Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[upcloud] Add firewall default deny policy and port allowlisting #9058

Merged
merged 1 commit into from
Jul 19, 2022
Merged

[upcloud] Add firewall default deny policy and port allowlisting #9058

merged 1 commit into from
Jul 19, 2022

Conversation

Ajarmar
Copy link
Contributor

@Ajarmar Ajarmar commented Jul 5, 2022

What type of PR is this?

/kind feature

What this PR does / why we need it:

Added firewall default deny policy (required upgrading the Terraform provider to v2.5.0) and port allowlisting

Special notes for your reviewer:

When enabling firewall default deny policy, UpCloud's DNS servers are allowlisted automatically.

Does this PR introduce a user-facing change?:

Add option to use default deny firewall policy and port allowlisting on UpCloud

@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jul 5, 2022
@k8s-ci-robot
Copy link
Contributor

Hi @Ajarmar. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 5, 2022
@cristicalin
Copy link
Contributor

Hi @Ajarmar , thanks for this contribution, please address the CI job failure, it looks like a linting error.

robinAwallace
robinAwallace reviewed Jul 6, 2022
View reviewed changes
Copy link
Contributor

@robinAwallace robinAwallace left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this looks good overall. I would like to see some small changes 🙂

contrib/terraform/upcloud/modules/kubernetes-cluster/main.tf Outdated Show resolved Hide resolved
contrib/terraform/upcloud/modules/kubernetes-cluster/main.tf Outdated Show resolved Hide resolved
contrib/terraform/upcloud/modules/kubernetes-cluster/main.tf Show resolved Hide resolved
@Ajarmar Ajarmar force-pushed the upcloud-firewall-default-deny branch from c705573 to 0b21ffa Compare July 11, 2022 14:44
@Ajarmar Ajarmar force-pushed the upcloud-firewall-default-deny branch from 0b21ffa to 8c7e85f Compare July 11, 2022 14:45
@Ajarmar
Copy link
Contributor Author

Ajarmar commented Jul 11, 2022

Fixed linting error and made changes according to feedback.

oomichi
oomichi reviewed Jul 12, 2022
View reviewed changes
Copy link
Contributor

@oomichi oomichi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for doing this, just one question.

/ok-to-test

contrib/terraform/upcloud/modules/kubernetes-cluster/main.tf
family = "IPv4"
protocol = firewall_rule.value
source_address_end = "94.237.40.9"
source_address_start = "94.237.40.9"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where those IP addresses come from?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These IP addresses are UpCloud's DNS servers. You can see them listed on this page on UpCloud's website.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your explanation, I got it.

/lgtm

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 12, 2022
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 14, 2022
floryut
floryut approved these changes Jul 19, 2022
View reviewed changes
Copy link
Member

@floryut floryut left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Ajarmar Thank you 👍

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Ajarmar, floryut

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 19, 2022
@k8s-ci-robot k8s-ci-robot merged commit 0d32c0d into kubernetes-sigs:master Jul 19, 2022
@floryut floryut added kind/applications Applications section in the release note and removed kind/feature Categorizes issue or PR as related to a new feature. labels Jul 19, 2022
@floryut floryut mentioned this pull request Sep 19, 2022
Closed
nolimitkun pushed a commit to nolimitkun/kubespray that referenced this pull request Mar 19, 2023
@Ajarmar @nolimitkun
[upcloud] Add firewall default deny policy and port allowlisting (kub…
c99db64 
…ernetes-sigs#9058)
LuckySB pushed a commit to southbridgeio/kubespray that referenced this pull request Jul 2, 2023
@Ajarmar @LuckySB
[upcloud] Add firewall default deny policy and port allowlisting (kub…
b4ea5ea 
…ernetes-sigs#9058)
LuckySB pushed a commit to southbridgeio/kubespray that referenced this pull request Jul 7, 2023
@Ajarmar @LuckySB
[upcloud] Add firewall default deny policy and port allowlisting (kub…
d13809c 
…ernetes-sigs#9058)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@oomichi oomichi oomichi left review comments

@robinAwallace robinAwallace robinAwallace left review comments

@floryut floryut floryut approved these changes

@cristicalin cristicalin Awaiting requested review from cristicalin

Assignees

@oomichi oomichi

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/applications Applications section in the release note lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@Ajarmar @k8s-ci-robot @cristicalin @oomichi @robinAwallace @floryut