Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug 1916373: upi: allow IPsec ports #4552

Merged
merged 1 commit into from
Jan 21, 2021
Merged

Bug 1916373: upi: allow IPsec ports #4552

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
112 changes: 112 additions & 0 deletions upi/aws/cloudformation/03_cluster_security.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,62 @@ Resources:
ToPort: 6081
IpProtocol: udp

MasterIngressIpsecIke:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt MasterSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
Description: IPsec IKE packets
FromPort: 500
ToPort: 500
IpProtocol: udp

MasterIngressIpsecNat:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt MasterSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
Description: IPsec NAT-T packets
FromPort: 4500
ToPort: 4500
IpProtocol: udp

MasterIngressIpsecEsp:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt MasterSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
Description: IPsec ESP packets
IpProtocol: esp

MasterIngressWorkerIpsecIke:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt MasterSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
Description: IPsec IKE packets
FromPort: 500
ToPort: 500
IpProtocol: udp

MasterIngressWorkerIpsecNat:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt MasterSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
Description: IPsec NAT-T packets
FromPort: 4500
ToPort: 4500
IpProtocol: udp

MasterIngressWorkerIpsecEsp:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt MasterSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
Description: IPsec ESP packets
IpProtocol: esp

MasterIngressInternal:
Type: AWS::EC2::SecurityGroupIngress
Properties:
Expand Down Expand Up @@ -274,6 +330,62 @@ Resources:
ToPort: 6081
IpProtocol: udp

WorkerIngressIpsecIke:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt WorkerSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
Description: IPsec IKE packets
FromPort: 500
ToPort: 500
IpProtocol: udp

WorkerIngressIpsecNat:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt WorkerSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
Description: IPsec NAT-T packets
FromPort: 4500
ToPort: 4500
IpProtocol: udp

WorkerIngressIpsecEsp:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt WorkerSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
Description: IPsec ESP packets
IpProtocol: esp

WorkerIngressMasterIpsecIke:
markdgray marked this conversation as resolved.
Show resolved Hide resolved
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt WorkerSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
Description: IPsec IKE packets
FromPort: 500
ToPort: 500
IpProtocol: udp

WorkerIngressMasterIpsecNat:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt WorkerSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
Description: IPsec NAT-T packets
FromPort: 4500
ToPort: 4500
IpProtocol: udp

WorkerIngressMasterIpsecEsp:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !GetAtt WorkerSecurityGroup.GroupId
SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
Description: IPsec ESP packets
IpProtocol: esp

WorkerIngressInternal:
Type: AWS::EC2::SecurityGroupIngress
Properties:
Expand Down
5 changes: 5 additions & 0 deletions upi/gcp/03_firewall.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,11 @@ def GenerateConfig(context):
'allowed': [{
'IPProtocol': 'udp',
'ports': ['4789', '6081']
},{
'IPProtocol': 'udp',
'ports': ['500', '4500']
},{
'IPProtocol': 'esp',
},{
'IPProtocol': 'tcp',
'ports': ['9000-9999']
Expand Down
32 changes: 32 additions & 0 deletions upi/openstack/security-groups.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,22 @@
port_range_min: 6081
port_range_max: 6081

- name: 'Create master-sg rule "IPsec IKE"'
os_security_group_rule:
security_group: "{{ os_sg_master }}"
protocol: udp
remote_ip_prefix: "{{ os_subnet_range }}"
port_range_min: 500
port_range_max: 500

- name: 'Create master-sg rule "IPsec NAT-T"'
os_security_group_rule:
security_group: "{{ os_sg_master }}"
protocol: udp
markdgray marked this conversation as resolved.
Show resolved Hide resolved
remote_ip_prefix: "{{ os_subnet_range }}"
port_range_min: 4500
port_range_max: 4500

- name: 'Create master-sg rule "ovndb"'
os_security_group_rule:
security_group: "{{ os_sg_master }}"
Expand Down Expand Up @@ -230,6 +246,22 @@
port_range_min: 6081
port_range_max: 6081

- name: 'Create worker-sg rule "IPsec IKE"'
os_security_group_rule:
security_group: "{{ os_sg_worker }}"
protocol: udp
remote_ip_prefix: "{{ os_subnet_range }}"
port_range_min: 500
port_range_max: 500

- name: 'Create worker-sg rule "IPsec NAT-T"'
os_security_group_rule:
security_group: "{{ os_sg_worker }}"
protocol: udp
remote_ip_prefix: "{{ os_subnet_range }}"
port_range_min: 4500
port_range_max: 4500

- name: 'Create worker-sg rule "worker ingress internal (TCP)"'
os_security_group_rule:
security_group: "{{ os_sg_worker }}"
Expand Down