security_groups.yaml

heat_template_version: 2016-04-08

parameters:
  control_plane_ports:
    type: comma_delimited_list
    description: ports to open for external access to haproxy servers
    default: "8443"
  data_plane_ports:
    type: comma_delimited_list
    description: ports to open for external access to haproxy servers
    default: "80,443"
  net2_data_plane_ports:
    type: comma_delimited_list
    description: ports to open for external access to haproxy servers
    default: "80,443"
  extra_data_plane_ports:
    type: comma_delimited_list
    description: ports to open for external access to haproxy servers
    default: "80,443"
  control_plane_sources:
    type: comma_delimited_list
    description: ip addresses that inbound connectivity can come from
  monitoring_sources:
    type: comma_delimited_list
    description: ip addresses that inbound connectivity for monitoring
  data_plane_sources:
    type: comma_delimited_list
    description: ip addresses that inbound connectivity can come from
  net2_data_plane_sources:
    type: comma_delimited_list
    description: ip addresses that inbound connectivity can come from
    default: [ "0.0.0.0/0" ]
  extra_data_plane_sources:
    type: comma_delimited_list
    description: ip addresses that inbound connectivity can come from
    default: [ "0.0.0.0/0" ]
  bastion_sources:
    type: comma_delimited_list
    description: ip addresses that inbound SSH connectivity can come from

resources:
  external_service_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: external_service_sg

  bastion_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: bastion_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  masters_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: masters_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  infra_nodes_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: infra_nodes_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  internet_nodes_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: internet_nodes_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  net2_nodes_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: net2_nodes_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  all_nodes_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: all_nodes_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  controlplane_lb_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: controlplane_lb_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  internet_lb_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: internet_lb_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  net2_lb_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: net2_lb_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  all_net2_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: all_net2_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  all_internet_egress_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: all_internet_egress_sg
      rules:
        - direction: egress
          ethertype: IPv4

  bastion_external_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: bastion_external_sg
      rules:
        repeat:
          for_each:
            <%sourceip%>: { get_param: bastion_sources }
          template:
            direction: ingress
            remote_ip_prefix: <%sourceip%>
            protocol: tcp
            port_range_min: 22
            port_range_max: 22

  bastion_internal_ssh_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: bastion_internal_ssh_sg
      rules:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: bastion_egress_secgroup }
          protocol: tcp
          port_range_min: 22
          port_range_max: 22

  control_plane_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: controlplane_sg
      rules:
        repeat:
          for_each:
            <%sourceip%>: { get_param: control_plane_sources }
            <%port%>: { get_param: control_plane_ports }
          template:
            protocol: tcp
            direction: ingress
            remote_ip_prefix: <%sourceip%>
            port_range_min: <%port%>
            port_range_max: <%port%>


  monitoring_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: monitoring_sg
      rules:
        repeat:
          for_each:
            <%sourceip%>: { get_param: monitoring_sources }
            <%port%>: { get_param: control_plane_ports }
          template:
            protocol: tcp
            direction: ingress
            remote_ip_prefix: <%sourceip%>
            port_range_min: <%port%>
            port_range_max: <%port%>

  controlplane_certbot_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: controlplane_certbot_sg
      rules:
          - direction: ingress
            protocol: tcp
            remote_ip_prefix: 0.0.0.0/0
            port_range_min: 80
            port_range_max: 80

  proxy_controlplane_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: proxy_controlplane_sg
      rules:
        - direction: ingress
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_nodes_egress_secgroup }
          protocol: tcp
          port_range_min: 3128
          port_range_max: 3128

  vrrp_controlplane_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: vrrp_controlplane_sg
      rules:
        - protocol: 112
          direction: ingress
          remote_mode: remote_group_id
          
  vrrp_dataplane_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: vrrp_dataplane_sg
      rules:
        - protocol: 112
          direction: ingress
          remote_mode: remote_group_id

  vrrp_net2_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: vrrp_net2_sg
      rules:
        - protocol: 112
          direction: ingress
          remote_mode: remote_group_id

  data_plane_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: dataplane_sg
      rules:
        repeat:
          for_each:
            <%sourceip%>: { get_param: data_plane_sources }
            <%port%>: { get_param: data_plane_ports }
          template:
            protocol: tcp
            direction: ingress
            remote_ip_prefix: <%sourceip%>
            port_range_min: <%port%>
            port_range_max: <%port%>

  net2_data_plane_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: dataplane_net2_sg
      rules:
        repeat:
          for_each:
            <%sourceip%>: { get_param: net2_data_plane_sources }
            <%port%>: { get_param: net2_data_plane_ports }
          template:
            protocol: tcp
            direction: ingress
            remote_ip_prefix: <%sourceip%>
            port_range_min: <%port%>
            port_range_max: <%port%>

  extra_data_plane_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: dataplane_extra_sg
      rules:
        repeat:
          for_each:
            <%sourceip%>: { get_param: extra_data_plane_sources }
            <%port%>: { get_param: extra_data_plane_ports }
          template:
            protocol: tcp
            direction: ingress
            remote_ip_prefix: <%sourceip%>
            port_range_min: <%port%>
            port_range_max: <%port%>

  all_nodes_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: all_nodes_sg
      rules:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: masters_egress_secgroup }
          protocol: tcp
          port_range_min: 10250
          port_range_max: 10250
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: infra_nodes_egress_secgroup }
          protocol: tcp
          port_range_min: 10250
          port_range_max: 10250
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          protocol: udp
          port_range_min: 4789
          port_range_max: 4789
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          protocol: tcp
          port_range_min: 9100
          port_range_max: 9100
          # Portworx ports:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_nodes_egress_secgroup }
          protocol: tcp
          port_range_min: 9001
          port_range_max: 9022

  infra_nodes_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: infra_nodes_sg
      rules:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: net2_lb_egress_secgroup }
          protocol: tcp
          port_range_min: 80
          port_range_max: 80
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: net2_lb_egress_secgroup }
          protocol: tcp
          port_range_min: 443
          port_range_max: 443
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: internet_lb_egress_secgroup }
          protocol: tcp
          port_range_min: 7080
          port_range_max: 7080
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: internet_lb_egress_secgroup }
          protocol: tcp
          port_range_min: 7443
          port_range_max: 7443

  internet_nodes_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: internet_nodes_sg
      rules:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_internet_egress_secgroup }
          protocol: tcp
          port_range_min: 80
          port_range_max: 80
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_internet_egress_secgroup }
          protocol: tcp
          port_range_min: 443
          port_range_max: 443

  net2_nodes_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: net2_nodes_sg
      rules:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_net2_egress_secgroup }
          protocol: tcp
          port_range_min: 80
          port_range_max: 80
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_net2_egress_secgroup }
          protocol: tcp
          port_range_min: 443
          port_range_max: 443

  vrrp_nodes_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: vrrp_nodes_sg
      rules:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          protocol: vrrp

  dns_internet_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: dns_internet_sg
      rules:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_internet_egress_secgroup }
          protocol: tcp
          port_range_min: 53
          port_range_max: 53
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_internet_egress_secgroup }
          protocol: udp
          port_range_min: 53
          port_range_max: 53

  dns_forwarder_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: dns_forwarder_sg
      rules:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: net2_lb_egress_secgroup }
          protocol: tcp
          port_range_min: 53
          port_range_max: 53
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: net2_lb_egress_secgroup }
          protocol: udp
          port_range_min: 53
          port_range_max: 53

  dns_net2_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: dns_net2_sg
      rules:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_net2_egress_secgroup }
          protocol: tcp
          port_range_min: 53
          port_range_max: 53
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_net2_egress_secgroup }
          protocol: udp
          port_range_min: 53
          port_range_max: 53


  masters_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: masters_sg
      rules:
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_nodes_egress_secgroup }
          protocol: tcp
          port_range_min: 8443
          port_range_max: 8444
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: controlplane_lb_egress_secgroup }
          protocol: tcp
          port_range_min: 8443
          port_range_max: 8443
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_nodes_egress_secgroup }
          protocol: tcp
          port_range_min: 8053
          port_range_max: 8053
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_nodes_egress_secgroup }
          protocol: udp
          port_range_min: 8053
          port_range_max: 8053
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          protocol: tcp
          port_range_min: 2379
          port_range_max: 2380

  net2_router_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      name: net2_router_sg
      rules:
        - direction: egress
          ethertype: IPv4
        - direction: ingress
          ethertype: IPv4
          remote_mode: remote_group_id
          remote_group_id: { get_resource: all_net2_egress_secgroup }

outputs:
  external_service_security_group:
    description: Externally exposed service security group
    value: { get_resource: external_service_secgroup }
  bastion_egress_security_group:
    description: Bastion egress security group
    value: { get_resource: bastion_egress_secgroup }
  masters_egress_security_group:
    description: Masters egress security group
    value: { get_resource: masters_egress_secgroup }
  infra_nodes_egress_security_group:
    description: Infrastructure facing nodes egress security group
    value: { get_resource: infra_nodes_egress_secgroup }
  internet_nodes_egress_security_group:
    description: Internet facing nodes egress security group
    value: { get_resource: internet_nodes_egress_secgroup }
  net2_nodes_egress_security_group:
    description: Net2 facing nodes egress security group
    value: { get_resource: net2_nodes_egress_secgroup }
  all_nodes_egress_security_group:
    description: All nodes egress security group
    value: { get_resource: all_nodes_egress_secgroup }
  control_plane_lb_egress_security_group:
    description: Control Plane LB egress security group
    value: { get_resource: controlplane_lb_egress_secgroup }
  internet_lb_egress_security_group:
    description: Internet data plane LB egress security group
    value: { get_resource: internet_lb_egress_secgroup }
  net2_lb_egress_security_group:
    description: Net2 data plane LB egress security group
    value: { get_resource: net2_lb_egress_secgroup }
  all_net2_egress_security_group:
    description: All net2 servers egress security group
    value: { get_resource: all_net2_egress_secgroup }
  all_internet_egress_security_group:
    description: All internet facing servers egress security group
    value: { get_resource: all_internet_egress_secgroup }
  vrrp_nodes_security_group:
    description: VRRP access between tenant and net2 nodes
    value: { get_resource: vrrp_nodes_secgroup }
  bastion_external_security_group:
    description: Bastion external security group
    value: { get_resource: bastion_external_secgroup }
  bastion_internal_ssh_security_group:
    description: Bastion ssh security group
    value: { get_resource: bastion_internal_ssh_secgroup }
  control_plane_security_group:
    description: Security group controlling access to the control plane
    value: { get_resource: control_plane_secgroup }
  monitoring_security_group:
    description: Security group controlling access to the control plane for monitoring
    value: { get_resource: monitoring_secgroup }
  data_plane_security_group:
    description: Security group controlling access to the data plane
    value: { get_resource: data_plane_secgroup }
  net2_data_plane_security_group:
    description: Security group controlling access to the data plane
    value: { get_resource: net2_data_plane_secgroup }
  extra_data_plane_security_group:
    description: Security group controlling access to the data plane
    value: { get_resource: extra_data_plane_secgroup }
  all_nodes_security_group:
    description: Security group controlling access to all openshift nodes
    value: { get_resource: all_nodes_secgroup }
  infra_nodes_security_group:
    description: Security group controlling access to all infrastructure openshift nodes
    value: { get_resource: infra_nodes_secgroup }
  internet_nodes_security_group:
    description: Security group controlling access to all internet openshift nodes
    value: { get_resource: internet_nodes_secgroup }
  net2_nodes_security_group:
    description: Security group controlling access to all net2 openshift nodes
    value: { get_resource: net2_nodes_secgroup }
  dns_internet_security_group:
    description: Internet based DNS security group
    value: { get_resource: dns_internet_secgroup }
  dns_forwarder_security_group:
    description: DNS forwarder access security group
    value: { get_resource: dns_forwarder_secgroup }
  dns_net2_security_group:
    description: Net2 based DNS security group
    value: { get_resource: dns_net2_secgroup }
  masters_security_group:
    description: Masters security group
    value: { get_resource: masters_secgroup }
  net2_router_security_group:
    description: Net2 Router security group
    value: { get_resource: net2_router_secgroup }
  vrrp_controlplane_security_group:
    description: Controlplane LB VRRP security group
    value: { get_resource: vrrp_controlplane_secgroup }
  vrrp_dataplane_security_group:
    description: Dataplane LB VRRP security group
    value: { get_resource: vrrp_dataplane_secgroup }
  vrrp_net2_security_group:
    description: Net2 LB VRRP security group
    value: { get_resource: vrrp_net2_secgroup }
  proxy_security_group:
    description: Net2 LB VRRP security group
    value: { get_resource: proxy_controlplane_secgroup }
  controlplane_certbot_security_group:
    description: Security group allowing http-01 challenge
    value: { get_resource: controlplane_certbot_secgroup }