990136 - Open netflows from aws-manager1.srv.releng.scl3.mozilla.com to buildbot master web interface

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Rail Aliiev [:rail]]

+++ This bug was initially created as a clone of Bug #988324 +++

aws-manager1 needs to talk to the buildbot masters (I believe the is a netflow group for them) to gracefully shutdown slaves. Depending on the master type the port may be 8001, 8101 or 8201.

From: aws-manager1
To: buildbot masters netflow group
Ports: 8001, 8101, 8201

Sorry for marking this "major", the previous machine hosting this code was too universal, still discovering all needed netflows.
  
Thanks in advance!

Comment 1

[Dave Curado :dcurado]

Sorry, I need to know what "buildbot masters netflow group" is.

Possibly these networks?
                address us-west-1 10.130.0.0/16;
                address us-west-2 10.132.0.0/16;
                address us-east-1 10.134.0.0/16;

Thanks,
Dave

Comment 2

[Rail Aliiev [:rail]]

For some reason I thought that there is a special group for buildbot masters. We can narrow down the nets above to:

address us-west-1 10.130.48.0/22;
address us-west-2 10.132.48.0/22;
address us-east-1 10.134.48.0/22;

Comment 3

[Dave Curado :dcurado]

There may be, but I wouldn't know it's name.
With the address info from above, I can find it.
Thanks.

Comment 4

[Dave Curado :dcurado]

this should be all set.
please let me know if there are any problems
thanks,
dave

Comment 5

[Rail Aliiev [:rail]]

So far it's looking good. Thanks.

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

"netflow" means something completely different.  If we were all in one DC, this would be an address-set, but in this case it's a little more complicated than that.

rail, you don't need access to srv.releng.scl3?

Comment 7

[Rail Aliiev [:rail]]

(In reply to Dustin J. Mitchell [:dustin] from comment #6)
> rail, you don't need access to srv.releng.scl3?

It looks open:

[[e-mail] aws_manager]$ nc -zv buildbot-master82.srv.releng.scl3.mozilla.com 8001
Connection to buildbot-master82.srv.releng.scl3.mozilla.com 8001 port [tcp/vcom-tunnel] succeeded!

Comment 8

[Dustin J. Mitchell [:dustin] (he/him)]

Hah, yes, that's the same VLAN so it would be.  Sorry for the noise!