philipp/uncloud
1
0
Fork 0
mirror of https://github.com/psviderski/uncloud.git synced 2026-08-26 19:13:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: add firewall rule to allow cluster machines to push to other machines unregistry

Browse Source
This commit is contained in:
Pasha Sviderski
2025-10-01 12:34:03 +10:00
parent a217643ac9
commit fa004d63bb
3 changed files with 27 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/machine/cluster.go
+1 -1
View File
@@ -92,7 +92,7 @@ func newClusterController(
func (cc *clusterController) Run(ctx context.Context) error { func (cc *clusterController) Run(ctx context.Context) error {
defer close(cc.stopped) defer close(cc.stopped)
if err := firewall.ConfigureIptablesChains(); err != nil { if err := firewall.ConfigureIptablesChains(network.MachineIP(cc.state.Network.Subnet)); err != nil {
return fmt.Errorf("configure iptables chains: %w", err) return fmt.Errorf("configure iptables chains: %w", err)
} }
internal/machine/firewall/iptables_darwin.go
+5 -2
View File
@@ -1,9 +1,12 @@
package firewall package firewall
import "fmt" import (
"fmt"
"net/netip"
)
// ConfigureIptablesChains is a stub for Darwin. // ConfigureIptablesChains is a stub for Darwin.
func ConfigureIptablesChains() error { func ConfigureIptablesChains(machineIP netip.Addr) error {
return fmt.Errorf("not supported on Darwin") return fmt.Errorf("not supported on Darwin")
} }
internal/machine/firewall/iptables_linux.go
+21 -6
View File
@@ -3,6 +3,7 @@ package firewall
import ( import (
"fmt" "fmt"
"log/slog" "log/slog"
"net/netip"
"strconv" "strconv"
"strings" "strings"
@@ -18,7 +19,7 @@ const (
) )
// ConfigureIptablesChains sets up custom iptables chains and initial firewall rules for Uncloud networking. // ConfigureIptablesChains sets up custom iptables chains and initial firewall rules for Uncloud networking.
func ConfigureIptablesChains() error { func ConfigureIptablesChains(machineIP netip.Addr) error {
if err := createIptablesChains(); err != nil { if err := createIptablesChains(); err != nil {
return err return err
} }
@@ -27,10 +28,24 @@ func ConfigureIptablesChains() error {
ipt6 := iptables.GetIptable(iptables.IPv6) ipt6 := iptables.GetIptable(iptables.IPv6)
// Allow WireGuard traffic to the machine. // Allow WireGuard traffic to the machine.
acceptWireGuardRule := []string{"-p", "udp", "--dport", strconv.Itoa(network.WireGuardPort), "-j", "ACCEPT"} acceptWireGuardRule := []string{
err := ipt4.ProgramRule(iptables.Filter, UncloudInputChain, iptables.Insert, acceptWireGuardRule) "-p", "udp",
if err != nil { "--dport", strconv.Itoa(network.WireGuardPort),
return fmt.Errorf("insert iptables rule '%s': %w", strings.Join(acceptWireGuardRule, " "), err) "-j", "ACCEPT",
}
// Allow cluster machines to access the unregistry (embedded image registry) on the machine to push/pull images.
// TODO: allow access only from the machine IPs (10.210.N.1) but not the containers running on them. Use ipset?
acceptUnregistryRule := []string{
"-i", network.WireGuardInterfaceName,
"-d", machineIP.String(),
"-p", "tcp",
"--dport", strconv.Itoa(constants.UnregistryPort),
"-j", "ACCEPT",
}
for _, rule := range [][]string{acceptUnregistryRule, acceptWireGuardRule} {
if err := ipt4.ProgramRule(iptables.Filter, UncloudInputChain, iptables.Insert, rule); err != nil {
return fmt.Errorf("insert iptables rule '%s': %w", strings.Join(rule, " "), err)
}
} }
// Allow cluster machines to access Machine API via the management IPv6 WireGuard network. // Allow cluster machines to access Machine API via the management IPv6 WireGuard network.
@@ -50,7 +65,7 @@ func ConfigureIptablesChains() error {
"-j", "ACCEPT", "-j", "ACCEPT",
} }
for _, rule := range [][]string{acceptMachineAPIRule, acceptCorrosionGossipRule} { for _, rule := range [][]string{acceptMachineAPIRule, acceptCorrosionGossipRule} {
if err = ipt6.ProgramRule(iptables.Filter, UncloudInputChain, iptables.Insert, rule); err != nil { if err := ipt6.ProgramRule(iptables.Filter, UncloudInputChain, iptables.Insert, rule); err != nil {
return fmt.Errorf("insert ip6tables rule '%s': %w", strings.Join(rule, " "), err) return fmt.Errorf("insert ip6tables rule '%s': %w", strings.Join(rule, " "), err)
} }
} }