Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: add in missing ACLs for windows multitenancy #2617

Merged
merged 2 commits into from Mar 8, 2024

Conversation

pjohnst5
Copy link
Collaborator

@pjohnst5 pjohnst5 commented Feb 29, 2024

In #2515 , an ACL was introduced to block port 80 of Wireserver
However, this also breaks all connectivity of a Windows multitenany pod
Adding in missing ACLs to fix this
Pings work just fine now with this fix:
image

@pjohnst5 pjohnst5 marked this pull request as ready for review March 2, 2024 00:29
@pjohnst5 pjohnst5 requested a review from a team as a code owner March 2, 2024 00:29
@pjohnst5 pjohnst5 requested a review from vipul-21 March 2, 2024 00:29
@pjohnst5
Copy link
Collaborator Author

pjohnst5 commented Mar 2, 2024

I see this ACL was added in #2515 but this fails multitenancy for Windows, was this tested @QxBytes ?

@pjohnst5
Copy link
Collaborator Author

pjohnst5 commented Mar 2, 2024

The reason I say this breaks QxBytes, is if a customer/partner team were to use Kubernetes with this conflist, the pods would not be able to resolve DNS, which is done through wireserver 168.63.129.16 (because multitenant customer pods could not use coredns, since these customer pods are in a differnet network than the K8S infra)

So I suggest here we add this back in, at least for testing, and maybe even back to the prod one too, because I don't see why we need to block Wireserver IP

@pjohnst5
Copy link
Collaborator Author

pjohnst5 commented Mar 2, 2024

@tamilmani1989 also to comment on this

@pjohnst5 pjohnst5 changed the title test: test conflist for windows multitenancy on an aks cluster fix: add in missing ACLs for windows multitenancy Mar 7, 2024
@pjohnst5
Copy link
Collaborator Author

pjohnst5 commented Mar 7, 2024

Validated both that outbound traffic to wireserver 80 is blocked within the pod and wireserver via pod's apipia endpoint also is blocked while seeing blocked packets increase by +1 each time

@QxBytes QxBytes self-requested a review March 7, 2024 19:28
Copy link
Contributor

@QxBytes QxBytes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Paul and I confirmed that invoking a request to google.com from within the container is successful with these two added ACL rules. DNS functionality with nslookup within the container was also confirmed and successful. We also validated that the wireserver traffic is blocked via both apipa and the container's eth0 by checking the vfp rules and seeing the dropped packet counter increase when a request is issued.

@pjohnst5
Copy link
Collaborator Author

pjohnst5 commented Mar 7, 2024

/azp run

Copy link

Azure Pipelines successfully started running 2 pipeline(s).

@pjohnst5 pjohnst5 added this pull request to the merge queue Mar 7, 2024
Merged via the queue into master with commit ab54979 Mar 8, 2024
170 of 174 checks passed
@pjohnst5 pjohnst5 deleted the paujohns/new-conflist branch March 8, 2024 00:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants