airship/maas
Code Issues Proposed changes

(security) Optionally only allow MAAS api access

Browse Source 
- MAAS does not allow you to turn off the gui which
  may be desired in some scenarios. Use Ingress rules
  to do so optionally.

Change-Id: I22f637ebd2dbbd7c552fd4644bcf27cc9b9661d8
This commit is contained in:
Scott Hussey 2019-01-18 15:55:45 -06:00
parent 7f50e96ff3
commit a833b682db
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
charts/maas/templates/ingress-region.yaml
View File

@ -27,7 +27,11 @@ spec:
- host: {{ tuple "maas_region" "public" . | include "helm-toolkit.endpoints.hostname_fqdn_endpoint_lookup" }} - host: {{ tuple "maas_region" "public" . | include "helm-toolkit.endpoints.hostname_fqdn_endpoint_lookup" }}
http: http:
paths: paths:
{{- if .Values.conf.maas.ingress_disable_gui }}
- path: /MAAS/api
{{- else }}
- path: / - path: /
{{- end }}
backend: backend:
serviceName: {{ tuple "maas_region" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }} serviceName: {{ tuple "maas_region" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }}
servicePort: region-api servicePort: region-api

1
charts/maas/values.yaml
View File

@ -154,6 +154,7 @@ conf:
override: override:
append: append:
http_boot: true http_boot: true
ingress_disable_gui: false
ntp: ntp:
# These options allow you to mock out the ntpd binary within the container # These options allow you to mock out the ntpd binary within the container
# by overwriting it with a script that simply sleeps - this is useful in # by overwriting it with a script that simply sleeps - this is useful in