359,7 +362,7 @@ if __name__ == "__main__":
egress_rule['targetTags'] = [
project_conf['ps_firewall_target']
]
- egress_rule['destinationRanges'] = [project_conf['allowed_ip_cidr']]
+ egress_rule['destinationRanges'] = project_conf['allowed_ip_cidr']
rules = [
{
'IPProtocol': 'tcp',
diff --git a/infrastructure-provisioning/src/general/scripts/gcp/ssn_prepare.py b/infrastructure-provisioning/src/general/scripts/gcp/ssn_prepare.py
index 8cf209d..ce1ae90 100644
--- a/infrastructure-provisioning/src/general/scripts/gcp/ssn_prepare.py
+++ b/infrastructure-provisioning/src/general/scripts/gcp/ssn_prepare.py
@@ -153,6 +153,10 @@ if __name__ == "__main__":
try:
logging.info('[CREATE FIREWALL]')
print('[CREATE FIREWALL]')
+ if os.environ['conf_allowed_ip_cidr'] != '0.0.0.0/0':
+ ssn_conf['allowed_ip_cidr'] = ssn_conf['allowed_ip_cidr'].split(', ')
+ else:
+ ssn_conf['allowed_ip_cidr'] = [ssn_conf['allowed_ip_cidr']]
firewall_rules = dict()
firewall_rules['ingress'] = []
firewall_rules['egress'] = []
@@ -160,7 +164,7 @@ if __name__ == "__main__":
ingress_rule = dict()
ingress_rule['name'] = '{}-ingress'.format(ssn_conf['firewall_name'])
ingress_rule['targetTags'] = [ssn_conf['network_tag']]
- ingress_rule['sourceRanges'] = [ssn_conf['allowed_ip_cidr']]
+ ingress_rule['sourceRanges'] = ssn_conf['allowed_ip_cidr']
rules = [
{
'IPProtocol': 'tcp',
@@ -175,7 +179,7 @@ if __name__ == "__main__":
egress_rule = dict()
egress_rule['name'] = '{}-egress'.format(ssn_conf['firewall_name'])
egress_rule['targetTags'] = [ssn_conf['network_tag']]
- egress_rule['destinationRanges'] = [ssn_conf['allowed_ip_cidr']]
+ egress_rule['destinationRanges'] = ssn_conf['allowed_ip_cidr']
rules = [
{
'IPProtocol': 'all',
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@dlab.apache.org
For additional commands, e-mail: commits-help@dlab.apache.org