Merge pull request #276 from MattiasGees/198-admin-cidr

Secure endpoints to only allow certain cidr blocks

Author: simonswine

docs/spelling_wordlist.txt

@@ -65,6 +65,7 @@ Jenkins
 prepended
 username
 loopback
+CIDR
 addons
 autoscaler
 prometheus

docs/user-guide.rst

@@ -413,6 +413,67 @@ configuration like that:
       enabled: true
       externalScrapeTargetsOnly: true
 
+Secure public endpoints
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Public endpoints (Jenkins, bastion host and if enabled apiserver) can be secured
+by limiting the access to a list of CIDR blocks. This can be configured on a
+environment level for all public endpoint and if wanted can be overwritten on a
+specific public endpoint.
+
+Environment level
++++++++++++++++++
+
+This can be done by adding an ``adminCIDRs`` list to an environments block,
+if nothing has been set, the default is 0.0.0.0/0:
+
+.. code-block:: yaml
+
+    environments:
+    - contact: hello@example.com
+      location: eu-west-1
+      metadata:
+        name: example
+      privateZone: example.local
+      project: example-project
+      provider: aws
+      adminCIDRs:
+      - x.x.x.x/32
+      - y.y.y.y/24
+
+Jenkins and bastion host
+++++++++++++++++++++++++
+
+The environment level can be overwritten for Jenkins and bastion host
+by adding ``allowCIDRs`` in the instance pool block:
+
+.. code-block:: yaml
+
+  instancePools:
+  - image: centos-puppet-agent
+    allowCIDRs:
+    - x.x.x.x/32
+    maxCount: 1
+    metadata:
+      name: jenkins
+    minCount: 1
+    size: large
+    type: jenkins
+
+
+API Server
+++++++++++
+
+For API server you can overwrite the environment level by adding ``allowCIDRs``
+to the kubernetes block
+
+.. code-block:: yaml
+
+  kubernetes:
+    apiServer:
+        public: true
+        allowCIDRs:
+        - y.y.y.y/24
 
 Additional IAM policies
 ~~~~~~~~~~~~~~~~~~~~~~~
@@ -459,4 +520,4 @@ It is possible to add extra policies to only a specific instance pool.
       zone: eu-west-1b
     - metadata:
       zone: eu-west-1c
-    type: worker
+    type: worker

pkg/apis/cluster/v1alpha1/cluster.go

@@ -103,7 +103,8 @@ type ClusterKubernetesDashboard struct {
 
 type ClusterKubernetesAPIServer struct {
 	// expose the API server through a public load balancer
-	Public bool `json:"public,omitempty"`
+	Public     bool     `json:"public,omitempty"`
+	AllowCIDRs []string `json:"allowCIDRs,omitempty"`
 
 	// OIDC
 	OIDC *ClusterKubernetesAPIServerOIDC `json:"oidc,omitempty"`

pkg/apis/cluster/v1alpha1/instancepool.go

@@ -55,6 +55,7 @@ type InstancePool struct {
 	Firewalls         []*Firewall             `json:"firewalls,omitempty"`
 	Volumes           []Volume                `json:"volumes,omitempty"`
 	Kubernetes        *InstancePoolKubernetes `json:"kubernetes,omitempty"`
+	AllowCIDRs        []string                `json:"allowCIDRs,omitempty"`
 
 	// Amazon specific settings for that instance pool
 	Amazon *InstancePoolAmazon `json:"amazon,omitempty"`

pkg/apis/tarmak/v1alpha1/defaults.go

@@ -24,6 +24,10 @@ func SetDefaults_Environment(obj *Environment) {
 	if obj.PrivateZone == "" {
 		obj.PrivateZone = "tarmak.local"
 	}
+
+	if obj.AdminCIDRs == nil {
+		obj.AdminCIDRs = append(obj.AdminCIDRs, "0.0.0.0/0")
+	}
 }
 
 func SetDefaults_Config(obj *Config) {

pkg/apis/tarmak/v1alpha1/types.go

@@ -90,6 +90,7 @@ type Environment struct {
 	Location    string               `json:"location,omitempty"`
 	SSH         *clusterv1alpha1.SSH `json:"ssh,omitempty"`
 	PrivateZone string               `json:"privateZone,omitempty"`
+	AdminCIDRs  []string             `json:"adminCIDRs,omitempty"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

pkg/tarmak/cluster/cluster.go

@@ -147,8 +147,13 @@ func validateClusterTypes(poolMap map[string][]*clusterv1alpha1.InstancePool, cl
 
 // validate server pools
 func (c *Cluster) validateInstancePools() (result error) {
-	return nil
-	//return fmt.Errorf("refactore me!")
+	for _, instancePool := range c.InstancePools() {
+		err := instancePool.Validate()
+		if err != nil {
+			result = multierror.Append(result, err)
+		}
+	}
+	return result
 }
 
 // Verify cluster
@@ -189,6 +194,15 @@ func (c *Cluster) Validate() (result error) {
 		result = multierror.Append(result, err)
 	}
 
+	//validate apiserver
+	if k := c.Config().Kubernetes; k != nil {
+		if apiServer := k.APIServer; apiServer != nil {
+			if err := c.validateAPIServer(); err != nil {
+				result = multierror.Append(result, err)
+			}
+		}
+	}
+
 	return result
 }
 
@@ -235,6 +249,18 @@ func (c *Cluster) validateLoggingSinks() (result error) {
 	return nil
 }
 
+// Validate APIServer
+func (c *Cluster) validateAPIServer() (result error) {
+	for _, cidr := range c.Config().Kubernetes.APIServer.AllowCIDRs {
+		_, _, err := net.ParseCIDR(cidr)
+		if err != nil {
+			result = multierror.Append(result, fmt.Errorf("%s is not a valid CIDR format", cidr))
+		}
+	}
+
+	return result
+}
+
 // Determine if this Cluster is a cluster or hub, single or multi environment
 func (c *Cluster) Type() string {
 	if c.conf.Type != "" {
@@ -392,6 +418,11 @@ func (c *Cluster) Variables() map[string]interface{} {
 		if ok {
 			output[fmt.Sprintf("%s_ami", instancePool.TFName())] = ids
 		}
+		if instancePool.Config().AllowCIDRs != nil {
+			output[fmt.Sprintf("%s_admin_cidrs", instancePool.TFName())] = instancePool.Config().AllowCIDRs
+		} else {
+			output[fmt.Sprintf("%s_admin_cidrs", instancePool.TFName())] = c.environment.Config().AdminCIDRs
+		}
 		output[fmt.Sprintf("%s_min_instance_count", instancePool.TFName())] = instancePool.Config().MinCount
 		output[fmt.Sprintf("%s_max_instance_count", instancePool.TFName())] = instancePool.Config().MaxCount
 	}
@@ -426,6 +457,17 @@ func (c *Cluster) Variables() map[string]interface{} {
 		}
 	}
 
+	// Get Apiserver valid admin cidrs
+	if k := c.Config().Kubernetes; k != nil {
+		if apiServer := k.APIServer; apiServer != nil && apiServer.AllowCIDRs != nil {
+			output["api_admin_cidrs"] = apiServer.AllowCIDRs
+		} else {
+			output["api_admin_cidrs"] = c.environment.Config().AdminCIDRs
+		}
+	} else {
+		output["api_admin_cidrs"] = c.environment.Config().AdminCIDRs
+	}
+
 	// publish changed private zone
 	if privateZone := c.Environment().Config().PrivateZone; privateZone != "" {
 		output["private_zone"] = privateZone

pkg/tarmak/environment/environment.go

@@ -17,6 +17,8 @@ import (
 	"golang.org/x/crypto/ssh"
 	"k8s.io/client-go/rest"
 
+	"net"
+
 	clusterv1alpha1 "github.com/jetstack/tarmak/pkg/apis/cluster/v1alpha1"
 	tarmakv1alpha1 "github.com/jetstack/tarmak/pkg/apis/tarmak/v1alpha1"
 	"github.com/jetstack/tarmak/pkg/tarmak/cluster"
@@ -275,14 +277,27 @@ func (e *Environment) Log() *logrus.Entry {
 	return e.log
 }
 
-func (e *Environment) Validate() error {
-	var result error
+func (e *Environment) Validate() (result error) {
 
-	err := e.Provider().Validate()
-	if err != nil {
+	if err := e.Provider().Validate(); err != nil {
 		result = multierror.Append(result, err)
 	}
 
+	if err := e.ValidateAdminCIDRs(); err != nil {
+		result = multierror.Append(result, err)
+	}
+
+	return result
+}
+
+func (e *Environment) ValidateAdminCIDRs() (result error) {
+	for _, cidr := range e.Config().AdminCIDRs {
+		_, _, err := net.ParseCIDR(cidr)
+		if err != nil {
+			result = multierror.Append(result, fmt.Errorf("%s is not a valid CIDR format", cidr))
+		}
+	}
+
 	return result
 }
 

pkg/tarmak/instance_pool/instance_pool.go

@@ -14,6 +14,7 @@ import (
 	"github.com/jetstack/tarmak/pkg/tarmak/interfaces"
 	"github.com/jetstack/tarmak/pkg/tarmak/role"
 	"github.com/jetstack/tarmak/pkg/tarmak/utils"
+	"net"
 )
 
 var _ interfaces.InstancePool = &InstancePool{}
@@ -185,3 +186,18 @@ func (n *InstancePool) AmazonAdditionalIAMPolicies() string {
 
 	return fmt.Sprintf("[%s]", strings.Join(policies, ","))
 }
+
+func (n *InstancePool) Validate() (result error) {
+	return n.ValidateAllowCIDRs()
+}
+
+func (e *InstancePool) ValidateAllowCIDRs() (result error) {
+	for _, cidr := range e.Config().AllowCIDRs {
+		_, _, err := net.ParseCIDR(cidr)
+		if err != nil {
+			result = multierror.Append(result, fmt.Errorf("%s is not a valid CIDR format", cidr))
+		}
+	}
+
+	return result
+}

pkg/tarmak/interfaces/interfaces.go

@@ -248,6 +248,7 @@ type InstancePool interface {
 	Role() *role.Role
 	Volumes() []Volume
 	Zones() []string
+	Validate() error
 	MinCount() int
 	MaxCount() int
 }