Skip to content

Use bosh-enable-monit-access if available and fallback to nftables setup #481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mariash wants to merge 1 commit into from
Closed

Use bosh-enable-monit-access if available and fallback to nftables setup #481

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion stemcell_builder/stages/base_ubuntu_packages/apply.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ source $base_dir/etc/settings.bash
debs="libssl-dev lsof strace bind9-host dnsutils tcpdump iputils-arping \
curl wget bison libreadline6-dev rng-tools \
libxml2 libxml2-dev libxslt1.1 libxslt1-dev zip unzip \
flex psmisc apparmor-utils iptables sysstat \
flex psmisc apparmor-utils iptables nftables sysstat \
rsync openssh-server traceroute libncurses5-dev quota \
libaio1 gdb libcap2-bin libcap2-dev libbz2-dev \
cmake uuid-dev libgcrypt-dev ca-certificates \
Expand Down
12 changes: 11 additions & 1 deletion stemcell_builder/stages/bosh_monit/assets/monit-access-helper.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,13 @@
permit_monit_access() {
/var/vcap/bosh/etc/bosh-enable-monit-access
local vcap_uid
vcap_uid="$(id -u vcap)"

if ! /var/vcap/bosh/etc/bosh-enable-monit-access "$vcap_uid" 2>/dev/null; then
if nft list chain inet bosh_agent monit_access_jobs &>/dev/null; then
if ! nft list chain inet bosh_agent monit_access_jobs 2>/dev/null | grep -q "skuid $vcap_uid"; then
nft add rule inet bosh_agent monit_access_jobs \
meta skuid "$vcap_uid" ip daddr 127.0.0.1 tcp dport 2822 accept
fi
fi
fi
}
Loading