feat.

Author: vknabel

capi-lab/roles/firewall-controller-manager/defaults/main.yaml

@@ -17,3 +17,8 @@ firewall_controller_manager_shoot_access_token_secret: "shoot-access-firewall-co
 
 firewall_controller_manager_secrets_server:
 firewall_controller_manager_ca_bundle:
+
+firewall_controller_manager_crd_fetch_base_url: "https://raw.githubusercontent.com/metal-stack/firewall-controller-manager/refs/heads/"
+# TODO:
+# firewall_controller_manager_crd_fetch_base_url: "https://raw.githubusercontent.com/metal-stack/firewall-controller-manager/refs/tags/"
+firewall_controller_manager_image_tag: initial-firewall-ruleset

capi-lab/roles/firewall-controller-manager/tasks/main.yaml

@@ -14,14 +14,13 @@
 
 - name: Deploy firewall-controller-manager CRDs
   k8s:
-    definition: "{{ lookup('url', 'https://raw.githubusercontent.com/metal-stack/firewall-controller-manager/refs/tags/' + firewall_controller_manager_image_tag + '/config/crds/' + item, split_lines=False) }}"
+    definition: "{{ lookup('url', firewall_controller_manager_crd_fetch_base_url + firewall_controller_manager_image_tag + '/config/crds/' + item, split_lines=False) }}"
     namespace: "{{ firewall_controller_manager_namespace }}"
   loop:
     - firewall.metal-stack.io_firewalldeployments.yaml
     - firewall.metal-stack.io_firewallmonitors.yaml
     - firewall.metal-stack.io_firewalls.yaml
     - firewall.metal-stack.io_firewallsets.yaml
-
 # - name: Deploy firewall-controller-manager
 #   k8s:
 #     definition:

go.mod

@@ -4,7 +4,7 @@ go 1.23.0
 
 require (
 	github.com/go-logr/logr v1.4.2
-	github.com/metal-stack/firewall-controller-manager v0.4.3
+	github.com/metal-stack/firewall-controller-manager v0.4.4-0.20241121151352-d3362457f60b
 	github.com/metal-stack/metal-go v0.37.2
 	github.com/metal-stack/metal-lib v0.18.4
 	github.com/onsi/ginkgo/v2 v2.20.2

go.sum

@@ -140,8 +140,8 @@ github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNB
 github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/metal-stack/firewall-controller-manager v0.4.3 h1:WU5bqD710gUtzyA2NdWJuSveCbOhllQ7ybpgUg7aJW8=
-github.com/metal-stack/firewall-controller-manager v0.4.3/go.mod h1:J/3LHcvfJCpEEC4yk+WD0exh3btaScCaFkzbnbOsqrY=
+github.com/metal-stack/firewall-controller-manager v0.4.4-0.20241121151352-d3362457f60b h1:MKtYVt1QPVSd9LzTW532QzVz9c+hIUst7+8SmxhM8us=
+github.com/metal-stack/firewall-controller-manager v0.4.4-0.20241121151352-d3362457f60b/go.mod h1:J/3LHcvfJCpEEC4yk+WD0exh3btaScCaFkzbnbOsqrY=
 github.com/metal-stack/metal-go v0.37.2 h1:SDIuV43y09kmwtHfsReOZoZ7c2F+lNP4iIhazfJL5tQ=
 github.com/metal-stack/metal-go v0.37.2/go.mod h1:3MJTYCS4YJz8D8oteTKhjpaAKNMMjMKYDrIy9awHGtQ=
 github.com/metal-stack/metal-lib v0.18.4 h1:7HnfSwSbrKNHU+i6i79YFk/eeuhBhwIEHWpGqS7pYCc=

internal/controller/metalstackcluster_controller.go

@@ -433,6 +433,49 @@ func (r *clusterReconciler) ensureFirewallDeployment(nodeNetworkID string) (*fcm
 			tag.ClusterID: string(r.infraCluster.GetUID()),
 		}
 
+		deploy.Spec.Template.Spec.InitialRuleSet = &fcmv2.InitialRuleSet{
+			Egress: []fcmv2.EgressRule{
+				{
+					Comment:  "allow outgoing http",
+					Ports:    []int32{80},
+					Protocol: fcmv2.NetworkProtocolTCP,
+					To:       []string{"0.0.0.0/0"},
+				},
+				{
+					Comment:  "allow outgoing https",
+					Ports:    []int32{443},
+					Protocol: fcmv2.NetworkProtocolTCP,
+					To:       []string{"0.0.0.0/0"},
+				},
+				{
+					Comment:  "allow outgoing dns via tcp",
+					Ports:    []int32{53},
+					Protocol: fcmv2.NetworkProtocolTCP,
+					To:       []string{"0.0.0.0/0"},
+				},
+				{
+					Comment:  "allow outgoing dns and ntp via udp",
+					Ports:    []int32{53, 123},
+					Protocol: fcmv2.NetworkProtocolUDP,
+					To:       []string{"0.0.0.0/0"},
+				},
+			},
+			Ingress: []fcmv2.IngressRule{
+				{
+					Comment:  "allow incoming ssh",
+					Ports:    []int32{22},
+					Protocol: fcmv2.NetworkProtocolTCP,
+					From:     []string{"0.0.0.0/0"}, // TODO: restrict cidr
+				},
+				{
+					Comment:  "allow incoming https to kube-apiserver",
+					Ports:    []int32{443},
+					Protocol: fcmv2.NetworkProtocolTCP,
+					From:     []string{"0.0.0.0/0"}, // TODO: restrict cidr
+				},
+			},
+		}
+
 		if deploy.Spec.Template.Labels == nil {
 			deploy.Spec.Template.Labels = map[string]string{}
 		}