Skip to content

Commit 41844b0

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #100325 from AedinC/OSDOCS-16479
[OSDOCS 16479] Finish OSD create new limit egress tutorial
2 parents 3638cc0 + fc9e0fd commit 41844b0

12 files changed

+459
-0
lines changed

‎_topic_maps/_topic_map_osd.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,8 @@ Topics:
9393
File: osd_index
9494
- Name: Updating component routes with custom domains and TLS certificates
9595
File: cloud-experts-osd-update-component-routes
96+
- Name: Limit egress with Google Cloud Next Generation Firewall
97+
File: cloud-experts-osd-create-new-limit-egress
9698
---
9799
Name: Red Hat OpenShift Cluster Manager
98100
Dir: ocm

‎cloud_experts_osd_tutorials/cloud-experts-osd-create-new-limit-egress.adoc‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="cloud-experts-osd-limit-egress-ngfw"]
3+
= Tutorial: Limit egress with Google Cloud Next Generation Firewall
4+
5+
include::_attributes/attributes-openshift-dedicated.adoc[]
6+
:context: cloud-experts-osd-limit-egress-ngfw
7+
8+
toc::[]
9+
10+
[role="_abstract"]
11+
Use this guide to implement egress restrictions for {product-title} on {GCP} by using {GCP}'s Next Generation Firewall (NGFW). NGFW is a fully distributed firewall service that allows fully qualified domain name (FQDN) objects in firewall policy rules. This is necessary for many of the external endpoints that {product-title} relies on.
12+
13+
[IMPORTANT]
14+
====
15+
The ability to restrict egress traffic using a firewall or other network device is only supported with {product-title} clusters deployed using Private Service Connect (PSC). Clusters that do not use PSC require a support exception to use this functionality. For additional assistance, please open a link:https://access.redhat.com/support/cases/?extIdCarryOver=true&sc_cid=701f2000001Css5AAC#/case/new/get-support?caseCreate=true[support case].
16+
====
17+
18+
include::modules/cloud-experts-osd-limit-egress-ngfw-prereqs.adoc[leveloffset=+1]
19+
20+
include::modules/cloud-experts-osd-limit-egress-ngfw-setup-environ.adoc[leveloffset=+1]
21+
22+
include::modules/cloud-experts-osd-limit-egress-ngfw-create-subnets.adoc[leveloffset=+1]
23+
24+
include::modules/cloud-experts-osd-limit-egress-ngfw-deploy-policy.adoc[leveloffset=+1]
25+
26+
include::modules/cloud-experts-osd-limit-egress-ngfw-create-a-cloud-router.adoc[leveloffset=+1]
27+
28+
include::modules/cloud-experts-osd-limit-egress-ngfw-create-private-dns.adoc[leveloffset=+1]
29+
30+
include::modules/cloud-experts-osd-limit-egress-ngfw-create-firewall-rules.adoc[leveloffset=+1]
31+
32+
include::modules/cloud-experts-osd-limit-egress-ngfw-create-osd-gcp-cluster.adoc[leveloffset=+1]
33+
34+
include::modules/cloud-experts-osd-limit-egress-ngfw-delete-osd-gcp-cluster.adoc[leveloffset=+1]
35+
36+
include::modules/cloud-experts-osd-limit-egress-ngfw-clean-resources.adoc[leveloffset=+1]
37+

‎modules/cloud-experts-osd-limit-egress-ngfw-clean-resources.adoc‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * cloud_experts_osd_tutorials/cloud-experts-osd-limit-egress-ngfw.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cloud-experts-osd-limit-egress-ngfw-clean-resource_{context}"]
7+
= Cleaning up resources
8+
9+
To prevent ongoing charges, after you delete your cluster you must manually delete the {GCP} networking infrastructure you created as part of this tutorial. Deleting the cluster will not automatically remove these underlying resources. You can clean up these resources using a combination of gcloud CLI commands and actions within the {GCP} console.
10+
11+
Before you begin the process of cleaning up the the resources you created for this tutorial, run the following commands and complete any prompts.
12+
13+
. To authenticate your identity run the following command:
14+
+
15+
[source,terminal]
16+
----
17+
$ gcloud init
18+
----
19+
+
20+
. To log in to your {GCP} account, run the following command:
21+
+
22+
[source,terminal]
23+
----
24+
$ gcloud auth application-default login
25+
----
26+
+
27+
. To log in to the OpenShift Cluster manager CLI tool, run the following command:
28+
+
29+
[source,terminal]
30+
----
31+
$ ocm login --use-auth-code
32+
----
33+
34+
You are now ready to clean up the resources you created as part of this tutorial. To respect resource dependencies, delete them in the reverse order of their creation.
35+
36+
. Delete the firewall policy's association with the VPC by running the following command:
37+
+
38+
[source,terminal]
39+
----
40+
$ gcloud compute network-firewall-policies associations delete \
41+
--firewall-policy=${prefix} \
42+
--network=${prefix}-vpc \
43+
--global-firewall-policy
44+
----
45+
+
46+
. Delete the global network firewall policy by running the following command:
47+
+
48+
[source,terminal]
49+
----
50+
$ gcloud compute network-firewall-policies delete ${prefix} --global
51+
----
52+
+
53+
. A managed DNS zone in {GCP} cannot be deleted until all user-defined record sets are removed. Define variables to target the specific {GCP} project and the managed DNS zone being cleaned up by running the following command:
54+
+
55+
[source,terminal]
56+
----
57+
$ cat /tmp/delete_records.sh
58+
PROJECT_ID=<your-project-id>
59+
ZONE_NAME=<your-managed-zone-name>
60+
----
61+
+
62+
. List the record sets that are included within the Private DNS zone by running the following command:
63+
+
64+
[source,terminal]
65+
----
66+
$ gcloud \
67+
dns record-sets list \
68+
--project=$PROJECT_ID \
69+
--zone=$ZONE_NAME \
70+
--filter="type!=NS AND type!=SOA" \
71+
--format="value(name,type)" | while read name type;
72+
----
73+
+
74+
. Delete the record sets that are included within that Private DNS Zone by running the following command:
75+
+
76+
[source,terminal]
77+
----
78+
$ gcloud --project=$PROJECT_ID dns record-sets delete "$name" --zone=$ZONE_NAME --type="$type"
79+
----
80+
+
81+
. Delete the Private DNS Zone by running the following command:
82+
+
83+
[source,terminal]
84+
----
85+
$ gcloud dns managed-zones delete ${prefix}-googleapis
86+
----
87+
+
88+
. Delete the Cloud NAT gateway:
89+
+
90+
[source,terminal]
91+
----
92+
$ gcloud compute routers nats delete ${prefix}-cloudnat-${region} \
93+
--router=${prefix}-router \
94+
--router-region=${region}
95+
----
96+
+
97+
. Delete the Cloud Router by running the following command:
98+
+
99+
[source,terminal]
100+
----
101+
$ gcloud compute routers delete ${prefix}-router --region=${region}
102+
----
103+
+
104+
. Delete the reserved IP address by running the following command:
105+
+
106+
[source,terminal]
107+
+
108+
----
109+
$ gcloud compute addresses delete ${prefix}-${region}-cloudnatip --region=${region}
110+
----
111+
+
112+
. Delete the worker subnet by running the following command:
113+
+
114+
[source,terminal]
115+
+
116+
----
117+
$ gcloud compute networks subnets delete ${prefix}-worker --region=${region}
118+
----
119+
+
120+
. Delete the control plane subnet by running the following command:
121+
+
122+
[source,terminal]
123+
+
124+
----
125+
$ gcloud compute networks subnets delete ${prefix}-control-plane --region=${region}
126+
----
127+
+
128+
. Delete the PSC subnet by running the following command:
129+
+
130+
[source,terminal]
131+
----
132+
$ gcloud compute networks subnets delete ${prefix}-psc --region=${region}
133+
----
134+
+
135+
. Delete the VPC by running the following command:
136+
+
137+
[source,terminal]
138+
----
139+
$ gcloud compute networks delete ${prefix}-vpc
140+
----

‎modules/cloud-experts-osd-limit-egress-ngfw-create-a-cloud-router.adoc‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * cloud_experts_osd_tutorials/cloud-experts-osd-limit-egress-ngfw.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cloud-experts-osd-limit-egress-ngfw-create-a-cloud-router_{context}"]
7+
= Creating a Cloud Router and a Cloud Network Address Translation gateway
8+
The Network Address Translation (NAT) gateway enables internet connectivity for your private VMs by masquerading all their traffic under a single public IP address. As the designated exit point, it translates their internal IPs for any outbound requests, such as fetching updates. This process effectively grants them access to the internet without ever exposing their private addresses.
9+
10+
. Reserve an IP address for Cloud NAT by running the following command:
11+
+
12+
13+
[source,terminal]
14+
----
15+
$ gcloud compute addresses create ${prefix}-${region}-cloudnatip \
16+
--region=${region}
17+
----
18+
+
19+
. Create a Cloud Router by running the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ gcloud compute routers create ${prefix}-router \
24+
--region=${region} \
25+
--network=${prefix}-vpc
26+
----
27+
+
28+
. Create a Cloud NAT by running the following command:
29+
+
30+
[source,terminal]
31+
----
32+
$ gcloud compute routers nats create ${prefix}-cloudnat-${region} \
33+
--router=${prefix}-router --router-region ${region} \
34+
--nat-all-subnet-ip-ranges \
35+
--nat-external-ip-pool=${prefix}-${region}-cloudnatip
36+
----

‎modules/cloud-experts-osd-limit-egress-ngfw-create-firewall-rules.adoc‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * cloud_experts_osd_tutorials/cloud-experts-osd-limit-egress-ngfw.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cloud-experts-osd-limit-egress-ngfw-create-firewall-rules_{context}"]
7+
= Creating the firewall rules
8+
9+
. Create a blanket allow rule for private IP (RFC 1918) address space by running the following command:
10+
+
11+
[source,terminal]
12+
----
13+
$ gcloud compute network-firewall-policies rules create 500 \
14+
--description "Allow egress to private IP ranges" \
15+
--action=allow \
16+
--firewall-policy=${prefix} \
17+
--global-firewall-policy \
18+
--direction=EGRESS \
19+
--layer4-configs all \
20+
--dest-ip-ranges=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
21+
22+
----
23+
+
24+
. Create an allow rule for HTTPS (tcp/443) domains required for {product-title} by running the following command:
25+
+
26+
[source,terminal]
27+
----
28+
$ gcloud compute network-firewall-policies rules create 600 \
29+
--description "Allow egress to OpenShift Dedicated required domains (tcp/443)" \
30+
--action=allow \
31+
--firewall-policy=${prefix} \
32+
--global-firewall-policy \
33+
--direction=EGRESS \
34+
--layer4-configs tcp:443 \
35+
--dest-fqdns accounts.google.com,pull.q1w2.quay.rhcloud.com,http-inputs-osdsecuritylogs.splunkcloud.com,nosnch.in,api.deadmanssnitch.com,events.pagerduty.com,api.pagerduty.com,api.openshift.com,mirror.openshift.com,observatorium.api.openshift.com,observatorium-mst.api.openshift.com,console.redhat.com,infogw.api.openshift.com,api.access.redhat.com,cert-api.access.redhat.com,catalog.redhat.com,sso.redhat.com,registry.connect.redhat.com,registry.access.redhat.com,cdn01.quay.io,cdn02.quay.io,cdn03.quay.io,cdn04.quay.io,cdn05.quay.io,cdn06.quay.io,cdn.quay.io,quay.io,registry.redhat.io,quayio-production-s3.s3.amazonaws.com
36+
37+
----
38+
+
39+
[IMPORTANT]
40+
====
41+
If there is not a matching rule that allows the traffic, it will be blocked by the firewall. To allow access to other resources, such as internal networks or other external endpoints, create additional rules with a priority of less than 1000. For more information on how to create firewall rules, see link:https://cloud.google.com/firewall/docs/use-network-firewall-policies[Use global network firewall policies and rules].
42+
====

‎modules/cloud-experts-osd-limit-egress-ngfw-create-osd-gcp-cluster.adoc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * cloud_experts_osd_tutorials/cloud-experts-osd-limit-egress-ngfw.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cloud-experts-osd-limit-egress-ngfw-create-osd-gcp-cluster_{context}"]
7+
= Creating your cluster
8+
You are now ready to create your {product-title} on {GCP} cluster. For more information, see link:https://docs.redhat.com/en/documentation/openshift_dedicated/4/html/openshift_dedicated_clusters_on_google_cloud/osd-creating-a-cluster-on-gcp-with-workload-identity-federation[Creating a cluster on {GCP} with Workload Identity Federation authentication].

‎modules/cloud-experts-osd-limit-egress-ngfw-create-private-dns.adoc‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * cloud_experts_osd_tutorials/cloud-experts-osd-limit-egress-ngfw.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cloud-experts-osd-limit-egress-ngfw-create-private-DNS_{context}"]
7+
= Creating private Domain Name System records for Private Google Access
8+
The private Domain Name System (DNS) zone optimizes how your resources connect to Google APIs by ensuring traffic never travels over the public internet. It functions by intercepting DNS requests for Google services and resolving them to private IP addresses, forcing the connection onto Google's internal network for a faster, more secure data exchange.
9+
10+
. Create a private DNS zone for the googleapis.com domain by running the following command:
11+
+
12+
[source,terminal]
13+
----
14+
$ gcloud dns managed-zones create ${prefix}-googleapis \
15+
--visibility=private \
16+
--networks=https://www.googleapis.com/compute/v1/projects/${project_id}/global/networks/${prefix}-vpc \
17+
--description="Private Google Access" \
18+
--dns-name=googleapis.com
19+
----
20+
+
21+
. Begin a record set transaction by running the following command:
22+
+
23+
[source,terminal]
24+
----
25+
$ gcloud dns record-sets transaction start \
26+
--zone=${prefix}-googleapis
27+
----
28+
+
29+
. Stage the DNS records for Google APIs under the googleapis.com domain by running the following commands:
30+
+
31+
[source,terminal]
32+
----
33+
$ gcloud dns record-sets transaction add --name="*.googleapis.com." \
34+
--type=CNAME restricted.googleapis.com. \
35+
--zone=${prefix}-googleapis \
36+
--ttl=300
37+
----
38+
+
39+
[source,terminal]
40+
----
41+
$ gcloud dns record-sets transaction add 199.36.153.4 199.36.153.5 199.36.153.6 199.36.153.7 \
42+
--name=restricted.googleapis.com. \
43+
--type=A \
44+
--zone=${prefix}-googleapis \
45+
--ttl=300
46+
47+
----
48+
+
49+
. Apply the staged record set transaction you started above by running the following command:
50+
+
51+
[source,terminal]
52+
----
53+
$ gcloud dns record-sets transaction execute \
54+
--zone=$prefix-googleapis
55+
----

‎modules/cloud-experts-osd-limit-egress-ngfw-create-subnets.adoc‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * cloud_experts_osd_tutorials/cloud-experts-osd-limit-egress-ngfw.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cloud-experts-osd-limit-egress-ngfw-create-subnets_{context}"]
7+
= Creating the VPC and subnets
8+
9+
Before you can deploy a {GCP} NGFW, you must first create the Virtual Private Cloud (VPC) and subnets that you will use for {product-title}:
10+
11+
. Create the VPC by running the following command:
12+
+
13+
[source,terminal]
14+
----
15+
$ gcloud compute networks create ${prefix}-vpc --subnet-mode=custom
16+
----
17+
+
18+
. Create the worker subnets by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ gcloud compute networks subnets create ${prefix}-worker \
23+
--range=10.0.2.0/23 \
24+
--network=${prefix}-vpc \
25+
--region=${region} \
26+
--enable-private-ip-google-access
27+
----
28+
+
29+
. Create the control plane subnets by running the following command:
30+
+
31+
[source,terminal]
32+
----
33+
$ gcloud compute networks subnets create ${prefix}-control-plane \
34+
--range=10.0.0.0/25 \
35+
--network=${prefix}-vpc \
36+
--region=${region} \
37+
--enable-private-ip-google-access
38+
----
39+
+
40+
. Create the PSC subnets by running the following command:
41+
+
42+
[source,terminal]
43+
----
44+
$ gcloud compute networks subnets create ${prefix}-psc \
45+
--network=${prefix}-vpc \
46+
--region=${region} \
47+
--stack-type=IPV4_ONLY \
48+
--range=10.0.0.128/29 \
49+
--purpose=PRIVATE_SERVICE_CONNECT
50+
51+
----
52+
+
53+
These examples use the subnet ranges of 10.0.2.0/23 for the worker subnet, 10.0.0.0/25 for the control plane subnet, and 10.0.0.128/29 for the PSC subnet. Modify the parameters to meet your needs. Ensure the parameter values are contained within the machine CIDR you set earlier in this tutorial.

0 commit comments

Comments
 (0)