Andrew Bogott has submitted this change and it was merged.
Change subject: contint: move iptables rule for zuul-merger git daemon
......................................................................
contint: move iptables rule for zuul-merger git daemon
The zuul mergers expose their git repository to the slaves via
git-daemon. The ferm rule was in contint::firewall which is only
applied on gallium (the CI master for a bunch of things).
We are adding a zuul-merger instance on scandium and hence need the ferm
rule to be attached to the role::zuul::merger class.
Impact:
gallium.wikimedia.org
scandium.eqiad.wmnet
Bug: T95046
Change-Id: Ib565995b7e39732ba3b60d6c275c0e0a2d3fec1b
---
M manifests/role/zuul.pp
M modules/contint/manifests/firewall.pp
2 files changed, 9 insertions(+), 7 deletions(-)
Approvals:
Andrew Bogott: Looks good to me, approved
Hashar: Looks good to me, but someone else must approve
jenkins-bot: Verified
diff --git a/manifests/role/zuul.pp b/manifests/role/zuul.pp
index 5031bf0..c644b00 100644
--- a/manifests/role/zuul.pp
+++ b/manifests/role/zuul.pp
@@ -144,4 +144,13 @@
zuul_git_dir =>
$role::zuul::configuration::merger[$::realm]['git_dir'],
}
+ # We run a git-daemon process to exposes the zuul-merger git repositories.
+ # The slaves fetch changes from it over the git:// protocol.
+ # It is only meant to be used from slaves, so only accept internal
+ # connections.
+ ferm::rule { 'git-daemon_internal':
+ rule => 'proto tcp dport 9418 { saddr $INTERNAL ACCEPT; }'
+ }
+
+
} # /role::zuul::merger
diff --git a/modules/contint/manifests/firewall.pp
b/modules/contint/manifests/firewall.pp
index 201bf68..12ff738 100644
--- a/modules/contint/manifests/firewall.pp
+++ b/modules/contint/manifests/firewall.pp
@@ -40,13 +40,6 @@
srange => $nodepool_host,
}
- # The master runs a git-daemon process used by slave to fetch changes from
- # the Zuul git repository. It is only meant to be used from slaves, so
- # reject outside calls.
- ferm::rule { 'git-daemon_internal':
- rule => 'proto tcp dport 9418 { saddr $INTERNAL ACCEPT; }'
- }
-
# Need to grant ytterbium ssh access for git
ferm::rule { 'ytterbium_ssh':
rule => 'proto tcp dport ssh { saddr (208.80.154.80 208.80.154.81
2620:0:861:3:92b1:1cff:fe2a:e60 2620:0:861:3:208:80:154:80
2620:0:861:3:208:80:154:81) ACCEPT; }'
--
To view, visit https://gerrit.wikimedia.org/r/253893
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ib565995b7e39732ba3b60d6c275c0e0a2d3fec1b
Gerrit-PatchSet: 2
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Hashar <[email protected]>
Gerrit-Reviewer: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Hashar <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
