You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
However, when testing offline-mode, I have to limit these rules to restrict traffic only within the cluster and block access to the Internet with the following rule:
- name: out
description: Deny internet access
direction: Egress
protocol: "all"
destination_port_range: "0"
source_address_prefix: "0.0.0.0/0"
destination_address_prefix: "10.1.0.0/20"
Validation does not allow this CIDR to be used.
2022-02-09T15:45:50.7212779Z �[38;21m15:45:50 INFO cli.src.schema.SchemaValidator - Validating: infrastructure/virtual-machine - ci-devofawsrhelflannel-repository-vm-0�[0m
2022-02-09T15:45:50.7269660Z �[31;21m15:45:50 ERROR cli.src.schema.SchemaValidator - Failed validating: infrastructure/virtual-machine�[0m
2022-02-09T15:45:50.7275496Z �[31;21m15:45:50 ERROR cli.src.schema.SchemaValidator - '10.1.0.0/20' is not one of ['0.0.0.0/0']
2022-02-09T15:45:50.7275835Z
2022-02-09T15:45:50.7276795Z Failed validating 'enum' in schema['properties']['specification']['properties']['security']['properties']['rules']['items']['properties']['destination_address_prefix']:
2022-02-09T15:45:50.7277856Z {'enum': ['0.0.0.0/0'], 'type': 'string'}
2022-02-09T15:45:50.7278080Z
2022-02-09T15:45:50.7278819Z On instance['specification']['security']['rules'][0]['destination_address_prefix']:
2022-02-09T15:45:50.7279436Z '10.1.0.0/20'�[0m
2022-02-09T15:45:50.7280107Z �[38;21m15:45:50 INFO cli.src.schema.SchemaValidator - Step finished in: 0.10s�[0m
How to reproduce
Steps to reproduce the behavior:
Modify NSG rules and execute epicli apply
Expected behavior
The cluster should be deployed without any problems with custom rules.
Environment
Cloud provider: [AWS]
OS: [all]
epicli version: [2.0.0dev]
Additional context
Add any other context about the problem here.
DoD checklist
Changelog
updated
not needed
COMPONENTS.md
updated
not needed
Schema
updated
not needed
Backport tasks
created
not needed
Documentation
added
updated
not needed
Feature has automated tests
Automated tests passed (QA pipelines)
apply
upgrade
backup/restore
Idempotency tested
All conversations in PR resolved
The text was updated successfully, but these errors were encountered:
Describe the bug
In the security groups on AWS, we use the destination_address_prefix that is
0.0.0.0/0
by default, which allows all outgoing traffic.Additionally, extra validation has been added recently for this filed: https://github.com/epiphany-platform/epiphany/blob/develop/schema/aws/validation/infrastructure/virtual-machine.yml#L92
However, when testing offline-mode, I have to limit these rules to restrict traffic only within the cluster and block access to the Internet with the following rule:
Validation does not allow this CIDR to be used.
How to reproduce
Steps to reproduce the behavior:
epicli apply
Expected behavior
The cluster should be deployed without any problems with custom rules.
Environment
epicli version: [
2.0.0dev
]Additional context
Add any other context about the problem here.
DoD checklist
The text was updated successfully, but these errors were encountered: