julian/scale-catalog
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add option to disable Kube API firewall

Browse Source 
The middlewared adds a firewall at every boot to block the Kubernetes
API from external access. Add a command line option to drop the firewall
rule.

Signed-off-by: SuperQ <superq@gmail.com>
This commit is contained in:
SuperQ 2022-09-26 15:08:07 +02:00
parent caee00f7eb
commit 79e9c31a42
No known key found for this signature in database
GPG Key ID: C646B23C9E3245F1
4 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
README.md
View File

@ -29,6 +29,7 @@ It also offers a few handy shortcuts for commonly required chores, like: Enablin
| --dns | --dns | None | list all of your applications DNS names and their web ports |
| --list-backups | --list-backups | None | Prints a list of backups available |
| --helm-enable | --helm-enable | None | Enables Helm command access on SCALE |
| --kubeapi-enable | --kubeapi-enable | None | Enables external access to Kuberntes API port |
| --apt-enable | --apt-enable | None | Enables Apt command access on SCALE |
| --no-color | --no-color | None | Disables showing colors in terminal output, usefull for SCALE Email output |
| -U | -U | None | Update applications, ignoring major version changes |

11
includes/chores.sh
View File

@ -12,6 +12,17 @@ chmod +x /usr/bin/apt* && echo -e "${IGreen}APT enabled${Color_Off}"|| echo -e "
}
export -f aptEnable
kubeapiEnable(){
local -r comment='iX Custom Rule to drop connection requests to k8s cluster from external sources'
echo -e "${BWhite}Enabling Apt-Commands${Color_Off}"
if iptables -t filter -L INPUT 2> /dev/null | grep -q "${comment}" ; then
iptables -D INPUT -p tcp -m tcp --dport 6443 -m comment --comment "${comment}" -j DROP && echo -e "${IGreen}Kubernetes API enabled${Color_Off}"|| echo -e "${IRed}Kubernetes API Enable FAILED${Color_Off}"
else
echo -e "${IGreen}Kubernetes API already enabled${Color_Off}"
fi
}
export -f kubeapiEnable
# Prune unused docker images to prevent dataset/snapshot bloat related slowdowns on SCALE
prune(){
echo -e "${BWhite}Docker Prune${Color_Off}"

4
includes/no_args.sh
View File

@ -12,6 +12,7 @@ no_args(){
echo "7 Enable Helm Commands"
echo "8 Enable Apt and Apt-Get Commands"
echo "9 Update All Apps"
echo "10 Enable external access to Kuberntes API port"
read -rt 600 -p "Please select an option by number: " selection
case $selection in
@ -59,6 +60,9 @@ no_args(){
echo "INVALID ENTRY" && exit 1
fi
;;
10)
kubeapiEnable="true"
;;
*)
echo "Unknown option" && exit 1
;;

6
truetool.sh
View File

@ -68,6 +68,9 @@ else
apt-enable)
aptEnable="true"
;;
kubeapi-enable)
kubeapiEnable="true"
;;
no-color)
noColor
;;
@ -158,7 +161,8 @@ fi
[[ "$help" == "true" ]] && help
[[ "$helmEnable" == "true" ]] && helmEnable
[[ "$aptEnable" == "true" ]] && aptEnable
[[ "$aptEnable" == "true" || "$helmEnable" == "true" ]] && exit
[[ "$kubeapiEnable" == "true" ]] && kubeapiEnable
[[ "$aptEnable" == "true" || "$helmEnable" == "true" || "$kubeapiEnable" == "true" ]] && exit
[[ "$listBackups" == "true" ]] && listBackups && exit
[[ "$deleteBackup" == "true" ]] && deleteBackup && exit
[[ "$dns" == "true" ]] && dns && exit