1355188 - access to all releng puppetmasters on port 8020 for all buildslaves

Status: VERIFIED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

All of the buildslave VLANs will need to have access to TCP port 8020 on all releng puppetmasters.

Jake or Dave can fill in the IP ranges -- I don't have access to that information anymore.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

I should say, all of the scl3 VLANs.  Buildslaves in AWS do not need access.  It's fine to give them access if that makes it easier, but it's not necessary.

Comment 2

[:dhouse]

The buildslave vlans include:

Vlan:252 build - 10.26.52.0/22 
Vlan:236 winbuild - 10.26.36.0/22

Vlan:256 test  - 10.26.56.0/22
Vlan:240 wintest - 10.26.40.0/22

Vlan:264 try - 10.26.64.0/22
Vlan:244 wintry - 10.26.44.0/22

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

The puppetmasters are releng-puppet{1,2}.srv.releng.scl3.mozilla.com.

Is this missing any critical information?

Comment 4

[James Barnell [:jbarnell]]

[e-mail]# show | compare 
[edit security policies from-zone winbuild to-zone srv]
      policy proxxy1--http { ... }
+     policy releng_puppet {
+         match {
+             source-address any;
+             destination-address [ releng-puppet1 releng-puppet2 ];
+             application releng_to_puppet;
+         }
+         then {
+             permit;
+         }
+     }
[edit security policies from-zone wintest to-zone srv]
      policy proxxy1--http { ... }
+     policy releng_puppet {
+         match {
+             source-address any;
+             destination-address [ releng-puppet1 releng-puppet2 ];
+             application releng_to_puppet;
+         }
+         then {
+             permit;
+         }
+     }
[edit security policies from-zone wintry to-zone srv]
      policy proxxy1--http { ... }
+     policy releng_puppet {
+         match {
+             source-address any;
+             destination-address [ releng-puppet1 releng-puppet2 ];
+             application releng_to_puppet;
+         }
+         then {                        
+             permit;
+         }
+     }
[edit security policies from-zone build to-zone srv]
      policy proxxy1--http { ... }
+     policy releng_puppet {
+         match {
+             source-address any;
+             destination-address [ releng-puppet1 releng-puppet2 ];
+             application releng_to_puppet;
+         }
+         then {
+             permit;
+         }
+     }
[edit security policies from-zone test to-zone srv]
      policy proxxy1--http { ... }
+     policy releng_puppet {
+         match {
+             source-address any;
+             destination-address [ releng-puppet1 releng-puppet2 ];
+             application releng_to_puppet;
+         }
+         then {
+             permit;
+         }
+     }
[edit security policies from-zone try to-zone srv]
      policy proxxy1--http { ... }
+     policy releng_puppet {
+         match {
+             source-address any;       
+             destination-address [ releng-puppet1 releng-puppet2 ];
+             application releng_to_puppet;
+         }
+         then {
+             permit;
+         }
+     }
[edit applications]
    application statsds { ... }
+   application releng_to_puppet {
+       protocol tcp;
+       destination-port 8020;
+   }

Please test