github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HA master: add firewall rule for etcd cluster.

Browse Source 
HA master: add firewall rule for accessing & securing etcd cluster.
This commit is contained in:
Jerzy Szczepkowski
2016-09-20 16:34:56 +02:00
parent 66d67ee41d
commit b8cbac6753
1 changed files with 30 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
cluster/gce/util.sh
View File

@@ -655,12 +655,22 @@ function create-network() {
gcloud compute networks create --project "${PROJECT}" "${NETWORK}" --range "10.240.0.0/16" gcloud compute networks create --project "${PROJECT}" "${NETWORK}" --range "10.240.0.0/16"
fi fi
if ! gcloud compute firewall-rules --project "${PROJECT}" describe "${NETWORK}-default-internal" &>/dev/null; then if ! gcloud compute firewall-rules --project "${PROJECT}" describe "${NETWORK}-default-internal-master" &>/dev/null; then
gcloud compute firewall-rules create "${NETWORK}-default-internal" \ gcloud compute firewall-rules create "${NETWORK}-default-internal-master" \
--project "${PROJECT}" \ --project "${PROJECT}" \
--network "${NETWORK}" \ --network "${NETWORK}" \
--source-ranges "10.0.0.0/8" \ --source-ranges "10.0.0.0/8" \
--allow "tcp:1-65535,udp:1-65535,icmp" & --allow "tcp:1-2379,tcp:2382-65535,udp:1-65535,icmp" \
--target-tags "${MASTER_TAG}"&
fi
if ! gcloud compute firewall-rules --project "${PROJECT}" describe "${NETWORK}-default-internal-node" &>/dev/null; then
gcloud compute firewall-rules create "${NETWORK}-default-internal-node" \
--project "${PROJECT}" \
--network "${NETWORK}" \
--source-ranges "10.0.0.0/8" \
--allow "tcp:1-65535,udp:1-65535,icmp" \
--target-tags "${NODE_TAG}"&
fi fi
if ! gcloud compute firewall-rules describe --project "${PROJECT}" "${NETWORK}-default-ssh" &>/dev/null; then if ! gcloud compute firewall-rules describe --project "${PROJECT}" "${NETWORK}-default-ssh" &>/dev/null; then
@@ -709,6 +719,16 @@ function create-master() {
--size "${CLUSTER_REGISTRY_DISK_SIZE}" & --size "${CLUSTER_REGISTRY_DISK_SIZE}" &
fi fi
# Create rule for accessing and securing etcd servers.
if ! gcloud compute firewall-rules --project "${PROJECT}" describe "${MASTER_NAME}-etcd" &>/dev/null; then
gcloud compute firewall-rules create "${MASTER_NAME}-etcd" \
--project "${PROJECT}" \
--network "${NETWORK}" \
--source-tags "${MASTER_TAG}" \
--allow "tcp:2380,tcp:2381" \
--target-tags "${MASTER_TAG}" &
fi
# Generate a bearer token for this cluster. We push this separately # Generate a bearer token for this cluster. We push this separately
# from the other cluster variables so that the client (this # from the other cluster variables so that the client (this
# computer) can forget it later. This should disappear with # computer) can forget it later. This should disappear with
@@ -1261,6 +1281,13 @@ function kube-down() {
--quiet \ --quiet \
"${NODE_TAG}-all" "${NODE_TAG}-all"
fi fi
# Delete firewall rule for etcd servers.
if ! gcloud compute firewall-rules --project "${PROJECT}" describe "${MASTER_NAME}-etcd" &>/dev/null; then
gcloud compute firewall-rules delete \
--project "${PROJECT}" \
--quiet \
"${MASTER_NAME}-etcd"
fi
fi fi
if [[ "${KUBE_DELETE_NODES:-}" != "false" ]]; then if [[ "${KUBE_DELETE_NODES:-}" != "false" ]]; then