Skip to content

Deprecate use of gitlab-iptables in GCP environments

Corrective actions from https://gitlab.com/gitlab-com/gl-infra/infrastructure/issues/8528.

  1. Deprecate iptables in favor of GCP firewall rules.
  • Must do.
  • Matt: We may still need a recipe to disable host-level firewall helpers like “ufw” or “firewalld”. Also, how should we handle VMs on other cloud providers than GCP (e.g. AWS, Azure)? The existing “gitlab-iptables::default” recipe looks like it enables iptables on AWS; not sure if that’s still relevant.
  1. Audit where there are (or will be) unmanaged iptables rules on hosts that have or currently do use the gitlab-iptables chef cookbook.

For this issue - find the remaining hosts in GCP using iptables. Create sub issues as needed to split this out. Adding part of action 18 to this too as the removal should incorporate how we mach sure unmanaged rules are also accounted for on these hosts.