Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Validation blocks overwriting of destination_address_prefix in NSG rules, which is 0.0.0.0/0 by default. #2984

Closed
7 of 18 tasks
przemyslavic opened this issue Feb 16, 2022 · 1 comment
Assignees
Labels

Comments

@przemyslavic
Copy link
Collaborator

przemyslavic commented Feb 16, 2022

Describe the bug
In the security groups on AWS, we use the destination_address_prefix that is 0.0.0.0/0 by default, which allows all outgoing traffic.
Additionally, extra validation has been added recently for this filed: https://github.com/epiphany-platform/epiphany/blob/develop/schema/aws/validation/infrastructure/virtual-machine.yml#L92

However, when testing offline-mode, I have to limit these rules to restrict traffic only within the cluster and block access to the Internet with the following rule:

     - name: out
       description: Deny internet access
       direction: Egress
       protocol: "all"
       destination_port_range: "0"
       source_address_prefix: "0.0.0.0/0"
       destination_address_prefix: "10.1.0.0/20"

Validation does not allow this CIDR to be used.

2022-02-09T15:45:50.7212779Z �[38;21m15:45:50 INFO cli.src.schema.SchemaValidator - Validating: infrastructure/virtual-machine - ci-devofawsrhelflannel-repository-vm-0�[0m
2022-02-09T15:45:50.7269660Z �[31;21m15:45:50 ERROR cli.src.schema.SchemaValidator - Failed validating: infrastructure/virtual-machine�[0m
2022-02-09T15:45:50.7275496Z �[31;21m15:45:50 ERROR cli.src.schema.SchemaValidator - '10.1.0.0/20' is not one of ['0.0.0.0/0']
2022-02-09T15:45:50.7275835Z 
2022-02-09T15:45:50.7276795Z Failed validating 'enum' in schema['properties']['specification']['properties']['security']['properties']['rules']['items']['properties']['destination_address_prefix']:
2022-02-09T15:45:50.7277856Z     {'enum': ['0.0.0.0/0'], 'type': 'string'}
2022-02-09T15:45:50.7278080Z 
2022-02-09T15:45:50.7278819Z On instance['specification']['security']['rules'][0]['destination_address_prefix']:
2022-02-09T15:45:50.7279436Z     '10.1.0.0/20'�[0m
2022-02-09T15:45:50.7280107Z �[38;21m15:45:50 INFO cli.src.schema.SchemaValidator - Step finished in: 0.10s�[0m

How to reproduce
Steps to reproduce the behavior:

  1. Modify NSG rules and execute epicli apply

Expected behavior
The cluster should be deployed without any problems with custom rules.

Environment

  • Cloud provider: [AWS]
  • OS: [all]

epicli version: [2.0.0dev]

Additional context
Add any other context about the problem here.


DoD checklist

  • Changelog
    • updated
    • not needed
  • COMPONENTS.md
    • updated
    • not needed
  • Schema
    • updated
    • not needed
  • Backport tasks
    • created
    • not needed
  • Documentation
    • added
    • updated
    • not needed
  • Feature has automated tests
  • Automated tests passed (QA pipelines)
    • apply
    • upgrade
    • backup/restore
  • Idempotency tested
  • All conversations in PR resolved
@seriva seriva self-assigned this Feb 16, 2022
@seriva seriva mentioned this issue Feb 16, 2022
seriva added a commit that referenced this issue Feb 16, 2022
* Fix for #2984
* Update docs/changelogs/CHANGELOG-2.0.md

Co-authored-by: to-bar <[email protected]>
@przemyslavic przemyslavic self-assigned this Feb 17, 2022
@przemyslavic
Copy link
Collaborator Author

✔️ Tested with custom NSG rules.

@seriva seriva closed this as completed Feb 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants