Configure the Firewall

ARTESCA comes with built-in network firewalling capabilities, which should be configured according to your needs and environment.

After installation, ARTESCA implements firewall rules for host interfaces, and for internal traffic between containers, which is transferred over the workload plane network.

Unless specified otherwise during the configuration file generation step (using --disable-firewall), a standard ARTESCA deployment applies all default firewall rules to the detected network interfaces (with IPs in either control plane or workload plane networks), as described in the reference documentation.

This topic describes how to reconfigure ARTESCA firewall.

Prerequisites

All components must have been deployed.

Enabling or Disabling the Firewall

With the ARTESCA installer, you can enable the default firewall rules with:

[artesca-os@bootstrap ~]$

sudo ./artesca-installer configure-firewall --enable

Or disable them with:

[artesca-os@bootstrap ~]$

sudo ./artesca-installer configure-firewall --disable

Adding Policies and Endpoints

Warning

Manipulating firewall can have dramatic consequences for your ARTESCA cluster and the service it exposes. Make sure you truly understand the implications and configuration options before attempting to create new rules and endpoints. If in doubt, contact Scality.

If the default configuration does not suit your needs, you may create additional GlobalNetworkPolicies and HostEndpoints. Refer to the Calico documentation, and take inspiration from existing rules, which you can retrieve using:

[artesca-os@bootstrap ~]$

sudo kubectl --kubeconfig /etc/kubernetes/admin.conf \
  get globalnetworkpolicies -o yaml

apiVersion: v1
items:
- apiVersion: crd.projectcalico.org/v1
  kind: GlobalNetworkPolicy
  metadata:
    [...]

Things to note are:

• All HostEndpoints created by ARTESCA have a network.metalk8s.scality/<network-type> label, allowing you to apply rules to a subset of all interfaces depending on their network

• HostEndpoints in the control plane network also have all node-role.kubernetes.io/<role> labels copied over for their node

• All GlobalNetworkPolicies created by ARTESCA cannot be edited (all changes will be lost on upgrade or execution of the configure-firewall command). The reserved names are:

  • workload-plane

  • control-plane-bootstrap

  • control-plane-master

  • control-plane-etcd

  • control-plane-general

• Rules have an order which determines when Calico will apply them (the earlier, the more “priority” the rule has). By default, all preinstalled control-plane-* rules have an order between 100 and 105, and the preinstalled workload-plane rule has an order of 200.

Example: Adding a Policy

To authorize all egress traffic on the workload plane interfaces (e.g. for Internet access), you may create such a policy by saving the contents to a file:

[artesca-os@bootstrap ~]$

cat << EOF > /tmp/wp-egress-policy.yaml
apiVersion: crd.projectcalico.org/v1
kind: GlobalNetworkPolicy
metadata:
  name: custom-workload-plane-egress
spec:
  # Define a priority order (here, the rule would apply before all defaults)
  order: 10
  # Apply to all workload plane HostEndpoints
  selector: has(network.metalk8s.scality.com/workload-plane)
  egress:
  - action: Allow
    protocol: TCP
    # You can add destination filters, for instance:
    # destination:
    #   nets: ["10.200.0.0/16"]
    metadata:
      # Annotations will show in iptables comments
      annotations:
        role: custom-egress
EOF
sudo kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f /tmp/wp-egress-policy.yaml

globalnetworkpolicy/custom-workload-plane-egress created

Example: Deleting a Policy

Warning

Deleting network policies can have dramatic consequences for your ARTESCA cluster and the service it exposes. Make sure you truly understand the implications and configuration options before attempting to delete rules and endpoints. If in doubt, contact Scality.

You may delete an existing policy:

[artesca-os@bootstrap ~]$

sudo kubectl --kubeconfig /etc/kubernetes/admin.conf delete globalnetworkpolicy custom-workload-plane-egress

globalnetworkpolicy/custom-workload-plane-egress deleted