Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(ci.jenkins.io) allow inbound JNLP from public NAT gateways IPs instead of private subnet CIDRs as we use public DNS #110

Conversation

dduportal
Copy link
Contributor

@dduportal dduportal commented Jan 23, 2025

Related to jenkins-infra/helpdesk#4317 (comment)

This PR introduces the following changes to the Security groups rules allowing the JNLP agent protocol for ci.jenkins.io:

  • Allow the outbound public IP from agents (whether they are VMs or containers) instead of the private IP as the public IP of aws.ci.jenkins.io is ued
  • Restrict the pod agents to:
    • Only outbound JNLP (no more plain HTTP)
    • Only the controller IPv4 public address

…nstead of private subnet CIDRs as we use public DNS

Signed-off-by: Damien Duportal <[email protected]>
@dduportal dduportal force-pushed the fix/ci.jio/allow-inbound-jnlp-from-gateways branch from 4e32ad4 to 2668919 Compare January 23, 2025 17:54
Signed-off-by: Damien Duportal <[email protected]>
@dduportal dduportal marked this pull request as ready for review January 23, 2025 18:08
@dduportal dduportal merged commit a4c0449 into jenkins-infra:main Jan 23, 2025
3 checks passed
@dduportal dduportal deleted the fix/ci.jio/allow-inbound-jnlp-from-gateways branch January 23, 2025 18:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant