{"action":"created","issue":{"url":"https://api.github.com/repos/Misch-/Kubernetes-Capstone/issues/1","repository_url":"https://api.github.com/repos/Misch-/Kubernetes-Capstone","labels_url":"https://api.github.com/repos/Misch-/Kubernetes-Capstone/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/Misch-/Kubernetes-Capstone/issues/1/comments","events_url":"https://api.github.com/repos/Misch-/Kubernetes-Capstone/issues/1/events","html_url":"https://github.com/Misch-/Kubernetes-Capstone/issues/1","id":131935191,"number":1,"title":"Secure supplied cluster servers with firewall","user":{"login":"Misch-","id":616386,"avatar_url":"https://avatars.githubusercontent.com/u/616386?v=3","gravatar_id":"","url":"https://api.github.com/users/Misch-","html_url":"https://github.com/Misch-","followers_url":"https://api.github.com/users/Misch-/followers","following_url":"https://api.github.com/users/Misch-/following{/other_user}","gists_url":"https://api.github.com/users/Misch-/gists{/gist_id}","starred_url":"https://api.github.com/users/Misch-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Misch-/subscriptions","organizations_url":"https://api.github.com/users/Misch-/orgs","repos_url":"https://api.github.com/users/Misch-/repos","events_url":"https://api.github.com/users/Misch-/events{/privacy}","received_events_url":"https://api.github.com/users/Misch-/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Misch-/Kubernetes-Capstone/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":{"login":"Misch-","id":616386,"avatar_url":"https://avatars.githubusercontent.com/u/616386?v=3","gravatar_id":"","url":"https://api.github.com/users/Misch-","html_url":"https://github.com/Misch-","followers_url":"https://api.github.com/users/Misch-/followers","following_url":"https://api.github.com/users/Misch-/following{/other_user}","gists_url":"https://api.github.com/users/Misch-/gists{/gist_id}","starred_url":"https://api.github.com/users/Misch-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Misch-/subscriptions","organizations_url":"https://api.github.com/users/Misch-/orgs","repos_url":"https://api.github.com/users/Misch-/repos","events_url":"https://api.github.com/users/Misch-/events{/privacy}","received_events_url":"https://api.github.com/users/Misch-/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/Misch-/Kubernetes-Capstone/milestones/1","html_url":"https://github.com/Misch-/Kubernetes-Capstone/milestones/Sprint%201","labels_url":"https://api.github.com/repos/Misch-/Kubernetes-Capstone/milestones/1/labels","id":1568418,"number":1,"title":"Sprint 1","description":"","creator":{"login":"Misch-","id":616386,"avatar_url":"https://avatars.githubusercontent.com/u/616386?v=3","gravatar_id":"","url":"https://api.github.com/users/Misch-","html_url":"https://github.com/Misch-","followers_url":"https://api.github.com/users/Misch-/followers","following_url":"https://api.github.com/users/Misch-/following{/other_user}","gists_url":"https://api.github.com/users/Misch-/gists{/gist_id}","starred_url":"https://api.github.com/users/Misch-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Misch-/subscriptions","organizations_url":"https://api.github.com/users/Misch-/orgs","repos_url":"https://api.github.com/users/Misch-/repos","events_url":"https://api.github.com/users/Misch-/events{/privacy}","received_events_url":"https://api.github.com/users/Misch-/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":1,"state":"open","created_at":"2016-02-07T04:56:15Z","updated_at":"2016-02-07T06:54:41Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2016-02-07T04:54:50Z","updated_at":"2016-02-07T06:54:41Z","closed_at":"2016-02-07T06:54:41Z","body":"Matt gave us a cluster of servers to work with, but they're completely open to the internet and we're going to be deploying services on them, so we ought to setup a firewall to block anything that's not the following:\r\n\r\n* ssh traffic from any of us to the cluster (so we can login remotely)\r\n* any traffic between cluster nodes (So the cluster can communicate openly amongst itself)\r\n* ICMP (ping) traffic (so we can see if hosts are online remotely)\r\n* Any IPs or networks that Matt wants to be able to access the cluster for whatever purpose\r\n\r\nAfter talking about it in our meeting yesterday, I will only allow SSH from anywhere, all other networking will have to be allowed later or it will only be visible from between the cluster computers. Matt also requested that I use the Ubuntu (UFW?) firewall program. So I'll do that."},"comment":{"url":"https://api.github.com/repos/Misch-/Kubernetes-Capstone/issues/comments/180964132","html_url":"https://github.com/Misch-/Kubernetes-Capstone/issues/1#issuecomment-180964132","issue_url":"https://api.github.com/repos/Misch-/Kubernetes-Capstone/issues/1","id":180964132,"user":{"login":"Misch-","id":616386,"avatar_url":"https://avatars.githubusercontent.com/u/616386?v=3","gravatar_id":"","url":"https://api.github.com/users/Misch-","html_url":"https://github.com/Misch-","followers_url":"https://api.github.com/users/Misch-/followers","following_url":"https://api.github.com/users/Misch-/following{/other_user}","gists_url":"https://api.github.com/users/Misch-/gists{/gist_id}","starred_url":"https://api.github.com/users/Misch-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Misch-/subscriptions","organizations_url":"https://api.github.com/users/Misch-/orgs","repos_url":"https://api.github.com/users/Misch-/repos","events_url":"https://api.github.com/users/Misch-/events{/privacy}","received_events_url":"https://api.github.com/users/Misch-/received_events","type":"User","site_admin":false},"created_at":"2016-02-07T06:54:41Z","updated_at":"2016-02-07T06:54:41Z","body":"Don't know if we need it, but I'll add an allow all for localhost\r\nAdd an allow all for every node\r\n\r\nufw allow from <IP>\r\n\r\nhttp://serverfault.com/questions/473348/deny-from-localhost-with-ufw\r\nThat page seems to think I can just use 127.0.0.1 like I thought. It doesn't accept localhost as an arg. Gonna go with that.\r\n\r\nAll nodes are configured as follows; took the IP addresses out.\r\n\r\n```\r\nroot@kube01:~# ufw status\r\nStatus: active\r\n\r\nTo                         Action      From\r\n--                         ------      ----\r\n22                         ALLOW       Anywhere\r\nAnywhere                   ALLOW       127.0.0.1\r\nAnywhere                   ALLOW       <kube01IP>\r\nAnywhere                   ALLOW       <kube02IP>\r\nAnywhere                   ALLOW       <kube03IP>\r\n22 (v6)                    ALLOW       Anywhere (v6)\r\n\r\nroot@kube01:~#\r\n```\r\n\r\nWe'll have to update that when we have more nodes. That would be a good thing to manage dynamically with ansible I think.\r\n\r\nCluster is secured\r\n\r\n"}}