restricted network traffic on zos #98

Closed
opened 2024-09-19 13:27:13 +00:00 by thabeta · 11 comments
Member

Overview

continuation of #82

  • default whitelisted outgoing web traffic (can be turned off by farmer), which means VM's can only go to whitelisted services (https) and web domains (can be with filter e.g. *.ubuntu.com), this to make sure people cannot use our VM's for e.g. hacking
  • the whitelists for outgoing traffic come from a github repo which is signed by us, this gets reloaded every hour

Notes

  • Moved the local network part here: #117
## Overview continuation of https://git.ourworld.tf/tfgrid/circle_engineering/issues/82 - [ ] default whitelisted outgoing web traffic (can be turned off by farmer), which means VM's can only go to whitelisted services (https) and web domains (can be with filter e.g. *.ubuntu.com), this to make sure people cannot use our VM's for e.g. hacking - [ ] the whitelists for outgoing traffic come from a github repo which is signed by us, this gets reloaded every hour ## Notes - Moved the local network part here: https://git.ourworld.tf/tfgrid/circle_engineering/issues/117
Author
Member

as this is requiring a GEP it's moved on its own also still blocked on jan's input

https://github.com/threefoldtech/zos4/pull/6
https://github.com/threefoldtech/zos4/pull/7

as this is requiring a GEP it's moved on its own also still blocked on jan's input https://github.com/threefoldtech/zos4/pull/6 https://github.com/threefoldtech/zos4/pull/7
thabeta added this to the tfgrid_3_15 project 2024-09-19 13:28:23 +00:00
Owner

Update

  • We are syncing with comms circle to make sure the info is properly communicated, only when it is ready to be communicated

Related Issue

Status

  • The GEP can happen after the token-based GEP is passed
  • @delandtj once it's unblocked on your end, comms circle can write the GEP + ops can create it.

@gosam (comms) @sabrinasadik (ops)

# Update - We are syncing with comms circle to make sure the info is properly communicated, only when it is ready to be communicated # Related Issue - Comms circle: https://git.ourworld.tf/tfgrid/circle_promotion/issues/291 # Status - The GEP can happen after the token-based GEP is passed - @delandtj once it's unblocked on your end, comms circle can write the GEP + ops can create it. @gosam (comms) @sabrinasadik (ops)
mik-tf added the
Story
label 2024-09-30 17:55:56 +00:00
delandtj was assigned by mik-tf 2024-10-03 14:17:19 +00:00
Owner

@delandtj can you check on your end if this is feasible? the allowed-list, etc. And please report here. Thanks.

If/once we know it is feasible:

  • The comms circle will make
    • forum post discussing this to community
    • write GEP to be passed
  • Then ops can create the GEP
  • Once the GEP is passed, we can implement it
@delandtj can you check on your end if this is feasible? the allowed-list, etc. And please report here. Thanks. If/once we know it is feasible: - The comms circle will make - forum post discussing this to community - write GEP to be passed - Then ops can create the GEP - Once the GEP is passed, we can implement it
Owner

Update

As discussed in today's meeting, Jan is off for now until he gets better.

After a discussion with @despiegk, Kristof suggests that @lee and @thabeta can have a look at this issue until Jan is back. Hopefully it can be unblocked and completed soon.

I am available to help if possible.

## Update As discussed in today's meeting, Jan is off for now until he gets better. After a discussion with @despiegk, Kristof suggests that @lee and @thabeta can have a look at this issue until Jan is back. Hopefully it can be unblocked and completed soon. I am available to help if possible.
Owner

Update

  • As discussed in today's meeting, Jan is still of so:
    • Lee can supervise the technical aspect
    • Thabet can supervise the high-level view
  • For 3.15 release, we need at least the technical aspect to be completed, then we can adjust the high-level view after grid 3.15 release
# Update - As discussed in today's meeting, Jan is still of so: - Lee can supervise the technical aspect - Thabet can supervise the high-level view - For 3.15 release, we need at least the technical aspect to be completed, then we can adjust the high-level view after grid 3.15 release
mik-tf modified the project from tfgrid_3_15 to tfgrid_3_17 2024-10-24 14:34:59 +00:00
Owner

Update

  • As discussed in today's meeting, we separated the issue in two:
    • Local network: moved here #117
      • We do this issue for 3.15
    • Allowed list: this issue
      • We moved it to 3.16 until we clarify the notions. @despiegk Please give feedback if needed
# Update - As discussed in today's meeting, we separated the issue in two: - Local network: moved here https://git.ourworld.tf/tfgrid/circle_engineering/issues/117 - We do this issue for 3.15 - Allowed list: this issue - We moved it to 3.16 until we clarify the notions. @despiegk Please give feedback if needed
Author
Member
https://github.com/threefoldtech/zos/issues/2399#issuecomment-2441131819
mik-tf modified the project from tfgrid_3_17 to tfgrid_3_15 2024-11-06 07:27:17 +00:00
Owner

@thabeta

As I understand, we now go with smart filtering, as explained here: #129

As for the local network, we have this issue: #117, linked to that GH issue: https://github.com/threefoldtech/zos/issues/2455

In this case, do we close this one? issue 98. And create a GitHub ticket for smart filtering? (gitea issue 129)

@thabeta As I understand, we now go with smart filtering, as explained here: https://git.ourworld.tf/tfgrid/circle_engineering/issues/129 As for the local network, we have this issue: https://git.ourworld.tf/tfgrid/circle_engineering/issues/117, linked to that GH issue: https://github.com/threefoldtech/zos/issues/2455 In this case, do we close this one? issue 98. And create a GitHub ticket for smart filtering? (gitea issue 129)
Author
Member

See with @delandtj he is more aware of the stories and their specs and how we are going to execute them

See with @delandtj he is more aware of the stories and their specs and how we are going to execute them
Owner

As I understand, we now go with smart filtering, as explained here: #129

As for the local network, we have this issue: #117, linked to that GH issue: https://github.com/threefoldtech/zos/issues/2455

In this case, do we close this one? issue 98. And create a GitHub ticket for smart filtering? (gitea issue 129)

@delandtj can you check this? Thanks

> As I understand, we now go with smart filtering, as explained here: https://git.ourworld.tf/tfgrid/circle_engineering/issues/129 > > As for the local network, we have this issue: https://git.ourworld.tf/tfgrid/circle_engineering/issues/117, linked to that GH issue: https://github.com/threefoldtech/zos/issues/2455 > > In this case, do we close this one? issue 98. And create a GitHub ticket for smart filtering? (gitea issue 129) > > @delandtj can you check this? Thanks
Owner

Update

# Update - replaced by https://git.ourworld.tf/tfgrid/circle_engineering/issues/129 and #117
Sign in to join this conversation.
No Milestone
No project
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: tfgrid/circle_engineering#98
No description provided.