This repository has been archived by the owner on Oct 22, 2021. It is now read-only.
Remove security group that allows apps to communicate with internal network #304
Labels
Milestone
Comments
mook-as
added a commit
to mook-as/kubecf
that referenced
this issue
Jan 14, 2020
This adds a //dev/minikube:load bazel rule that, when run, will build a golang-based program (which does nothing useful as of now) and loads it into the minikube VM. This is in preparation for adding a job to set up application security groups in the cloud controller to allow applications to access credhub (but only credhub) in support of cloudfoundry-incubator#304.
mook-as
added a commit
that referenced
this issue
Jan 23, 2020
This adds a //dev/minikube:load bazel rule that, when run, will build a golang-based program (which does nothing useful as of now) and loads it into the minikube VM. This is in preparation for adding a job to set up application security groups in the cloud controller to allow applications to access credhub (but only credhub) in support of #304.
mook-as
added a commit
to mook-as/kubecf
that referenced
this issue
Jan 29, 2020
This adds a //dev/minikube:load bazel rule that, when run, will build a golang-based program (which does nothing useful as of now) and loads it into the minikube VM. This is in preparation for adding a job to set up application security groups in the cloud controller to allow applications to access credhub (but only credhub) in support of cloudfoundry-incubator#304.
7 tasks
fargozhu
added
the
Status: Blocked
fargozhu
removed
the
Status: Blocked
fargozhu
added
SUSE
fargozhu
added
Status: WIP
and removed
Status: Accepted
fargozhu
added
the
Status: Verification Needed
7 tasks
fargozhu
removed
Status: Verification Needed
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Describe the bug
Replaces #297.
The pod and service CIDRs are currently required to created an app security group that allows connections to the internal k8s network. It allows connection to service brokers like
credhub.To Reproduce
Always.
Expected behavior
This approach is erroneous and we should allow only the
credhubIP.An auto-errand can take care of it by resolving
credhub.service.cf.internaland creating a security group allowing apps to communicate with this IP. We also should addfeatures.credhub.enabled=trueas default, but removecredhuband the auto-errand when this setting isfalse, allowing the usage of an externalcredhubinstance.Environment
Kubecf 0.1, all platforms.
The text was updated successfully, but these errors were encountered: