-
-
Notifications
You must be signed in to change notification settings - Fork 334
/
Copy pathdocker_machine_security_group.tf
188 lines (139 loc) · 6.31 KB
/
docker_machine_security_group.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
# Combine runner security group id and additional security group IDs
locals {
# Only include runner security group id and additional if ping is enabled
security_groups_ping = var.runner_networking.allow_incoming_ping && length(var.runner_networking.allow_incoming_ping_security_group_ids) > 0 ? concat(var.runner_networking.allow_incoming_ping_security_group_ids, [aws_security_group.runner.id]) : []
}
resource "aws_security_group" "docker_machine" {
# checkov:skip=CKV2_AWS_5:Security group is used within an template and assigned to the docker machines
count = var.runner_worker.type == "docker+machine" ? 1 : 0
name_prefix = "${local.name_sg}-docker-machine"
vpc_id = var.vpc_id
description = var.runner_worker_docker_machine_security_group_description
tags = merge(
local.tags,
{
"Name" = format("%s", local.name_sg)
},
)
}
resource "aws_vpc_security_group_ingress_rule" "docker_machine" {
for_each = var.runner_worker.type == "docker+machine" ? var.runner_worker_ingress_rules : {}
security_group_id = aws_security_group.docker_machine[0].id
from_port = each.value.from_port
to_port = each.value.to_port
ip_protocol = each.value.protocol
description = each.value.description
prefix_list_id = each.value.prefix_list_id
referenced_security_group_id = each.value.security_group
cidr_ipv4 = each.value.cidr_block
cidr_ipv6 = each.value.ipv6_cidr_block
tags = local.tags
}
resource "aws_vpc_security_group_egress_rule" "docker_machine" {
for_each = var.runner_worker.type == "docker+machine" ? var.runner_worker_egress_rules : {}
security_group_id = aws_security_group.docker_machine[0].id
from_port = each.value.from_port
to_port = each.value.to_port
ip_protocol = each.value.protocol
description = each.value.description
prefix_list_id = each.value.prefix_list_id
referenced_security_group_id = each.value.security_group
cidr_ipv4 = each.value.cidr_block
cidr_ipv6 = each.value.ipv6_cidr_block
tags = local.tags
}
########################################
## Runner agent to docker-machine ##
########################################
# Allow docker-machine traffic from gitlab-runner agent instances to docker-machine instances
resource "aws_vpc_security_group_ingress_rule" "docker_machine_docker_runner" {
count = var.runner_worker.type == "docker+machine" ? 1 : 0
security_group_id = aws_security_group.docker_machine[0].id
from_port = 2376
to_port = 2376
ip_protocol = "tcp"
referenced_security_group_id = aws_security_group.runner.id
description = format(
"Allow docker-machine traffic from group %s to docker-machine instances in group %s",
aws_security_group.runner.name,
aws_security_group.docker_machine[0].name
)
tags = local.tags
}
# Allow SSH traffic from gitlab-runner agent instances and security group IDs to docker-machine instances
resource "aws_vpc_security_group_ingress_rule" "docker_machine_ssh_runner" {
count = var.runner_worker.type == "docker+machine" ? 1 : 0
security_group_id = aws_security_group.docker_machine[0].id
from_port = 22
to_port = 22
ip_protocol = "tcp"
referenced_security_group_id = aws_security_group.runner.id
description = format(
"Allow SSH traffic from %s to docker-machine instances in group %s on port 22",
aws_security_group.runner.id,
aws_security_group.docker_machine[0].name
)
tags = local.tags
}
# Allow ICMP traffic from gitlab-runner agent instances and security group IDs to docker-machine instances
resource "aws_vpc_security_group_ingress_rule" "docker_machine_ping_runner" {
# checkov:skip=CKV_AWS_277:False positive. ICMP traffic has no ports.
count = var.runner_worker.type == "docker+machine" ? length(local.security_groups_ping) : 0
security_group_id = aws_security_group.docker_machine[0].id
from_port = -1
to_port = -1
ip_protocol = "icmp"
referenced_security_group_id = element(local.security_groups_ping, count.index)
description = format(
"Allow ICMP traffic from %s to docker-machine instances in group %s",
element(local.security_groups_ping, count.index),
aws_security_group.docker_machine[0].name
)
tags = local.tags
}
########################################
## Docker-machine instances to self ##
########################################
# Allow docker-machine traffic from docker-machine instances to docker-machine instances on port 2376
resource "aws_vpc_security_group_ingress_rule" "docker_machine_docker_self" {
count = var.runner_worker.type == "docker+machine" ? 1 : 0
security_group_id = aws_security_group.docker_machine[0].id
from_port = 2376
to_port = 2376
ip_protocol = "tcp"
referenced_security_group_id = aws_security_group.docker_machine[0].id
description = format(
"Allow docker-machine traffic within group %s on port 2376",
aws_security_group.docker_machine[0].name,
)
tags = local.tags
}
# Allow SSH traffic from docker-machine instances to docker-machine instances on port 22
resource "aws_vpc_security_group_ingress_rule" "docker_machine_ssh_self" {
count = var.runner_worker.type == "docker+machine" ? 1 : 0
security_group_id = aws_security_group.docker_machine[0].id
from_port = 22
to_port = 22
ip_protocol = "tcp"
referenced_security_group_id = aws_security_group.docker_machine[0].id
description = format(
"Allow SSH traffic within group %s on port 22",
aws_security_group.docker_machine[0].name,
)
tags = local.tags
}
# Allow ICMP traffic from docker-machine instances to docker-machine instances
resource "aws_vpc_security_group_ingress_rule" "docker_machine_ping_self" {
# checkov:skip=CKV_AWS_277:False positive. ICMP traffic has no ports.
count = (var.runner_worker.type == "docker+machine" && var.runner_networking.allow_incoming_ping) ? 1 : 0
security_group_id = aws_security_group.docker_machine[0].id
from_port = -1
to_port = -1
ip_protocol = "icmp"
referenced_security_group_id = aws_security_group.docker_machine[0].id
description = format(
"Allow ICMP traffic within group %s",
aws_security_group.docker_machine[0].name,
)
tags = local.tags
}