juju openstack environments have no security
Bug #1226996 reported by
Kapil Thangavelu
This bug affects 2 people
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Go OpenStack Exchange |
Invalid
|
High
|
Unassigned | ||
juju-core |
Fix Released
|
Critical
|
John A Meinel | ||
1.14 |
Fix Released
|
Critical
|
John A Meinel |
Bug Description
Every environment on the openstack provider has no network security. The security rule for internal ingress was fubar'd to allow access to the entire world. It means expose/unexpose is meaningless, and anything listening on a port is available to the world by default.
Related branches
lp://staging/~jameinel/juju-core/security-group-group-id-1226996
- Juju Engineering: Pending requested
-
Diff: 238 lines (+144/-9)4 files modifiedenvirons/jujutest/livetests.go (+4/-0)
provider/openstack/export_test.go (+24/-0)
provider/openstack/live_test.go (+86/-0)
provider/openstack/provider.go (+30/-9)
lp://staging/~jameinel/goose/security-group-rule-group-id-1226996
- Juju Engineering: Pending requested
-
Diff: 62 lines (+12/-5)2 files modifiedtestservices/novaservice/service.go (+7/-0)
testservices/novaservice/service_test.go (+5/-5)
lp://staging/~gz/juju-core/trunk-security-group-group-id-1226996
- Juju Engineering: Pending requested
-
Diff: 238 lines (+142/-9)4 files modifiedenvirons/jujutest/livetests.go (+4/-0)
provider/openstack/export_test.go (+24/-0)
provider/openstack/live_test.go (+84/-0)
provider/openstack/provider.go (+30/-9)
Changed in juju-core: | |
assignee: | nobody → John A Meinel (jameinel) |
information type: | Private Security → Public Security |
Changed in juju-core: | |
status: | Triaged → Fix Committed |
milestone: | none → 1.15.0 |
Changed in juju-core: | |
status: | Fix Committed → Fix Released |
To post a comment you must log in.
Essentially, we don't set a Cidr, so openstack is picking 0.0.0.0/0 by default, and we failed to set the group_id (and possibly parent_group_id). To be fair, it isn't actually documented in their API docs (that I can find) docs.openstack. org/api/ openstack- network/ 2.0/content/ POST_createSecG roupRule_ _security- group-rules_ .html docs.openstack. org/trunk/ openstack- network/ admin/content/ securitygroup_ api_abstraction s.html
http://
http://
but we are passing parent_group_id and group_id in the Python implementation.