Page MenuHomeDevCentral

Resolve private network interface
ClosedPublic

Authored by dereckson on Apr 12 2023, 19:38.
Tags
None
Referenced Files
F3631730: D3004.diff
Sun, Oct 6, 17:03
Unknown Object (File)
Thu, Oct 3, 19:03
Unknown Object (File)
Wed, Oct 2, 05:30
Unknown Object (File)
Tue, Oct 1, 23:57
Unknown Object (File)
Sat, Sep 28, 17:21
Unknown Object (File)
Tue, Sep 17, 17:31
Unknown Object (File)
Fri, Sep 13, 03:11
Unknown Object (File)
Fri, Sep 13, 03:11
Subscribers
None

Details

Summary

Currently, node.resolve_network() gives the "most public" IP address
available on a node.

For tasks like T1826 or T1829, we need to know the "most private" IP address
to allow servers like SSH or Alkane to listen there, restricting those services
for internal use.

For example, this allows to pass the following Jinja template expression
to any configuration needing a private IP address to listen to:

{{ network["private_ipv4_address"] | default("localhost") }}

By heuristics, the method will recommend through is_private_network_stable
if the private network is stable, i.e. suitable to listen to critical
services like SSH. A network is currently unstable if it needs a GRE tunnel
to connect to the private network. The goal is to avoid to be locked
outside a machine if the tunnel is broken: a SSH connection is useful
to debug it. In the future, we can declare stable the nodes with a KVM,
and documented procedure to relink quickly to the private network.

Ref T1829

Test Plan

salt '*' node.resolve_network

Diff Detail

Repository
rOPS Nasqueron Operations
Lint
Lint Errors
SeverityLocationCodeMessage
Error_modules/node.py:415E501flake8 E501
Unit
No Test Coverage
Branch
resolve-network
Build Status
Buildable 4751
Build 5032: arc lint + arc unit

Event Timeline

dereckson created this revision.
This revision is now accepted and ready to land.Apr 12 2023, 20:16
This revision was landed with ongoing or failed builds.Apr 12 2023, 20:17
This revision was automatically updated to reflect the committed changes.