Merge ~cjwatson/launchpad-mojo-specs:codeimport-update-puller-secgroups into launchpad-mojo-specs:master

[Colin Watson]

codeimport: Update secgroups for new codehosting deployments

[Guruprasad (lgp171188)]

LGTM 👍

review: Approve

diff --git a/lp-codeimport/configs/custom-secgroups-production.yaml b/lp-codeimport/configs/custom-secgroups-production.yaml
index 1a60ee0..796d4d0 100644
--- a/lp-codeimport/configs/custom-secgroups-production.yaml
+++ b/lp-codeimport/configs/custom-secgroups-production.yaml
@@ -28,3 +28,6 @@ rules:
         # codehost-ps5.lp.internal / bazaar.launchpad.net
         - {"protocol": "tcp", "family": "IPv4", "port": 22, "cidr": "10.131.66.217/32"}
         - {"protocol": "tcp", "family": "IPv4", "port": 22, "cidr": "185.125.189.232/32"}
+        # prod-launchpad@is-bastion-ps5 (firewall rules apply finer-grained
+        # ACLs)
+        - {"protocol": "tcp", "family": "IPv4", "port": 22, "cidr": "10.131.215.0/24"}
diff --git a/lp-codeimport/configs/custom-secgroups-qastaging.yaml b/lp-codeimport/configs/custom-secgroups-qastaging.yaml
index ad442af..c939bad 100644
--- a/lp-codeimport/configs/custom-secgroups-qastaging.yaml
+++ b/lp-codeimport/configs/custom-secgroups-qastaging.yaml
@@ -7,6 +7,10 @@ applications:
         type: neutron
         rules:
             - rsync-logs
+    lp-codeimport-storage:
+        type: neutron
+        rules:
+            - puller
 rules:
     nagios-monitored:
         # Allow monitoring from wendigo.
@@ -18,3 +22,10 @@ rules:
         # Allow carob and launchpad-bastion-ps5 to fetch logs.
         - {"protocol": "tcp", "family": "IPv4", "port": 873, "cidr": "91.189.90.14/32"}
         - {"protocol": "tcp", "family": "IPv4", "port": 873, "cidr": "10.131.10.100/32"}
+    puller:
+        # Bazaar imports aren't pushed directly to
+        # bazaar.qastaging.launchpad.net, but instead pulled from the code
+        # import storage unit.
+        # stg-launchpad@launchpad-bastion-ps5 (firewall rules apply
+        # finer-grained ACLs)
+        - {"protocol": "tcp", "family": "IPv4", "port": 22, "cidr": "10.132.54.0/24"}
diff --git a/lp-codeimport/configs/custom-secgroups-staging.yaml b/lp-codeimport/configs/custom-secgroups-staging.yaml
index a5e149a..17118ea 100644
--- a/lp-codeimport/configs/custom-secgroups-staging.yaml
+++ b/lp-codeimport/configs/custom-secgroups-staging.yaml
@@ -28,3 +28,6 @@ rules:
         # import storage unit.
         # tellurium.canonical.com
         - {"protocol": "tcp", "family": "IPv4", "port": 22, "cidr": "91.189.94.53/32"}
+        # stg-launchpad@launchpad-bastion-ps5 (firewall rules apply
+        # finer-grained ACLs)
+        - {"protocol": "tcp", "family": "IPv4", "port": 22, "cidr": "10.132.54.0/24"}