openstack
/
magnum
Code Issues Proposed changes

Merge "Add iptables rule to listen m-api"

This commit is contained in:
Jenkins 2015-11-12 16:19:43 +00:00 committed by Gerrit Code Review
parent 46ed284887 2316016ccc
commit 9bf633f002
2 changed files with 2 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
devstack/lib/magnum
View File

@ -281,6 +281,8 @@ function configure_iptables {
ROUTE_TO_INTERNET=$(ip route get 8.8.8.8)
OBOUND_DEV=$(echo ${ROUTE_TO_INTERNET#*dev} | awk '{print $1}')
sudo iptables -t nat -A POSTROUTING -o $OBOUND_DEV -j MASQUERADE
# bay nodes will access m-api (port $MAGNUM_SERVICE_PORT) to get CA certificate.
sudo iptables -I INPUT -d $HOST_IP -p tcp --dport $MAGNUM_SERVICE_PORT -j ACCEPT || true
fi
}

10
magnum/tests/contrib/post_test_hook.sh
View File

@ -99,16 +99,6 @@ nova keypair-add default
echo_summary "Create a flavor"
nova flavor-create m1.magnum 100 2048 8 1
# FIXME(eliqao): workaround for allow 9511 can be accessed from VM.
# k8s nodes will access m-api (port 9511) to get CA certificate.
sudo iptables -D openstack-INPUT -j REJECT --reject-with icmp-host-prohibited
sudo iptables -D openstack-INPUT -m limit --limit 2/min -j LOG --log-prefix "iptables dropped: "
sudo iptables -A openstack-INPUT -s 172.24.4.0/23 -p tcp -m tcp --dport 9511 -j ACCEPT
sudo iptables -A openstack-INPUT -m limit --limit 2/min -j LOG --log-prefix "iptables dropped: "
sudo iptables -A openstack-INPUT -j REJECT --reject-with icmp-host-prohibited
# Run functional tests
# Currently we support functional-api, functional-k8s, will support swarm,
# mesos later.