Skip to content

Harden ignite networking

Warren Gifford requested to merge es/harden-ignite-networking into main

Created by: eseliger

This PR improves the isolation of our executor VMs further by making them all fully isolated on the network.

# Test points:

- SSH into ignite VM
- curl -fv http://169.254.169.254/latest/meta-data/
- ssh 10.61.0.1
- curl -fv google.com
- curl -fvL http://10.0.1.4:5000 FAIL (will fix in tf module)
- ping 10.61.0.1
- ping 10.61.0.3 (other VM) 
- ssh <host_internal_ip>
- ssh <host_external_ip>

Addresses https://github.com/sourcegraph/security-issues/issues/295

Test plan

See test points above, both tested on GCP and AWS.

Merge request reports