Conversation
Mastermjr
left a comment
Mastermjr
left a comment
There was a problem hiding this comment.
all tests should run while LME instance and all the guest vms have no network connectivity.
I think the best way to do this is to setup a jump box that you can connect to and all the other vms in the network have no internet
.github/workflows/offline.yml
Outdated
| ssh -o StrictHostKeyChecking=no lme-user@${{ env.U2_IP }} 'cd ~/LME && NON_INTERACTIVE=true AUTO_CREATE_ENV=true ./install.sh -o -d' | ||
| " | ||
|
|
||
| - name: Remove NSG outbound rules for u2 |
There was a problem hiding this comment.
I only open it to install the stuff for the tests. If we don't at least open all the ports, for maybe remote testing, I am not sure exactly how we can do it.
There was a problem hiding this comment.
thank you, we have to be careful what we allow to run, or else we can run random repos that people create PRs for!
.github/workflows/offline.yml
Outdated
| echo "Azure region: ${{ inputs.azure_region || 'centralus' }}" | ||
| cd testing/v2/development | ||
| docker compose -p ${{ env.UNIQUE_ID }} exec -T pipeline bash -c " | ||
| ssh -o StrictHostKeyChecking=no lme-user@${{ env.U2_IP }} 'cd ~/LME && NON_INTERACTIVE=true AUTO_CREATE_ENV=true ./install.sh -o -d' |
There was a problem hiding this comment.
we should never add outbound back into u2, if we ever allow outbound anything, then the testing framework might lie to us and say something works, when it truly doesn't work on a no-net system
if this is an issue, let me know and we can hop on a call and try and figure out what needs to happen
There was a problem hiding this comment.
I don't think I can ssh to it without allowing traffic both ways. I can limit the traffic to u2 and the build machine maybe.
I was also thinking about redoing it and putting both machines on the same network with different nsgs. That might be the best way.
|
I think either way should work, having only 22 open is probably fine.
The multiple NSGs is also what I was thinking too lol
Hopefully this goes to github
________________________________
From: Clint Baxley ***@***.***>
Sent: Tuesday, December 2, 2025 9:12:26 AM
To: cisagov/LME ***@***.***>
Cc: Reeves, Mikey Johnathan ***@***.***>; Review requested ***@***.***>
Subject: [EXTERNAL] Re: [cisagov/LME] Offline GitHub workflow (PR #733)
@cbaxley commented on this pull request.
________________________________
In .github/workflows/offline.yml<#733 (comment)>:
run: |
- echo "Offline workflow - ready for implementation"
- echo "Azure region: ${{ inputs.azure_region || 'centralus' }}"
+ cd testing/v2/development
+ docker compose -p ${{ env.UNIQUE_ID }} exec -T pipeline bash -c "
+ ssh -o StrictHostKeyChecking=no lme-user@${{ env.U2_IP }} 'cd ~/LME && NON_INTERACTIVE=true AUTO_CREATE_ENV=true ./install.sh -o -d'
I don't think I can ssh to it without allowing traffic both ways. I can limit the traffic to u2 and the build machine maybe.
I was also thinking about redoing it and putting both machines on the same network with different nsgs. That might be the best way.
—
Reply to this email directly, view it on GitHub<#733 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BDCGUN6WO3UWMBIXKPNQUAL37WM4VAVCNFSM6AAAAACNAT7NWWVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZTKMZQGM2DSMZSHA>.
You are receiving this because your review was requested.Message ID: ***@***.***>
|
|
your design looks good to me |
|
github-project-automation
bot
moved this from 🏗 In Progress
to ✅ Done
in LME-Development
3 participants
🗣 Description
This builds the workflow for offline install testing
💭 Motivation and context
📷 Screenshots (DELETE IF UNAPPLICABLE)
🧪 Testing
✅ Pre-approval checklist
the title reflects this in a clear human readable format
✅ Pre-merge Checklist
✅ Post-merge Checklist