Modifying Firewall rules to provide Internet Access to T0/T1 #2327
Conversation
There was a problem hiding this comment.
I can deploy an SRE, but can't actually connect to anything. At the moment, literally only traffic from workspaces is allowed. None of the container services can connect to the internet, so a user can't get to the remote desktop gateway, for example I misdescribed that a bit. Guacamole can't talk to the microsoft Auth servers over the internet, so it can't properly log you in.
|
Have tested a fresh deployment with internet access enabled, and can confirm it works! |
Coverage report
Click to see where and how coverage changed
This report was generated by python-coverage-comment-action |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
cptanalatriste
changed the title
| tags=tags, | ||
| ) | ||
| for dns_zone_name in AzureDnsZoneNames.ALL | ||
| }, # TODO: Check if this works |
| # TODO: Be more precise in rule filtering. | ||
| allow_internet_collection: list[dict] = [ | ||
| rule_collection | ||
| for rule_collection in network_rule_collections | ||
| if rule_collection["name"] == "workspaces-all-allow" | ||
| ] |
|
I don't think I like adding
What does everyone else think? |
| network.AzureFirewallApplicationRuleCollectionArgs( | ||
| action=network.AzureFirewallRCActionArgs( | ||
| type=network.AzureFirewallRCActionType.ALLOW | ||
| application_rule_collections: list[ |
There was a problem hiding this comment.
Can we make a new PR that just has the change that moves the application rules to the variable application_rule_collections = [...] without adding/removing/changing any rules? This would make it much easier to review what's actually changing here.
JimMadge
force-pushed
the
2283-internet-access-tier0-tier1
branch
from
94a5682 to
a7f9275
Compare
✅ Checklist
Enable foobar integrationrather than515 foobar).develop.🚦 Depends on
The proposed approach adds an extra field to the SRE config file (
allow_workspace_internet) and based on its value does the following: 1) Iffalse, business as usual, 2) iftrue, we remove all the firewall's application rules, we add a network rule allowing connections to the internet, and removeuser_rulesDNS server configuration.🌂 Related issues
Closes #2283
🔬 Tests