openstack: clarify IPv6 firewalling
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• aborrero
	Sep 13 2024, 12:48 PM

Description

A few things to clarify:

VMs are not protected by NAT anymore. Figure out the right firewalling semantics.
We need to make sure neutron security groups works as expected using IPv6.

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	cloudgw: forward all VRF traffic without restrictions for IPv6	operations/puppet	production	+4 -9

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Open	None	T53494 Use Beta cluster as a true canary for code deployments (epic)
Declined	None	T87220 Minimize infrastructure differences between Beta Cluster and production
Open	None	T211677 Support IPv6 in beta
Open	None	T404466 Support IPv6-only VMs
Open	None	T392688 Enable IPv6 on Cloud VPS infrastructure services
Resolved	taavi	T379175 Enable IPv6 for the Cloud VPS web proxy
Open	None	T270694 CloudVPS: introduce tenant networks
Resolved	• aborrero	T364725 Migrate Cloud VPS instances to VXLAN based networks
Open	None	T392509 Enable IPv6 for Toolforge services
Resolved	taavi	T392506 Enable IPv6 for tools.wmflabs.org / *.toolserver.org legacy redirector service
Resolved	taavi	T211575 Enable IPv6 on toolforge.org
Resolved	None	T209460 CloudVPS: network architecture
Resolved	None	T244727 CloudVPS: networking improvements
Open	None	T220306 Add IPv6 monitoring
Resolved	• aborrero	T37947 Enable IPv6 on CloudVPS
Resolved	• aborrero	T245495 CloudVPS: IPv6 in codfw1dev
Resolved	• aborrero	T374714 openstack: clarify IPv6 firewalling
Resolved	• aborrero	T377339 horizon: enable IPv6 security group panels

Event Timeline

• aborrero created this task.Sep 13 2024, 12:48 PM

Restricted Application removed a subscriber: taavi. · View Herald TranscriptSep 13 2024, 12:48 PM

• aborrero removed a subtask: T374715: openstack: work out IPv6 and designate integration.Sep 13 2024, 12:50 PM

• aborrero mentioned this in T245495: CloudVPS: IPv6 in codfw1dev.Sep 13 2024, 12:54 PM

• aborrero triaged this task as Medium priority.Sep 18 2024, 2:08 PM

ayounsi removed projects: Infrastructure-Foundations, netops.Sep 24 2024, 1:56 PM

taavi added a project: Cloud-VPS.Sep 28 2024, 11:33 AM

taavi moved this task from Unsorted to Network on the Cloud-VPS board.

• aborrero renamed this task from openstack: verify security groups settings for IPv6 to openstack: clarify IPv6 firewalling.Oct 14 2024, 3:33 PM

• aborrero updated the task description. (Show Details)

aborrero opened https://gitlab.wikimedia.org/repos/cloud/cloud-vps/tofu-infra/-/merge_requests/96

codfw1dev: default secgroup: refresh IPv6 settings

• aborrero changed the task status from Open to In Progress.Oct 14 2024, 3:34 PM

• aborrero claimed this task.

• aborrero edited projects, added User-aborrero; removed SRE.

• aborrero moved this task from Backlog to Doing on the User-aborrero board.Oct 14 2024, 3:45 PM

aborrero merged https://gitlab.wikimedia.org/repos/cloud/cloud-vps/tofu-infra/-/merge_requests/96

codfw1dev: default secgroup: refresh IPv6 settings

Maintenance_bot removed a project: Patch-For-Review.Oct 15 2024, 10:31 AM

aborrero opened https://gitlab.wikimedia.org/repos/cloud/cloud-vps/tofu-infra/-/merge_requests/98

codfw1dev: default secgroup: fix ICMP in IPv6

aborrero merged https://gitlab.wikimedia.org/repos/cloud/cloud-vps/tofu-infra/-/merge_requests/98

codfw1dev: default secgroup: fix ICMP in IPv6

Change #1080267 had a related patch set uploaded (by Arturo Borrero Gonzalez; author: Arturo Borrero Gonzalez):

[operations/puppet@production] cloudgw: forward all VRF traffic without restrictions for IPv6

https://gerrit.wikimedia.org/r/1080267

Change #1080267 merged by Arturo Borrero Gonzalez:

[operations/puppet@production] cloudgw: forward all VRF traffic without restrictions for IPv6

https://gerrit.wikimedia.org/r/1080267

Mentioned in SAL (#wikimedia-cloud) [2024-10-15T11:33:17Z] <arturo> cloudgw maintenance, firewall change for T374714

problem detected: remote_group_name parameter in tofu-infra security group rules is not getting resolved.

Maintenance_bot removed a project: Patch-For-Review.Oct 15 2024, 12:31 PM

In T374714#10228685, @aborrero wrote:

problem detected: remote_group_name parameter in tofu-infra security group rules is not getting resolved.

fixed with this https://gitlab.wikimedia.org/repos/cloud/cloud-vps/tofu-infra/-/merge_requests/99

For now, the semantics are:

the default neutron security group in each project will allow: all egress IPv6 traffic, inbound IPv6 traffic only from the same tenant
if the IPv6-enabled VM wants to be directly reachable from the internet in its IPv6 address, it can be configured via another security group.
the perimetral firewall at cloudgw does not enforce anything related to IPv6. All IPv6 traffic is free to flow at this point of the edge network, until we decide to introduce cloud-wide filters or whatever.

• aborrero mentioned this in T377467: Decision Request - How to do the Cloud VPS VXLAN/IPv6 migration.Oct 24 2024, 7:50 AM

• aborrero changed the status of subtask T377339: horizon: enable IPv6 security group panels from Open to In Progress.Nov 15 2024, 12:03 PM

• aborrero closed subtask T377339: horizon: enable IPv6 security group panels as Resolved.Nov 15 2024, 12:45 PM

openstack: clarify IPv6 firewallingClosed, ResolvedPublicActions

Description

Details

Related ObjectsSearch...

Event Timeline

openstack: clarify IPv6 firewalling
Closed, ResolvedPublic
Actions

Related Objects
Search...