Skip to content

Commit 3838a0a

Browse files
author
Matthew Fisher
committed
Merge pull request #4333 from laurrentt/router-whitelist
feat(Router): IP whitelisting for apps and controller
2 parents c854faf + 21d6305 commit 3838a0a

5 files changed

Lines changed: 71 additions & 1 deletion

File tree

‎docs/customizing_deis/router_settings.rst‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,10 @@ setting description
3434
======================================= ==================================================================================================================================================================================================================================================================================================================================
3535
/deis/builder/host host of the builder component (set by builder)
3636
/deis/builder/port port of the builder component (set by builder)
37+
/deis/config/\*/deis_whitelist comma separated list of IPs (or CIDR) allowed to connect to the application containers (set by controller) Example: "0.0.0.0:some_optional_label,10.0.0.0/8"
3738
/deis/controller/host host of the controller component (set by controller)
3839
/deis/controller/port port of the controller component (set by controller)
39-
/deis/domains/* domain configuration for applications (set by controller)
40+
/deis/domains/\* domain configuration for applications (set by controller)
4041
/deis/router/affinityArg for requests with the indicated query string variable, hash its contents to perform session affinity (default: undefined)
4142
/deis/router/bodySize nginx body size setting (default: 1m)
4243
/deis/router/defaultTimeout default timeout value in seconds. Should be greater then the frontfacing load balancers timeout value (default: 1300)
@@ -45,7 +46,9 @@ setting description
4546
/deis/router/controller/timeout/connect proxy_connect_timeout for deis-controller (default: 10m)
4647
/deis/router/controller/timeout/read proxy_read_timeout for deis-controller (default: 20m)
4748
/deis/router/controller/timeout/send proxy_send_timeout for deis-controller (default: 20m)
49+
/deis/router/controller/whitelist comma separated list of IPs (or CIDR) allowed to connect to the controller (default: not set) Example: "0.0.0.0:some_optional_label,10.0.0.0/8"
4850
/deis/router/enforceHTTPS redirect all HTTP traffic to HTTPS (default: false)
51+
/deis/router/enforceWhitelist deny all connections unless specifically whitelisted (default: false)
4952
/deis/router/firewall/enabled nginx naxsi firewall enabled (default: false)
5053
/deis/router/firewall/errorCode nginx default firewall error code (default: 400)
5154
/deis/router/errorLogLevel nginx error_log level (default: error) Valid options: debug, info, notice, warn, error, crit, alert, emerg

‎docs/managing_deis/security_considerations.rst‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,24 @@ The :ref:`Router` component includes a firewall to help thwart attacks. It can b
8181
``deisctl config router set firewall/enabled=true``. For more information, see the `router README`_
8282
and :ref:`router_settings`.
8383

84+
IP Whitelist
85+
------------
86+
You can enforce cluster-wide IP whitelisting by running ``deisctl config router set enforceWhitelist=true``.
87+
Then you'll have to manually whitelist IPs to the applications using the config endpoint of the deis
88+
client. The format is ``{IP_or_CIDR}:{Optional_label},...``. For example:
89+
90+
.. code-block:: console
91+
92+
$ deis config:set -a your-app DEIS_WHITELIST="10.0.1.0/24:office_ABC,212.121.212.121:client_YXZ"
93+
94+
The format is the same for the controller whitelist but you need to specify the list directly into
95+
ectd. For example:
96+
97+
.. code-block:: console
98+
99+
$ deisctl config router set controller/whitelist="10.0.1.0/24:office_intranet,121.212.121.212:dev_jenkins"
100+
101+
84102
.. _`#986`: https://github.com/deis/deis/issues/986
85103
.. _`contrib/util/custom-firewall.sh`: https://github.com/deis/deis/blob/master/contrib/util/custom-firewall.sh
86104
.. _`router README`: https://github.com/deis/deis/blob/master/router/README.md

‎router/cmd/boot/boot.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ func main() {
5252
time.Sleep(timeout + 1)
5353

5454
log.Debug("creating required defaults in etcd...")
55+
mkdirEtcd(client, "/deis/config")
5556
mkdirEtcd(client, "/deis/controller")
5657
mkdirEtcd(client, "/deis/services")
5758
mkdirEtcd(client, "/deis/domains")

‎router/rootfs/etc/confd/conf.d/nginx.conf.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ uid = 0
55
gid = 0
66
mode = "0644"
77
keys = [
8+
"/deis/config",
89
"/deis/services",
910
"/deis/router",
1011
"/deis/domains",

‎router/rootfs/etc/confd/templates/nginx.conf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,9 @@ http {
8383
## since HSTS headers are not permitted on HTTP requests, 301 redirects to HTTPS resources are also necessary
8484
{{ $enforceHTTPS := or (getv "/deis/router/enforceHTTPS") $enableHSTS "false" }}
8585

86+
{{/* Enabling the enforceWhitelist option deny all connections except those from IPs explicitly allowed */}}
87+
{{ $enforceWhitelist := or (getv "/deis/router/enforceWhitelist") "false" }}
88+
8689
## start deis-controller
8790
{{ if exists "/deis/controller/host" }}
8891
upstream deis-controller {
@@ -94,6 +97,20 @@ http {
9497
server_name ~^{{ or (getv "/deis/controller/subdomain") "deis" }}\.(?<domain>.+)$;
9598
include deis.conf;
9699

100+
{{/* IP Whitelisting */}}
101+
{{ $controllerHasWhitelist := exists "/deis/router/controller/whitelist" }}
102+
{{ if $controllerHasWhitelist }}
103+
## Only connections from the following addresses are allowed
104+
{{ $whitelist := getv "/deis/router/controller/whitelist" }}
105+
{{ range $whitelist_entry := split $whitelist "," }}
106+
{{ $whitelist_detail := split $whitelist_entry ":" }}
107+
allow {{index $whitelist_detail 0}};{{if eq (len $whitelist_detail) 2}} # {{index $whitelist_detail 1}}{{ end }}
108+
{{ end }}
109+
{{ end }}
110+
{{ if or (eq $enforceWhitelist "true") $controllerHasWhitelist }}
111+
deny all;
112+
{{ end }}
113+
97114
{{ if exists "/deis/controller/host" }}
98115
location / {
99116
{{ if eq $useFirewall "true" }}include /opt/nginx/firewall/active-mode.rules;{{ end }}
@@ -207,6 +224,21 @@ http {
207224
{{ else }}
208225
include deis.conf;
209226
{{ end }}
227+
228+
{{/* IP Whitelisting */}}
229+
{{ $appHasWhitelist := exists (printf "/deis/config/%s/deis_whitelist" $app) }}
230+
{{ if $appHasWhitelist }}
231+
## Only connections from the following addresses are allowed
232+
{{ $whitelist := getv (printf "/deis/config/%s/deis_whitelist" $app) }}
233+
{{ range $whitelist_entry := split $whitelist "," }}
234+
{{ $whitelist_detail := split $whitelist_entry ":" }}
235+
allow {{index $whitelist_detail 0}};{{if eq (len $whitelist_detail) 2}} # {{index $whitelist_detail 1}}{{ end }}
236+
{{ end }}
237+
{{ end }}
238+
{{ if or (eq $enforceWhitelist "true") $appHasWhitelist}}
239+
deny all;
240+
{{ end }}
241+
210242
{{ if ne $appContainerLen 0 }}
211243
location / {
212244
{{ if eq $useFirewall "true" }}include /opt/nginx/firewall/active-mode.rules;{{ end }}
@@ -269,6 +301,21 @@ http {
269301
server {
270302
server_name ~^{{ $app }}\.(?<domain>.+)$;
271303
include deis.conf;
304+
305+
{{/* IP Whitelisting */}}
306+
{{ $appHasWhitelist := exists (printf "/deis/config/%s/deis_whitelist" $app) }}
307+
{{ if $appHasWhitelist }}
308+
## Only connections from the following addresses are allowed
309+
{{ $whitelist := getv (printf "/deis/config/%s/deis_whitelist" $app) }}
310+
{{ range $whitelist_entry := split $whitelist "," }}
311+
{{ $whitelist_detail := split $whitelist_entry ":" }}
312+
allow {{index $whitelist_detail 0}};{{if eq (len $whitelist_detail) 2}} # {{index $whitelist_detail 1}}{{ end }}
313+
{{ end }}
314+
{{ end }}
315+
{{ if or (eq $enforceWhitelist "true") $appHasWhitelist}}
316+
deny all;
317+
{{ end }}
318+
272319
{{ if ne $appContainerLen 0 }}
273320
location / {
274321
{{ if eq $useFirewall "true" }}include /opt/nginx/firewall/active-mode.rules;{{ end }}

0 commit comments

Comments
 (0)