packet-labs/packetnet-fw-agent

Firewalls for Packet Devices

packetnet-fw-agent's Issues

Test Requirements

Test should:

• Run example TF
• Ping jumphost (won't be firewalled-- if pingable, success):

ping -oc 100000 "$some_address" > /dev/null && exit 0 || exit 1

• Ping FW agent node (will be firewalled-- if pingable, fail, else, pass):

ping -oc 100000 "$some_address" > /dev/null && exit 1 || exit 0

Pretty straightforward workflow, demonstrates functionality intentionally.

This will need a one-liner to get the addresses out of TF state reliably as well.

Helm Chart

Add to packet-labs/helm-charts, potentially as a DaemonSet-- let the CCM Secret provide auth, and the only require SEEK_TAG to find the cluster tag.

Update function name to be consistent with style

Rename this function (and the one instance it is used) to SeekTag to be consistent with the variable naming in the rest of the package:

packetnet-fw-agent/peers.go

Line 8 in 0ec8895

func seekTag(a string, list []string) bool {

update makefile to build all supported arches, kick off docker build

Add makefile options to:

1. build all supported arches
2. then build/tag relevant docker images

multi-arch container pipeline

There's no reason for this to build two images, when the only different is the step targeting the arch when hub support multiple architectures for the same image-- figure that out

update iptables fails

unclear if rules re-apply cleanly, but bails if chain exists but nothing was loaded initially, requires retry to apply cleanly (flush and delete, then recreate?)

tables.go houses all this behavior, imported directly from droplan, but check how its invoked since i did not see similar behavior in droplan when public was disabled. seems to function as expected when public is enabled.

Makefile `clean` fails

Need to fix syntax because clean does not work as-is, and this impacts the Docker build steps.

Uniform Standards Request: Experimental Repository

Hello!

We believe this repository is Experimental and therefore needs the following files updated:

• The Experimental badge
• The Experimental Statement in the README.md
• Getting Started Tutorial
• README.md
• LICENSE
• CI/CD
• OWNERS.md
• Developer Certificate of Origin
• At least one maintainer

If you feel the repository should be maintained or end of life or that you'll need assistance to create these files, please let us know by filing an issue with https://github.com/packethost/standards.

Equinix Metal maintains a number of public repositories that help customers to run various workloads on Equinix Metal. These repositories are in various states of completeness and quality, and being public, developers often find them and start using them. This creates problems:

• Developers using low-quality repositories may infer that Equinix Metal generally provides a low quality experience.
• Many of our repositories are put online with no formal communication with, or training for, customer success. This leads to a below average support experience when things do go wrong.
• We spend a huge amount of time supporting users through various channels when with better upfront planning, documentation and testing much of this support work could be eliminated.

To that end, we propose three tiers of repositories: Private, Experimental, and Maintained.

As a resource and example of a maintained repository, we've created https://github.com/packethost/standards. This is also where you can file any requests for assistance or modification of scope.

The Goal

Our repositories should be the example from which adjacent, competing, projects look for inspiration.

Each repository should not look entirely different from other repositories in the ecosystem, having a different layout, a different testing model, or a different logging model, for example, without reason or recommendation from the subject matter experts from the community.

We should share our improvements with each ecosystem while seeking and respecting the feedback of these communities.

Whether or not strict guidelines have been provided for the project type, our repositories should ensure that the same components are offered across the board. How these components are provided may vary, based on the conventions of the project type. GitHub provides general guidance on this which they have integrated into their user experience.

inconsistent detection of private IPs when PUBLIC=false

capsule can reliably detect the public IPv4 address, and differentiates from private IP when PUBLIC is set to true; when set to false, capsule seems to intermittently (because of how the IP is being pulled from the response body, by index value) retrieve the IPv6 address, which, of course, does not commit to iptables properly.

packet-labs/packetnet-fw-agent will be removed!

This repository will be deleted by November 1, 2021.

While the concepts and instruction provided in this repository may be helpful to some users and carry some relevance, this repository has seen few recent changes. Packet became Equinix Metal over a year ago.

This repository requires maintenance and owners to ensure that the documentation is up to date and relevant. A repository like this one may need to update the version of dependencies and tools for safe consumption.

If you are affected by this deletion, please comment by the November 1, 2021 date.

Alternatives:

• Repo is Archived. This is not preferable, it is intended that the 'packet-labs' GH org is vacated.
• Repo is moved to github.com/equinix-labs. This is only preferably after Packet branding and tooling has been updated to Equinix Metal.