Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

V4.32.0 #1234

Merged
merged 33 commits into from
Feb 27, 2024
Merged

V4.32.0 #1234

merged 33 commits into from
Feb 27, 2024

Conversation

Cabecinha84
Copy link
Member

  • Fix iptables generation to prevent dockers to access private network of the fluxnode;
  • Fix adding back the option to update applications specification without extending subscription;
  • Added job to clean automaticaly backup files after 24h they were created;
  • Big change on UI, simplified menus and big change on application management, is no longer needed to go to Fluxnodes where your app was running to have local management available;
  • Other optimizations.

This version will be enforced on March 13th, make sure you update your Fluxnode before that day.

David White and others added 27 commits February 21, 2024 08:33
* Update iptables rules to make them idempotent

* Add missing return statements

* Fix catch logic error

* Only catch one statement with try

* Remove broken catches (sync code)

* Move to explictly denying flux 172.23.0.0/16 and use DOCKER-USER chain

* Add a bit more to docstring

* Remove erroneous extra function call from testing

* Greatly simplify how default gateway / local subnet is determined

* Lint

* Remove requirement for , will protect all operator networks

* Modify rules slightly to match iptables output, add tests

* Add allow for Flux networks, remove RETURN that docker keeps adding

* Full refactor - see below

This commit now blocks 100% of access to private address space, while
maintaining isolation for each Flux docker network. Now apps can be
sure no other app is snooping their traffic, and operators can be sure
that apps do not have access to ANY private network they are routing.

Tests will all be broken - I'll fix up in next commit.

* Lint

* Update tests

* Move the docker interface fetch up a level to avoid circular

* Add dockerService to serviceManager, fix up tests

* Fix typing for return

* Stub console output (from Flux log) so it doesn't clog up the testing output

* Add missing remove private stanza for softInstallLocally

* Update compatibility with older iptables 1.8.4 - see below

Older iptables (legacy) on ubuntu 20.04 operates slightly
differently than the nf_tables version, the check output command
doesn't return anything.

Some of the output strings are different, so we don't check those
anymore.

Have also added a check to make sure the iptables binary is in the
root users path.

* Add iptables exists check and fix up tests
Copy link

gitguardian bot commented Feb 27, 2024

⚠️ GitGuardian has uncovered 24 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request
GitGuardian id GitGuardian status Secret Commit Filename
8398280 Triggered PGP Private Key aad25a2 HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key aad25a2 HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 4b55f1d HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 4b55f1d HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 60fb79b HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 60fb79b HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 1bcf794 HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 1bcf794 HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key d5455c7 HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key d5455c7 HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 4d8d207 HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 4d8d207 HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key ef043fd HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key ef043fd HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 717c399 HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 717c399 HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 62a24ab HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 62a24ab HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 0453b1f HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 0453b1f HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 56a0eff HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 56a0eff HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 2117b4a HomeUI/dist/js/index.js View secret
8398280 Triggered PGP Private Key 2117b4a HomeUI/dist/js/index.js View secret
🛠 Guidelines to remediate hardcoded secrets
  1. Understand the implications of revoking this secret by investigating where it is used in your code.
  2. Replace and store your secrets safely. Learn here the best practices.
  3. Revoke and rotate these secrets.
  4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider


🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!

Copy link

codecov bot commented Feb 27, 2024

Codecov Report

Attention: Patch coverage is 45.77465% with 77 lines in your changes are missing coverage. Please review.

Project coverage is 48.52%. Comparing base (8fbfecd) to head (56a0eff).
Report is 8 commits behind head on master.

❗ Current head 56a0eff differs from pull request most recent head 2117b4a. Consider uploading reports for the commit 2117b4a to get more accurate results

Files Patch % Lines
ZelBack/src/services/appsService.js 0.00% 26 Missing ⚠️
ZelBack/src/services/backupRestoreService.js 4.34% 22 Missing ⚠️
ZelBack/src/services/serviceHelper.js 0.00% 11 Missing ⚠️
ZelBack/src/services/dockerService.js 0.00% 10 Missing ⚠️
ZelBack/src/services/fluxNetworkHelper.js 88.88% 8 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1234      +/-   ##
==========================================
+ Coverage   48.49%   48.52%   +0.02%     
==========================================
  Files          45       45              
  Lines       14796    14925     +129     
==========================================
+ Hits         7176     7242      +66     
- Misses       7620     7683      +63     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants