2023-01-19: Delete default VPC in gitlab-pre and gitlab-staging-1

Production Change

Change Summary

In https://gitlab.com/gitlab-com/gl-security/security-operations/infrastructure-security/bau/-/issues/238 we identified that the default VPC and the firewalls rules attached to them are insecure, for example they allow public ssh. We should delete these, in gitlab-pre and gitlab-staging-1

Change Details

  1. Services Impacted - ServiceGCP
  2. Change Technician - @steveazz
  3. Change Reviewer - @T4cC0re
  4. Time tracking - 30m
  5. Downtime Component - none

Detailed steps for the change

Change Steps - steps to take to execute the change

Estimated Time to Complete (mins) - 15

  • Set label changein-progress /label ~change::in-progress
  • gitlab-pre
    • Take screenshot of the VPC, just in case
    • Validate that no VM is running in default: gcloud --project='gitlab-pre' compute instances list --filter="networkInterfaces.network:default"
    • Validate that no internal static IPs exist: gcloud --project='gitlab-pre' compute addresses list --filter="subnetwork:default"
    • Validate that no VPC peering exists: gcloud --project='gitlab-pre' compute networks peerings list --network=default
    • Delete firewall rules: gcloud --project='gitlab-pre' compute firewall-rules list --filter="network:default" --format="value(name)" | parallel gcloud --project='gitlab-pre' compute firewall-rules delete {}
    • Delete default VPC: gcloud --project='gitlab-pre' compute networks delete default
    • Validate that the VPC was deleted: gcloud --project='gitlab-pre' compute networks list
    • Validate that the firewall rules no longer exist: gcloud --project='gitlab-pre' compute firewall-rules list --filter="network:default"
  • gitlab-staging-1
    • Take screenshot of the VPC, just in case
    • Validate that no VM is running in default: gcloud --project='gitlab-staging-1' compute instances list --filter="networkInterfaces.network:default"
    • Validate that no internal static IPs exist: gcloud --project='gitlab-staging-1' compute addresses list --filter="subnetwork:default"
    • Validate that no VPC peering exists: gcloud --project='gitlab-staging-1' compute networks peerings list --network=default
    • Delete firewall rules: gcloud --project='gitlab-staging-1' compute firewall-rules list --filter="network:default" --format="value(name)" | parallel gcloud --project='gitlab-staging-1' compute firewall-rules delete {}
    • Delete addresses: gcloud --project='gitlab-staging-1' compute addresses list --filter='subnetwork:default' --format='value(name)' | parallel gcloud --project='gitlab-staging-1' compute addresses delete --quiet --region='us-east1' {}
    • Delete default VPC: gcloud --project='gitlab-staging-1' compute networks delete default
    • Validate that the VPC was deleted: gcloud --project='gitlab-staging-1' compute networks list
    • Validate that the firewall rules no longer exist: gcloud --project='gitlab-staging-1' compute firewall-rules list --filter='network:default'
  • Set label changecomplete /label ~change::complete

Rollback

Rollback steps - steps to be taken in the event of a need to rollback this change

Estimated Time to Complete (mins) - 15

  • gitlab-pre

    gcloud compute networks create default --project=gitlab-pre
gcloud compute firewall-rules create default-allow-internal --allow tcp,udp,icmp --network default --source-ranges 10.128.0.0/9 --priority=65534 --project=gitlab-pre
gcloud compute firewall-rules create default-allow-rdp --allow tcp:3389 --network default --source-ranges 0.0.0.0/0 --priority=65534 --project=gitlab-pre
gcloud compute firewall-rules create default-allow-ssh --allow tcp:22 --network default --source-ranges 0.0.0.0/0 --priority=65534 --project=gitlab-pre
gcloud compute firewall-rules create default-allow-icmp --allow icmp --network default --source-ranges 0.0.0.0/0 --priority=65534 --project=gitlab-pre

  • gitlab-staging-1

    gcloud compute networks create default --project=gitlab-staging-1
gcloud compute firewall-rules create default-allow-internal --allow tcp,udp,icmp --network default --source-ranges 10.128.0.0/9 --priority=65534 --project=gitlab-staging-1
gcloud compute firewall-rules create default-allow-rdp --allow tcp:3389 --network default --source-ranges 0.0.0.0/0 --priority=65534 --project=gitlab-staging-1
gcloud compute firewall-rules create default-allow-ssh --allow tcp:22 --network default --source-ranges 0.0.0.0/0 --priority=65534 --project=gitlab-staging-1
gcloud compute firewall-rules create default-allow-http --allow tcp:80 --network default --source-ranges 0.0.0.0/0 --project=gitlab-staging-1
gcloud compute firewall-rules create default-allow-https --allow tcp:443 --network default --source-ranges 0.0.0.0/0 --project=gitlab-staging-1
gcloud compute firewall-rules create default-allow-icmp --allow icmp --network default --source-ranges 0.0.0.0/0 --priority=65534 --project=gitlab-staging-1

  • Set label changeaborted /label ~change::aborted

Monitoring

Key metrics to observe

Change Reviewer checklist

C4 C3 C2 C1:

  • Check if the following applies:
    • The scheduled day and time of execution of the change is appropriate.
    • The change plan is technically accurate.
    • The change plan includes estimated timing values based on previous testing.
    • The change plan includes a viable rollback plan.
    • The specified metrics/monitoring dashboards provide sufficient visibility for the change.

C2 C1:

  • Check if the following applies:
    • The complexity of the plan is appropriate for the corresponding risk of the change. (i.e. the plan contains clear details).
    • The change plan includes success measures for all steps/milestones during the execution.
    • The change adequately minimizes risk within the environment/service.
    • The performance implications of executing the change are well-understood and documented.
    • The specified metrics/monitoring dashboards provide sufficient visibility for the change.
      • If not, is it possible (or necessary) to make changes to observability platforms for added visibility?
    • The change has a primary and secondary SRE with knowledge of the details available during the change window.
    • The labels blocks deployments and/or blocks feature-flags are applied as necessary

Change Technician checklist

  • Check if all items below are complete:
    • The change plan is technically accurate.
    • This Change Issue is linked to the appropriate Issue and/or Epic
    • Change has been tested in staging and results noted in a comment on this issue.
    • A dry-run has been conducted and results noted in a comment on this issue.
    • The change execution window respects the Production Change Lock periods.
    • For C1 and C2 change issues, the change event is added to the GitLab Production calendar.
    • For C1 and C2 change issues, the SRE on-call has been informed prior to change being rolled out. (In #production channel, mention @sre-oncall and this issue and await their acknowledgement.)
    • For C1 and C2 change issues, the SRE on-call provided approval with the eoc_approved label on the issue.
    • For C1 and C2 change issues, the Infrastructure Manager provided approval with the manager_approved label on the issue.
    • Release managers have been informed (If needed! Cases include DB change) prior to change being rolled out. (In #production channel, mention @release-managers and this issue and await their acknowledgment.)
    • There are currently no active incidents that are severity1 or severity2
    • If the change involves doing maintenance on a database host, an appropriate silence targeting the host(s) should be added for the duration of the change.
Edited by Steve Xuereb