601150 - bounceradmin.mozilla.com should be accessible to build machines and through build-vpn

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps, task)

Description

[[e-mail] (:bhearsum)]

We use this webapp to add and manage bouncer entries, both through automation as well as manually. Therefore, it should be accessible through build-vpn and to the build machines.

Comment 1

[matthew zeier [:mrz]]

Would like comments from infra-sec in case there's something we're overlooking.

Comment 2

[Chris Lyon [:clyon]]

What is the current process? Is this something that we are adding because of the build-vpn?

Little more background would be good.

Comment 3

[matthew zeier [:mrz]]

Current process requires you to be on vlan72 (mpt-vpn).

The build network is supposed to be isolated from other systems.  This request is to allow users on the build-vpn host to talk to bounceradmin (vlan72).

Comment 4

[Chris AtLee [:catlee]]

(In reply to comment #3)
> Current process requires you to be on vlan72 (mpt-vpn).
> 
> The build network is supposed to be isolated from other systems.  This request
> is to allow users on the build-vpn host to talk to bounceradmin (vlan72).

Why does what hosts the build network is allowed to reach have anything to do with the routes allowed for build-vpn users?

Comment 5

[matthew zeier [:mrz]]

You will have -a- host in the build network allowed to talk to a host outside that other hosts in the build network do not.  I'm merely passing information over to clyon.

Comment 6

[[e-mail] (:bhearsum)]

(In reply to comment #5)
> You will have -a- host in the build network allowed to talk to a host outside
> that other hosts in the build network do not.  I'm merely passing information
> over to clyon.

That really doesn't work well with our pool-of-slaves model...

Comment 7

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

(In reply to comment #6)
> (In reply to comment #5)
> > You will have -a- host in the build network allowed to talk to a host outside
> > that other hosts in the build network do not.  I'm merely passing information
> > over to clyon.
> 
> That really doesn't work well with our pool-of-slaves model...

We already have our pool-o-slaves talking to hosts outside build.m.o (f.e. for uploading/downloading builds.) In order to be able to automate adding bouncer entries as part of release automation, these same pool-o-slaves need to be able to access bounceradmin, so adding this now while setting up build-vpn seems a good idea.

mrz/clyon: please let us know if you need more info.

Comment 8

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

(In reply to comment #7)
> mrz/clyon: please let us know if you need more info.

clyon: let me know if you need more info after the quick whiteboard diagram yesterday

Comment 9

[Chris Lyon [:clyon]]

Few more emails between John O and myself, we have a good understanding of what is happening. 

Access to bounceradmin on vlan 75 from the build vpn, there isn't much risk and probably better over the current setup. 

so we are good with the changes.

Comment 10

[Arzhel Younsi [:XioNoX]]

Only build vpn or the whole build network?

Comment 11

[matthew zeier [:mrz]]

The whole build network.

Comment 12

[Arzhel Younsi [:XioNoX]]

Access granted