improve-swarm-security

[Daneyon Hansen]

Neutron security groups for the swarm bay type were too restrictive, causing containers to be unable to communicate. This was fixed in [1]. However, the fix leaves security rules wide open, allowing all icmp/tcp/udp traffic to the swarm manager and agent nodes.

[1] https://review.openstack.org/229134

A better fix should be implemented that allows container to freely communicate, while providing a reasonable level of protection to swarm nodes.

Suggested implementation:

Allow magnum bay-create to take a parameter --security-group-id that will pass the security group to template generation to result in a security group like the one in magnum/templates/docker-swarm/swarm.yaml.

Consider input validation to require access to the following ports in any security groups passed in:

tcp/22 # ssh
tcp/2375 # docker
tcp/2376 # swarm-manager

If any passed security group does not include these ports, raise an exception indicating that swarm will not work without them.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/352358

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/352358
Committed: https://git.openstack.org/cgit/openstack/magnum/commit/?id=5b02a6090d88c0bfb3dcbdf0a6aa78949d2f873d
Submitter: Jenkins
Branch: master

commit 5b02a6090d88c0bfb3dcbdf0a6aa78949d2f873d
Author: Rajiv Kumar <email address hidden>
Date: Mon Aug 8 16:44:07 2016 +0530

    Improve security for swarm

    All traffic was allowed for swarm manager. With this patch
    following secgroup is created for restricted access.

    Security Group: secgroup_swarm_manager

      1) Allow TCP 22, 2376 ports for everyone.
      2) Allow all the ports to subnet created.
      3) Allow UDP 53 port for everyone.

    Change-Id: Ie1aa4fffeb6317dc200a764319ac93e18d414a4b
    Depends-On: I9ad6e0577918e811e9dd051b56aa69bfe2c391a0
    Closes-bug: #1501050

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/magnum 4.0.0 release.