Deployed applications are implicitly exposed on Equinix metal

[Achilleas Anagnostopoulos]

Each provisioned machine on Equinix metal is assigned both a private and a public IP address. Due to substrate limitations (no support for the equivalent of security groups / firewall control), all machines, and therefore any ports opened by units, are reachable from the Internet via their public address. However, if the workloads are deployed as LXD containers then this is a non-issue as containers are always (by default) assigned FAN addresses.

One potential solution for this problem is as follows: during the machine provisioning step where we execute additional scripts (at cloudinit time) to correct the routing table entries, we can install iptable rules that prevent ingress traffic from public IP addresses but allow egress traffic so that charms can still download their dependencies (apt packages, snaps etc.).

Then, the provider can implement the (instance) Firewaller interface and manipulate the iptable rules as needed to support 'juju expose' using the existing ssh-based iptable mutator helpers (e.g. as we do for the rackspace provider https://github.com/juju/juju/blob/develop/provider/rackspace/firewaller.go).

[Achilleas Anagnostopoulos (achilleasa)]

PR https://github.com/juju/juju/pull/13695 tracks the work for resolving this issue.