Révision 5dedf86c
Add ruleset for a Nomad cluster
Nomad clusters typically have single public API
port as well as rpc and serf ports for inter cluster
communication.
Example:
```puppet
class{ 'nftables::rules::nomad':
cluster_elements = [
'10.0.0.1','10.0.0.2',
'::1', '::2'',
],
}
```
The default ports can be overridden with parameters `http`, `rpc` and
`surf`.
| REFERENCE.md | ||
|---|---|---|
| 33 | 33 |
* [`nftables::rules::nfs`](#nftables--rules--nfs): manage in nfs4 |
| 34 | 34 |
* [`nftables::rules::nfs3`](#nftables--rules--nfs3): manage in nfs3 |
| 35 | 35 |
* [`nftables::rules::node_exporter`](#nftables--rules--node_exporter): manage in node exporter |
| 36 |
* [`nftables::rules::nomad`](#nftables--rules--nomad): manage port openings for a nomad cluster |
|
| 36 | 37 |
* [`nftables::rules::ospf`](#nftables--rules--ospf): manage in ospf |
| 37 | 38 |
* [`nftables::rules::ospf3`](#nftables--rules--ospf3): manage in ospf3 |
| 38 | 39 |
* [`nftables::rules::out::active_directory`](#nftables--rules--out--active_directory): manage outgoing active diectory |
| ... | ... | |
| 887 | 888 |
|
| 888 | 889 |
Default value: `9100` |
| 889 | 890 |
|
| 891 |
### <a name="nftables--rules--nomad"></a>`nftables::rules::nomad` |
|
| 892 |
|
|
| 893 |
manage port openings for a nomad cluster |
|
| 894 |
|
|
| 895 |
#### Examples |
|
| 896 |
|
|
| 897 |
##### Simple two node nomad cluster |
|
| 898 |
|
|
| 899 |
```puppet |
|
| 900 |
class{ 'nftables::rules::nomad':
|
|
| 901 |
cluster_elements = [ |
|
| 902 |
'10.0.0.1','10.0.0.2', |
|
| 903 |
'::1', '::2'', |
|
| 904 |
], |
|
| 905 |
} |
|
| 906 |
``` |
|
| 907 |
|
|
| 908 |
#### Parameters |
|
| 909 |
|
|
| 910 |
The following parameters are available in the `nftables::rules::nomad` class: |
|
| 911 |
|
|
| 912 |
* [`cluster_elements`](#-nftables--rules--nomad--cluster_elements) |
|
| 913 |
* [`http`](#-nftables--rules--nomad--http) |
|
| 914 |
* [`rpc`](#-nftables--rules--nomad--rpc) |
|
| 915 |
* [`serf`](#-nftables--rules--nomad--serf) |
|
| 916 |
|
|
| 917 |
##### <a name="-nftables--rules--nomad--cluster_elements"></a>`cluster_elements` |
|
| 918 |
|
|
| 919 |
Data type: `Array[Stdlib::IP::Address,1]` |
|
| 920 |
|
|
| 921 |
IP addreses of nomad cluster nodes |
|
| 922 |
|
|
| 923 |
Default value: `['127.0.0.1','::1']` |
|
| 924 |
|
|
| 925 |
##### <a name="-nftables--rules--nomad--http"></a>`http` |
|
| 926 |
|
|
| 927 |
Data type: `Stdlib::Port` |
|
| 928 |
|
|
| 929 |
Specify http api port to open to the world. |
|
| 930 |
|
|
| 931 |
Default value: `4646` |
|
| 932 |
|
|
| 933 |
##### <a name="-nftables--rules--nomad--rpc"></a>`rpc` |
|
| 934 |
|
|
| 935 |
Data type: `Stdlib::Port` |
|
| 936 |
|
|
| 937 |
Specify rpc port to open within the nomad cluster |
|
| 938 |
|
|
| 939 |
Default value: `4647` |
|
| 940 |
|
|
| 941 |
##### <a name="-nftables--rules--nomad--serf"></a>`serf` |
|
| 942 |
|
|
| 943 |
Data type: `Stdlib::Port` |
|
| 944 |
|
|
| 945 |
Specify serf port to open within the nomad cluster |
|
| 946 |
|
|
| 947 |
Default value: `4648` |
|
| 948 |
|
|
| 890 | 949 |
### <a name="nftables--rules--ospf"></a>`nftables::rules::ospf` |
| 891 | 950 |
|
| 892 | 951 |
manage in ospf |
| manifests/rules/nomad.pp | ||
|---|---|---|
| 1 |
# @summary manage port openings for a nomad cluster |
|
| 2 |
# |
|
| 3 |
# @param cluster_elements IP addreses of nomad cluster nodes |
|
| 4 |
# @param http Specify http api port to open to the world. |
|
| 5 |
# @param rpc Specify rpc port to open within the nomad cluster |
|
| 6 |
# @param serf Specify serf port to open within the nomad cluster |
|
| 7 |
# |
|
| 8 |
# @example Simple two node nomad cluster |
|
| 9 |
# class{ 'nftables::rules::nomad':
|
|
| 10 |
# cluster_elements = [ |
|
| 11 |
# '10.0.0.1','10.0.0.2', |
|
| 12 |
# '::1', '::2'', |
|
| 13 |
# ], |
|
| 14 |
# } |
|
| 15 |
# |
|
| 16 |
class nftables::rules::nomad ( |
|
| 17 |
Stdlib::Port $http = 4646, |
|
| 18 |
Stdlib::Port $rpc = 4647, |
|
| 19 |
Stdlib::Port $serf = 4648, |
|
| 20 |
Array[Stdlib::IP::Address,1] $cluster_elements = ['127.0.0.1','::1'], |
|
| 21 |
) {
|
|
| 22 |
# Open http api port to everything. |
|
| 23 |
# |
|
| 24 |
nftables::rule { 'default_in-nomad_http':
|
|
| 25 |
content => "tcp dport ${http}",
|
|
| 26 |
} |
|
| 27 |
|
|
| 28 |
['ip','ip6'].each | $_family | {
|
|
| 29 |
$_ip_type = $_family ? {
|
|
| 30 |
'ip' => Stdlib::IP::Address::V4, |
|
| 31 |
default => Stdlib::IP::Address::V6, |
|
| 32 |
} |
|
| 33 |
$_set_type = $_family ? {
|
|
| 34 |
'ip' => 'ipv4_addr', |
|
| 35 |
default => 'ipv6_addr', |
|
| 36 |
} |
|
| 37 |
|
|
| 38 |
$_elements = $cluster_elements.filter | $_ip | { $_ip =~ $_ip_type }
|
|
| 39 |
|
|
| 40 |
if $_elements.length > 0 {
|
|
| 41 |
nftables::set { "nomad_${_family}":
|
|
| 42 |
elements => $_elements, |
|
| 43 |
type => $_set_type, |
|
| 44 |
} |
|
| 45 |
|
|
| 46 |
nftables::rule { "default_in-nomad_rpc_${_family}":
|
|
| 47 |
content => "tcp dport ${rpc} ${_family} saddr @nomad_${_family} accept",
|
|
| 48 |
} |
|
| 49 |
|
|
| 50 |
nftables::rule { "default_in-nomad_serf_udp_${_family}":
|
|
| 51 |
content => "udp dport ${serf} ${_family} saddr @nomad_${_family} accept",
|
|
| 52 |
} |
|
| 53 |
|
|
| 54 |
nftables::rule { "default_in-nomad_serf_tcp_${_family}":
|
|
| 55 |
content => "tcp dport ${serf} ${_family} saddr @nomad_${_family} accept",
|
|
| 56 |
} |
|
| 57 |
} |
|
| 58 |
} |
|
| 59 |
} |
|
| spec/acceptance/all_rules_spec.rb | ||
|---|---|---|
| 48 | 48 |
include nftables::rules::smtp_submission |
| 49 | 49 |
include nftables::rules::https |
| 50 | 50 |
include nftables::rules::nfs |
| 51 |
include nftables::rules::nomad |
|
| 51 | 52 |
include nftables::rules::smtps |
| 52 | 53 |
include nftables::rules::smtp |
| 53 | 54 |
include nftables::rules::ceph |
| spec/classes/rules/nomad_spec.rb | ||
|---|---|---|
| 1 |
# frozen_string_literal: true |
|
| 2 |
|
|
| 3 |
require 'spec_helper' |
|
| 4 |
|
|
| 5 |
describe 'nftables::rules::nomad' do |
|
| 6 |
on_supported_os.each do |os, os_facts| |
|
| 7 |
context "on #{os}" do
|
|
| 8 |
let(:facts) { os_facts }
|
|
| 9 |
|
|
| 10 |
context 'default options' do |
|
| 11 |
it { is_expected.to compile }
|
|
| 12 |
|
|
| 13 |
it {
|
|
| 14 |
is_expected.to contain_nftables__set('nomad_ip').with(
|
|
| 15 |
{
|
|
| 16 |
type: 'ipv4_addr', |
|
| 17 |
elements: ['127.0.0.1'], |
|
| 18 |
} |
|
| 19 |
) |
|
| 20 |
} |
|
| 21 |
|
|
| 22 |
it {
|
|
| 23 |
is_expected.to contain_nftables__set('nomad_ip6').with(
|
|
| 24 |
{
|
|
| 25 |
type: 'ipv6_addr', |
|
| 26 |
elements: ['::1'], |
|
| 27 |
} |
|
| 28 |
) |
|
| 29 |
} |
|
| 30 |
|
|
| 31 |
it {
|
|
| 32 |
is_expected.to contain_nftables__rule('default_in-nomad_http').with_content('tcp dport 4646')
|
|
| 33 |
is_expected.to contain_nftables__rule('default_in-nomad_rpc_ip6').with_content('tcp dport 4647 ip6 saddr @nomad_ip6 accept')
|
|
| 34 |
is_expected.to contain_nftables__rule('default_in-nomad_rpc_ip').with_content('tcp dport 4647 ip saddr @nomad_ip accept')
|
|
| 35 |
is_expected.to contain_nftables__rule('default_in-nomad_serf_tcp_ip6').with_content('tcp dport 4648 ip6 saddr @nomad_ip6 accept')
|
|
| 36 |
is_expected.to contain_nftables__rule('default_in-nomad_serf_tcp_ip').with_content('tcp dport 4648 ip saddr @nomad_ip accept')
|
|
| 37 |
is_expected.to contain_nftables__rule('default_in-nomad_serf_udp_ip6').with_content('udp dport 4648 ip6 saddr @nomad_ip6 accept')
|
|
| 38 |
is_expected.to contain_nftables__rule('default_in-nomad_serf_udp_ip').with_content('udp dport 4648 ip saddr @nomad_ip accept')
|
|
| 39 |
} |
|
| 40 |
end |
|
| 41 |
|
|
| 42 |
context 'with ports set' do |
|
| 43 |
let(:params) do |
|
| 44 |
{
|
|
| 45 |
http: 1000, |
|
| 46 |
rpc: 2000, |
|
| 47 |
serf: 3000, |
|
| 48 |
} |
|
| 49 |
end |
|
| 50 |
|
|
| 51 |
it { is_expected.to compile }
|
|
| 52 |
|
|
| 53 |
it {
|
|
| 54 |
is_expected.to contain_nftables__set('nomad_ip')
|
|
| 55 |
is_expected.to contain_nftables__set('nomad_ip6')
|
|
| 56 |
} |
|
| 57 |
|
|
| 58 |
it {
|
|
| 59 |
is_expected.to contain_nftables__rule('default_in-nomad_http').with_content('tcp dport 1000')
|
|
| 60 |
is_expected.to contain_nftables__rule('default_in-nomad_rpc_ip6').with_content('tcp dport 2000 ip6 saddr @nomad_ip6 accept')
|
|
| 61 |
is_expected.to contain_nftables__rule('default_in-nomad_rpc_ip').with_content('tcp dport 2000 ip saddr @nomad_ip accept')
|
|
| 62 |
is_expected.to contain_nftables__rule('default_in-nomad_serf_tcp_ip6').with_content('tcp dport 3000 ip6 saddr @nomad_ip6 accept')
|
|
| 63 |
is_expected.to contain_nftables__rule('default_in-nomad_serf_tcp_ip').with_content('tcp dport 3000 ip saddr @nomad_ip accept')
|
|
| 64 |
is_expected.to contain_nftables__rule('default_in-nomad_serf_udp_ip6').with_content('udp dport 3000 ip6 saddr @nomad_ip6 accept')
|
|
| 65 |
is_expected.to contain_nftables__rule('default_in-nomad_serf_udp_ip').with_content('udp dport 3000 ip saddr @nomad_ip accept')
|
|
| 66 |
} |
|
| 67 |
end |
|
| 68 |
|
|
| 69 |
context 'with ipv4 hosts only' do |
|
| 70 |
let(:params) do |
|
| 71 |
{
|
|
| 72 |
cluster_elements: ['127.0.0.1', '127.0.0.2'] |
|
| 73 |
} |
|
| 74 |
end |
|
| 75 |
|
|
| 76 |
it {
|
|
| 77 |
is_expected.to contain_nftables__set('nomad_ip').with(
|
|
| 78 |
{
|
|
| 79 |
type: 'ipv4_addr', |
|
| 80 |
elements: ['127.0.0.1', '127.0.0.2'], |
|
| 81 |
} |
|
| 82 |
) |
|
| 83 |
} |
|
| 84 |
|
|
| 85 |
it { is_expected.not_to contain_nftables__set('nomad_ip6') }
|
|
| 86 |
|
|
| 87 |
it {
|
|
| 88 |
is_expected.to contain_nftables__rule('default_in-nomad_http').with_content('tcp dport 4646')
|
|
| 89 |
is_expected.not_to contain_nftables__rule('default_in-nomad_rpc_ip6')
|
|
| 90 |
is_expected.to contain_nftables__rule('default_in-nomad_rpc_ip').with_content('tcp dport 4647 ip saddr @nomad_ip accept')
|
|
| 91 |
is_expected.not_to contain_nftables__rule('default_in-nomad_serf_tcp_ip6')
|
|
| 92 |
is_expected.to contain_nftables__rule('default_in-nomad_serf_tcp_ip').with_content('tcp dport 4648 ip saddr @nomad_ip accept')
|
|
| 93 |
is_expected.not_to contain_nftables__rule('default_in-nomad_serf_udp_ip6')
|
|
| 94 |
is_expected.to contain_nftables__rule('default_in-nomad_serf_udp_ip').with_content('udp dport 4648 ip saddr @nomad_ip accept')
|
|
| 95 |
} |
|
| 96 |
end |
|
| 97 |
end |
|
| 98 |
end |
|
| 99 |
end |
|
Formats disponibles : Unified diff