Repository navigation
Support Firewall for public IPs in VPC - #12706
Conversation
boring-cyborg
Bot
added
component:kubernetes
component:networking
component:orchestration
component:UI
component:virtual-router
Python
|
@blueorangutan package |
|
@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16942 |
There was a problem hiding this comment.
Pull request overview
This PR adds support for firewall rules on public IPs in VPC networks, which were previously only available for non-VPC isolated networks. This is a major feature addition that enables VPC users to configure ingress/egress firewall rules on their public IP addresses, similar to the functionality available in traditional isolated networks.
Changes:
- Enabled Firewall service for VPC offerings and networks by removing it from the list of non-supported services
- Added Firewall capability to VpcVirtualRouterElement by removing the code that previously excluded it
- Updated UI to show firewall tabs for VPC public IPs in various states (source NAT, static NAT, port forwarding, load balancing)
- Implemented iptables firewall chain logic in VPC virtual routers to support per-public-IP firewall rules
- Added database migration to retrofit existing VPC offerings, VPC networks, and VPCs with Firewall service
Reviewed changes
Copilot reviewed 9 out of 11 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| ui/src/views/offering/AddVpcOffering.vue | Adds Firewall service with VpcVirtualRouter provider to the list of services when creating VPC offerings |
| ui/src/views/network/PublicIpResource.vue | Updates tab visibility logic to show firewall tab for VPC IPs in various states (source NAT, static NAT, etc.) |
| systemvm/debian/opt/cloud/bin/cs/CsAddress.py | Implements PREROUTING firewall chain jump and firewall chain with default DROP policy for public IPs in VPC routers |
| systemvm/debian/opt/cloud/bin/configure.py | Modifies ACL processing to use AclIP (per-IP firewall) instead of AclDevice for VPC firewall rules |
| server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java | Removes VPCVirtualRouter check from isVirtualRouterGateway method for Network parameter |
| server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java | Removes Service.Firewall from the list of non-supported VPC services |
| server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java | Re-enables Firewall capability for VPC Virtual Router by removing the code that excluded it |
| server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java | Updates network offering validation to no longer automatically set forVpc=false when Firewall service is included |
| plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java | Updates Kubernetes VPC network offering creation to include Firewall service with VPCVirtualRouter provider |
| engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java | Adds database migration to insert Firewall service mappings for existing VPC offerings, networks, and VPCs |
| engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java | Adds Firewall service to default VPC offering providers |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
[SF] Trillian Build Failed (tid-15532) |
|
@blueorangutan package |
|
@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #12706 +/- ##
==========================================
Coverage 19.47% 19.48%
- Complexity 19352 19395 +43
==========================================
Files 6294 6296 +2
Lines 568164 568626 +462
Branches 69600 69713 +113
==========================================
+ Hits 110664 110810 +146
- Misses 445422 445677 +255
- Partials 12078 12139 +61
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 12 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@blueorangutan package |
|
@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16957 |
|
@blueorangutan package |
|
@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16959 |
|
@blueorangutan package |
a6c04ae to
60186e4
Compare
|
@blueorangutan package |
|
@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18527 |
kiranchavala
left a comment
kiranchavala
left a comment
There was a problem hiding this comment.
LGTM
Verified manually
Need to make sure firewall is a supported service when creating a vpc offering
Able to assign firewall rules to the public ip address acquired in a vpc network
Navigate to a vpc > Public ip address > acuire a public ip > Assign firewall rules
|
merging based on approvals and manual tests, thanks @harikrishna-patnala @kiranchavala @vishesh92 |
|
@harikrishna-patnala |
(cherry picked from commit 13822b1)
…les held them Since VPC public IPs can carry firewall rules (apache#12706), such a rule has a VPC but no network. unassignIPFromVpcNetwork() kept a VPC IP bound to its network while the IP had any firewall_rules row, and deleting the network never revokes these rules, because they belong to no network. The IP then stayed bound to the removed network. deleteVPC removed the firewall rule, looked the network up, got null, and failed with a NullPointerException in applyIpAssociations(), leaving the IP in Releasing and the VPC undeletable. Repro: VPC offering with the Firewall service, one network, a VM, a public IP with a port forwarding rule and a firewall rule; destroy the VM, delete the network, delete the VPC. - Only static NAT and rules that belong to a network keep a VPC IP bound to its network; VPC firewall rules are applied through the VPC. isIpAllocatedToVpc(), which also decides whether the IP stays plugged on the router, is unchanged. - disassociatePublicIpAddress() releases an IP whose associated network was removed as an unassociated IP instead of applying IP associations on a null network, so VPCs already stuck this way can be deleted. (cherry picked from commit 364686a)
Description
This PR adds support for firewall rules on public IPs in VPC networks.
Doc PR apache/cloudstack-documentation#633
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?