Merge lp:~michael.nelson/charms/trusty/elasticsearch/ufw-for-peers-too into lp:~charmers/charms/trusty/elasticsearch/trunk

[Michael Nelson]

Firewall rules for the node-to-node communications port 9300

This branch follows on from the prerequisite, and adds firewall rules for the peer-to-peer communications port 9300.

I found that I could only deny all on 9300 once the unit had joined the cluster, as the es master communicates back to the unit is part of joining the cluster.

Here's a full demo of adding and destroying units showing the firewall rules at each step (note, the charm has a task that actually fails if a unit fails to join the cluster):

http://paste.ubuntu.com/7765540/

[Kapil Thangavelu (hazmat)]

same comments apply to this as to the pre-req merge proposal, re upgrade of extant cluster.

[lp:~michael.nelson/charms/trusty/elasticsearch/ufw-for-peers-too]

40. By Michael Nelson on 2014-07-30

Merged add-ufw

41. By Michael Nelson on 2014-07-30

Rewrite ufw during peer relations too.

[Michael Nelson (michael.nelson)]

Ditto (see comments on pre-req MP).

I tested an upgrade-charm of a configured elasticsearch service using
this branch: https://pastebin.canonical.com/114541/

Thanks.

[Kapil Thangavelu (hazmat)]

lgtm

review: Approve

[Matt Bruzek (mbruzek)]

I tested this several different ways and found it to work as described. Thank you Michael for providing the pastebin outline for tests.

I did deploy 2 nodes of elastic search before the ufw fix verified they did not have ufw rules and then upgraded-charm to the latest version. The upgrade went well and worked as expected.

I also tested with an ELK relations. Adding and destroying units of elastic search.

This change looks good to me. +1

review: Approve

=== modified file 'README.md'
--- README.md	2014-07-30 07:23:55 +0000
+++ README.md	2014-07-30 07:23:55 +0000
@@ -37,6 +37,10 @@
     epoch      timestamp cluster       status node.total node.data shards ...
     1404728290 10:18:10  elasticsearch green           2         2      0
 
+Note that the admin port (9200) is only accessible from the instance itself
+and any clients that join. Similarly the node-to-node communication
+port (9300) is only available to other units in the elasticsearch service.
+
 See the separate HACKING.md for information about deploying this charm
 from a local repository.
 
 
=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2014-07-30 07:23:55 +0000
+++ hooks/hooks.py	2014-07-30 07:23:55 +0000
@@ -13,6 +13,7 @@
         'config-changed',
         'cluster-relation-joined',
         'peer-relation-joined',
+        'peer-relation-departed',
         'nrpe-external-master-relation-changed',
         'rest-relation-joined',
         'start',
 
=== added symlink 'hooks/peer-relation-departed'
=== target is u'hooks.py'
=== modified file 'playbook.yaml'
--- playbook.yaml	2014-07-30 07:23:55 +0000
+++ playbook.yaml	2014-07-30 07:23:55 +0000
@@ -13,17 +13,20 @@
   vars:
     - service_name: "{{ local_unit.split('/')[0] }}"
     - client_relation_id: "{{ relations['client'].keys()[0] | default('') }}"
+    - peer_relation_id: "{{ relations['peer'].keys()[0] | default('') }}"
 
   tasks:
 
     - include: tasks/install-elasticsearch.yml
+    - include: tasks/peer-relations.yml
     - include: tasks/setup-ufw.yml
       tags:
         - install
         - upgrade-charm
         - client-relation-joined
         - client-relation-departed
-    - include: tasks/peer-relations.yml
+        - peer-relation-joined
+        - peer-relation-departed
 
     - name: Update configuration
       tags:
 
=== modified file 'tasks/peer-relations.yml'
--- tasks/peer-relations.yml	2014-06-06 14:40:08 +0000
+++ tasks/peer-relations.yml	2014-07-30 07:23:55 +0000
@@ -54,4 +54,3 @@
     - peer-relation-joined
   fail: msg="Unit failed to join cluster during peer-relation-joined"
   when: cluster_health.json.number_of_nodes == 1 and cluster_health_after_restart.json.number_of_nodes == 1
-
 
=== modified file 'tasks/setup-ufw.yml'
--- tasks/setup-ufw.yml	2014-07-30 07:23:55 +0000
+++ tasks/setup-ufw.yml	2014-07-30 07:23:55 +0000
@@ -27,3 +27,14 @@
 
 - name: Deny all other requests on 9200
   ufw: rule=deny port=9200
+
+- name: Open the firewall for all peers
+  ufw: rule=allow src={{ item.value['private-address'] }} port=9300 proto=tcp
+  with_dict: relations["peer"]["{{ peer_relation_id }}"] | default({})
+  when: not item.key == local_unit
+
+# Only deny incoming on 9300 once the unit is part of a cluster.
+- name: Deny all incoming requests on 9300 once unit is part of cluster
+  ufw: rule=deny port=9300
+  when: not peer_relation_id == ""
+