zecfoundation
/
cloud-foundation-fabric
mirror of https://github.com/ZcashFoundation/cloud-foundation-fabric.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

logging for default ingress rules in FAST (#2030) 

* Add default ingress deny rule with logging to FAST net stages.

Fixes #2024

* Allow firewall factory to omit rules key

* Fix tests

* Fix fast tests

* fix fast tests
This commit is contained in:
Julio Castillo 2024-01-30 17:53:01 +01:00 committed by GitHub
parent 7b58114d65
commit da95434308
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
22 changed files with 161 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
fast/stages/2-networking-a-peering/data/firewall-rules/dev/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-a-peering/data/firewall-rules/landing/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-a-peering/data/firewall-rules/prod/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-b-vpn/data/firewall-rules/dev/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-b-vpn/data/firewall-rules/landing/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-b-vpn/data/firewall-rules/prod/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-c-nva/data/firewall-rules/dev/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-c-nva/data/firewall-rules/landing-trusted/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
trusted-ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-c-nva/data/firewall-rules/landing-untrusted/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
untrusted-ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-c-nva/data/firewall-rules/prod/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-d-separate-envs/data/firewall-rules/dev/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-d-separate-envs/data/firewall-rules/prod/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-e-nva-bgp/data/firewall-rules/dev/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-e-nva-bgp/data/firewall-rules/landing-trusted/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
trusted-ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-e-nva-bgp/data/firewall-rules/landing-untrusted/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
untrusted-ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

9
fast/stages/2-networking-e-nva-bgp/data/firewall-rules/prod/default-ingress.yaml Normal file
View File

@ -0,0 +1,9 @@
# skip boilerplate check
ingress:
ingress-default-deny:
description: "Deny and log any unmatched ingress traffic."
deny: true
priority: 65535
enable_logging:
include_metadata: false

4
modules/net-vpc-firewall/main.tf
View File

@ -1,5 +1,5 @@
/**
* Copyright 2022 Google LLC
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -27,7 +27,7 @@ locals {
for name, rule in ruleset : {
name = name
deny = try(rule.deny, false)
rules = try(rule.rules, [{ protocol = "all" }])
rules = try(rule.rules, [{ protocol = "all", ports = null }])
description = try(rule.description, null)
destination_ranges = try(rule.destination_ranges, null)
direction = upper(direction)

6
tests/fast/stages/s2_networking_a_peering/stage.yaml
View File

@ -1,4 +1,4 @@
# Copyright 2023 Google LLC
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -13,5 +13,5 @@
# limitations under the License.
counts:
modules: 28
resources: 148
modules: 29
resources: 151

6
tests/fast/stages/s2_networking_b_vpn/stage.yaml
View File

@ -1,4 +1,4 @@
# Copyright 2023 Google LLC
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -13,5 +13,5 @@
# limitations under the License.
counts:
modules: 30
resources: 185
modules: 31
resources: 188

6
tests/fast/stages/s2_networking_c_nva/stage.yaml
View File

@ -1,4 +1,4 @@
# Copyright 2023 Google LLC
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -13,5 +13,5 @@
# limitations under the License.
counts:
modules: 42
resources: 195
modules: 43
resources: 199

6
tests/fast/stages/s2_networking_d_separate_envs/stage.yaml
View File

@ -1,4 +1,4 @@
# Copyright 2023 Google LLC
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -13,5 +13,5 @@
# limitations under the License.
counts:
modules: 21
resources: 170
modules: 22
resources: 172

6
tests/fast/stages/s2_networking_e_nva_bgp/stage.yaml
View File

@ -1,4 +1,4 @@
# Copyright 2023 Google LLC
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -13,5 +13,5 @@
# limitations under the License.
counts:
modules: 36
resources: 206
modules: 37
resources: 210