AGENT-925: Block port 22624 when adding day 2 worker node #1671
Conversation
22624 is the insecure port for the machine config server. Day 2 nodes should be communicating through the secure port 22623. By blocking the insecure port for extra worker nodes, we force them to use the secure port. The filter isn't applied to master or worker nodes because they fetch their ignition through the secure port during initial installation.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
|
||
| sudo virsh define ${tmpdomain} | ||
| done | ||
| } |
There was a problem hiding this comment.
Maybe I'm oversimplifying it a little bit, but wouldn't be enough to execute a simple ansible playbook like the following (similar to the ones used in metal3-dev-env):
tasks:
- name: Block port 22624 using firewalld
firewalld:
port: 22624/tcp
state: disabled
immediate: yes
permanent: yes
on each control plane (master) node? Given also that this is a specific requirement for the add nodes workflow, it could be probably a task executed only in the new step
| @@ -519,6 +549,8 @@ if [[ "${AGENT_PLATFORM_TYPE}" == "external" ]] || [[ "${AGENT_PLATFORM_TYPE}" = | |||
| set_device_mfg worker $NUM_WORKERS ${AGENT_PLATFORM_TYPE} ${AGENT_PLATFORM_NAME} | |||
| fi | |||
|
|
|||
| block_insecure_machine_config_server_port extraworker $NUM_EXTRA_WORKERS | |||
There was a problem hiding this comment.
As mentioned before, I was expecting the port to be blocked on the control plane nodes, more than on the hosts to be added
22624 is the insecure port for the machine config server. Day 2
nodes should be communicating through the secure port 22623. By
blocking the insecure port for extra worker nodes, we force them
to use the secure port.
The filter isn't applied to master or worker nodes because they
fetch their ignition through the secure port during initial
installation.