Lockdown external ports after director creation #450
Conversation
Signed-off-by: Denny Hoang <dhoang@pivotal.io> Signed-off-by: Conor Nosal <cnosal@pivotal.io>
|
✅ Hey ohlookadollar! The commit authors and yourself have already signed the CLA. |
|
@zachgersh could you please review this PR? Thanks |
|
@ohlookadollar - the one thing I would want to know is, what happens when I want to recreate my director and or jumpbox? Do I have to reverse this process? |
| @@ -31,7 +31,7 @@ func NewTemplateGenerator() TemplateGenerator { | |||
| } | |||
| } | |||
|
|
|||
| func (tg TemplateGenerator) Generate(state storage.State) string { | |||
| func (tg TemplateGenerator) Generate(state storage.State, _ bool) string { | |||
There was a problem hiding this comment.
Could we make this work for all the IAASes? I'd like to not have this only work for GCP.
@zachgersh Good Catch, recreating the jumpbox failed because of the mbus agent check. Recreating the director seems fine. |
Signed-off-by: Denny Hoang dhoang@pivotal.io
Signed-off-by: Conor Nosal cnosal@pivotal.io
This pr addresses: #417
We noticed that port 6868 and 25555 was exposed publicly on the jumpbox. According to the git issue, it is only required during bootstrapping the director.
This pr introduce a "Lockdown" step after the director creation in bbl up.
The lockdown step generates a new bbl_template.tf file without port 6868 and 25555.
It does this by putting all of the bootstrapping rules under terraform/gcp/templates/bosh_bootstrap.tf
During "Setup" the bbl_template.tf is included and during "Lockdown" it is not included.