Set up and configure egress proxy services

[JeanMarie-PM]

At a glance

In order to restrict app egress while enabling connections that are explicitly allowed for operation (meeting the intent of NIST control SC-7)
As a FAC system architect
I want a proxy in a public-egress space that will only proxy connections to configured domains.

Acceptance Criteria

We use DRY behavior-driven development wherever possible.

Scenario: The egress proxy is deployed and properly configured

Given I am logged into cloud.gov and targeting the gsa-tts-oros-fac organization
When I run cf spaces
...

then...

Beta Give feedback

1. I see that there are [dev|staging|production]-egress spaces

Given I am logged into cloud.gov
And and I have run cf t -o gsa-tts-oros-fac -s [dev|staging|production]-egress
When I run cf app egress ; cf network-policies; cf env egress | grep PROXY
...

then...

Beta Give feedback

1. I see that the egress app is running
2. I see a route on the apps.internal domain is mapped to the app
3. I see a network policy allows connections from FAC applications in the corresponding space to port 61443
4. I see that the expected allow/deny configuration and a random username/password in the egress environment variables

Given I am logged into cloud.gov
And and I have run cf t -o gsa-tts-oros-fac -s [dev|staging|production]
When I run cf service egress-creds
...

then...

Beta Give feedback

1. I see that there is a user-provided service instance

Shepherd

• Design shepherd:
• Engineering shepherd: @mogul

Background/discussion

While this issue sets up the egress proxy, it does not cover binding the client apps to the egress-creds service and ensuring they use the provided info to make outbound connections. That work will happen in another issue.

Security Considerations

Required per SC-7. This change sets up a proxy that will allow HTTPS and SSH connections only to explicitly expected destinations. The configuration is completely managed via a Terraform module, and the ACLs are maintained in version control. Credentials for using the proxy are not exposed outside the cloud.gov platform. Within the platform, they are only visible to people with SpaceDeveloper permission on the spaces, and to apps that are explicitly bound to the egress-creds service.

---

Process checklist

Sketch

• Design designs all the things
• Engineering engineers all the things

Definition of Done

Triage

If not likely to be important in the next quarter...

• Archived from the board

Otherwise...

• Has a clear story statement
• Design or Engineering accepts that it belongs in their respective backlog

Design Backlog

• Has clearly stated/testable acceptance criteria
• Meets the design Definition of Ready [citation needed]
• A design shepherd has been identified

Design In Progress

• Meets the design Definition of Done [citation needed]

Design Review Needed

• Necessary outside review/sign-off was provided

Design Done

• Presented in a sprint review
• Includes screenshots or references to artifacts

If no engineering is necessary

• Tagged with the sprint where it was finished
• Archived

Engineering Backlog

• Has clearly stated/testable acceptance criteria
• Has a sketch or list of tasks
• Can reasonably be done in a few days (otherwise, split this up!)

Engineering Available

• There's capacity in the In Progress column
• An engineering shepherd has been identified

Engineering In Progress

• Meets acceptance criteria
• Meets QASP conditions

If there's UI...

• Screen reader - Listen to the experience with a screen reader extension, ensure the information presented in order
• Keyboard navigation - Run through acceptance criteria with keyboard tabs, ensure it works.
• Text scaling - Adjust viewport to 1280 pixels wide and zoom to 200%, ensure everything renders as expected. Document 400% zoom issues with USWDS if appropriate.

Engineering Blocked

• Blocker removed/resolved

Engineering Review Needed

• Outside review/sign-off was provided

Engineering Done

• Presented in a sprint review
• Includes screenshots or references to artifacts
• Tagged with the sprint where it was finished
• Archived

[JeanMarie-PM]

Pasting a comment in Slack by @mogul :
The egress proxy should be in place, and if necessary an SMTP proxy implemented into it. This is for SC-7, arguably the most important NIST control in existence.

[JeanMarie-PM]

@mogul , do I get spaces provisioned manually in cloud.gov? Or are you going to do this via terraform?

[mogul]

You should do it via Terraform. I'll put in a PR.

[mogul]

This is now in progress on this branch.