CadolesKube/typhoon
7
0
Fork 0
mirror of https://github.com/puppetmaster/typhoon.git synced 2025-07-22 19:31:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add firewall and security rules for Cilium/Hubble metrics

Browse Source 
* Add firewall or security riles to allow node-to-node traffic
on ports 9962-9965 for Cilium and Hubble metrics. Cilium runs
with host network, so these require cloud firewall changes
This commit is contained in:
Dalton Hubble
2024-05-13 08:38:36 -07:00
parent 1d63592c42
commit cc80ec9b98
9 changed files with 199 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
google-cloud/flatcar-linux/kubernetes/network.tf
View File

@ -112,13 +112,14 @@ resource "google_compute_firewall" "internal-vxlan" {
target_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
}
# Cilium VXLAN
resource "google_compute_firewall" "internal-linux-vxlan" {
# Cilium
resource "google_compute_firewall" "internal-cilium" {
count = var.networking == "cilium" ? 1 : 0
name = "${var.cluster_name}-linux-vxlan"
name = "${var.cluster_name}-cilium"
network = google_compute_network.network.name
# vxlan
allow {
protocol = "udp"
ports = [8472]
@ -128,12 +129,17 @@ resource "google_compute_firewall" "internal-linux-vxlan" {
allow {
protocol = "icmp"
}
allow {
protocol = "tcp"
ports = [4240]
}
# metrics
allow {
protocol = "tcp"
ports = [9962, 9963, 9964, 9965]
}
source_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
target_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
}