Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Protocol Security group for AWS #538

Open
wants to merge 9 commits into
base: next_gen
Choose a base branch
from
Open

Protocol Security group for AWS #538

wants to merge 9 commits into from

Conversation

praveenramuu
Copy link
Contributor

No description provided.

@praveenramuu
Protocol Security group for AWS
9632ae3 
Signed-off-by: Praveen Ramu <praveen.ramu@ibm.com>
@praveenramuu praveenramuu marked this pull request as draft June 7, 2024 06:49
@praveenramuu
Added protocol sec group output
f413534 
Signed-off-by: Praveen Ramu <praveen.ramu@ibm.com>
@praveenramuu
Added cloudVM and direction communication to protocol
8f5406a 
Signed-off-by: Praveen Ramu <praveen.ramu@ibm.com>
@praveenramuu praveenramuu marked this pull request as ready for review June 7, 2024 09:15
@praveenramuu
Added missing using_cloud_connection var
3aec04b 
Signed-off-by: Praveen Ramu <praveen.ramu@ibm.com>
@praveenramuu
consolidation sg
886753c 
Signed-off-by: Praveen Ramu <praveen.ramu@ibm.com>
@praveenramuu praveenramuu marked this pull request as draft June 10, 2024 04:58
sasikeda
sasikeda reviewed Jun 10, 2024
View reviewed changes
aws_scale_templates/sub_modules/instance_template/locals.tf Outdated
@@ -15,6 +15,72 @@ locals {
instance_storage_device_names = ["/dev/nvme0n1", "/dev/nvme1n1", "/dev/nvme2n1", "/dev/nvme3n1", "/dev/nvme4n1", "/dev/nvme5n1", "/dev/nvme6n1", "/dev/nvme7n1", "/dev/nvme8n1", "/dev/nvme9n1", "/dev/nvme10n1", "/dev/nvme11n1", "/dev/nvme12n1", "/dev/nvme13n1", "/dev/nvme14n1", "/dev/nvme15n1", "/dev/nvme16n1"]
gpfs_base_rpm_path = var.spectrumscale_rpms_path != null ? fileset(var.spectrumscale_rpms_path, "gpfs.base-*") : null
scale_version = local.gpfs_base_rpm_path != null ? regex("gpfs.base-(.*).x86_64.rpm", tolist(local.gpfs_base_rpm_path)[0])[0] : null

traffic_protocol_bi = ["icmp", "TCP", "TCP", "TCP", "TCP", "UDP", "TCP", "TCP", "UDP", "TCP", "TCP", "TCP", "TCP", "icmp", "TCP", "TCP", "TCP", "TCP", "UDP", "TCP", "TCP", "UDP", "TCP", "TCP", "TCP", "TCP"]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consolidate the security groups b/w compute, storage and protocol nodes
sasikeda
sasikeda reviewed Jun 10, 2024
View reviewed changes
aws_scale_templates/sub_modules/instance_template/locals.tf Outdated

traffic_protocol_bi = ["icmp", "TCP", "TCP", "TCP", "TCP", "UDP", "TCP", "TCP", "UDP", "TCP", "TCP", "TCP", "TCP", "icmp", "TCP", "TCP", "TCP", "TCP", "UDP", "TCP", "TCP", "UDP", "TCP", "TCP", "TCP", "TCP"]
traffic_protocol_from_port_bi = [-1, 22, 1191, 60000, 47080, 47443, 4444, 4739, 4739, 9080, 9081, 80, 443, -1, 22, 1191, 60000, 47080, 47443, 4444, 4739, 4739, 9080, 9081, 80, 443]
traffic_protocol_to_port_bi = [-1, 22, 1191, 61000, 47080, 47443, 4444, 4739, 4739, 9080, 9081, 80, 443, -1, 22, 1191, 60000, 47080, 47443, 4444, 4739, 4739, 9080, 9081, 80, 443]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check the ports with the latest security port definitions and separate them as the base and extended. (Base is limited to storage only) and extended to protocol
sasikeda
sasikeda reviewed Jun 10, 2024
View reviewed changes
aws_scale_templates/sub_modules/instance_template/main.tf Outdated
sec_group_description = ["Enable SSH access to the compute cluster hosts"]
turn_on = true
sec_group_name = ["scale-sec-group-"]
sec_group_description = ["Scale cluster sec group"]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sec -> security
sasikeda
sasikeda reviewed Jun 10, 2024
View reviewed changes
aws_scale_templates/sub_modules/instance_template/main.tf Outdated
# Create Scale cluster security group
module "protocol_security_group" {
source = "../../../resources/aws/security/security_group"
turn_on = length(local.protocol_vm_subnet_map) > 0 ? true : false
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change to len of protocol nodes rather than subnet map
sasikeda
sasikeda reviewed Jun 10, 2024
View reviewed changes
resources/aws/compute/ec2_multiple_vol/ec2_multiple_vol.tf Outdated
ami = var.ami_id
instance_type = var.instance_type
key_name = var.user_public_key
#security_groups = var.security_groups
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the security group commented ?
sasikeda
sasikeda reviewed Jun 10, 2024
View reviewed changes
resources/aws/security/security_group/security_group.tf
vpc_id = var.vpc_id
revoke_rules_on_delete = true

lifecycle {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is lifecycle required, by default it is create before destroy true.
sasikeda
sasikeda reviewed Jun 10, 2024
View reviewed changes
aws_scale_templates/sub_modules/instance_template/outputs.tf
@@ -32,7 +32,7 @@ output "compute_cluster_instance_details" {
}

output "compute_cluster_security_group_id" {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

once consolidation is complete, both security groups will merge and causes changes in terms of edit, remote mount
@praveenramuu
consolidated local vars
4281b73 
Signed-off-by: Praveen Ramu <praveen.ramu@ibm.com>
@praveenramuu
Copy link
Contributor Author

  • Consolidate and created security group based on "base" and "extended"
  • Change to len of protocol nodes rather than subnet map
  • Uncommented security group var inside ec2_multiple_vol.tf
@praveenramuu
single base scale sg for scale and protocol node
d17dd56 
Signed-off-by: Praveen Ramu <praveen.ramu@ibm.com>
@praveenramuu
Copy link
Contributor Author

  • Single base scale sg for scale and protocol node
sasikeda
sasikeda reviewed Jun 12, 2024
View reviewed changes
aws_scale_templates/sub_modules/instance_template/locals.tf Outdated

## Extended ports
# Protocol ports
protocol_traffic_ports = [4379, 11211, 11211, 6200, 5431]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please remove the openstack swift ports and add nooba ports
@sasikeda sasikeda marked this pull request as ready for review June 12, 2024 10:13
@praveenramuu
Added nooba ports and removed swift proxy port
b9cd118 
Signed-off-by: Praveen Ramu <praveen.ramu@ibm.com>
@praveenramuu
Copy link
Contributor Author

Added nooba ports and removed swift port
@praveenramuu
Added security rule to enable protocol cluster egress communication
50a6d2a 
Signed-off-by: Praveen Ramu <praveen.ramu@ibm.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
2 participants
@praveenramuu @sasikeda