Skip to content

Wpb 23988 fix internet access wiab stag #881

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mohitrajain wants to merge 7 commits into
base: wpb-23988-enable-5.25
Choose a base branch
from
Open

Wpb 23988 fix internet access wiab stag #881

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b5efd28
add: wpb-23988 variable private_deployment with default true to disab…
mohitrajain Mar 17, 2026
b6d3fbd
fix: wpb-23988 cert_master_email env var
mohitrajain Mar 17, 2026
7145ff3
fix: wpb-23988 running wiab-staging-nftables.yaml playbook is explicit
mohitrajain Mar 17, 2026
eb909fc
fix: wpb-23988 wiab-staging.md documentation to add details about def…
mohitrajain Mar 17, 2026
737cb5b
fix: wpb-23988 add changelog
mohitrajain Mar 17, 2026
1bea057
fix: wpb-23988 update the wiab-staging.md to improve documentation ar…
mohitrajain Mar 18, 2026
b682734
fix: wpb-23988 update the artifact hash
mohitrajain Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ansible/files/wiab_server_nftables.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,9 @@ table ip nat {
chain POSTROUTING {
type nat hook postrouting priority 100;
oifname != docker0 ip saddr 172.17.0.0/16 counter masquerade
{% if not (private_deployment | default(false) | bool) %}
oifname $INF_WAN counter masquerade comment "{{ wire_comment }} masquerade outgoing traffic"
{% endif %}
}
chain DOCKER {
iifname docker0 counter return
Expand Down
4 changes: 3 additions & 1 deletion ansible/inventory/demo/wiab-staging.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,6 @@ wiab-staging:
ansible_user: 'demo'
ansible_ssh_private_key_file: "~/.ssh/id_ed25519"
vars:
artifact_hash: 2200257f7a528f3a8157e8878fc7ee1c945594d1
artifact_hash: 7da2319729ba792f91d7ccba4e026c21cd3a3691
# it will disable internet access to VMs created on the private network
private_deployment: true
3 changes: 1 addition & 2 deletions ansible/wiab-staging-provision.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,9 +298,8 @@
kubenode2_ip: "{{ kubenode_ip_result.results[1].stdout }}"
kubenode3_ip: "{{ kubenode_ip_result.results[2].stdout }}"
wire_comment: "wiab-stag"

tags: always

- name: Configure nftables
import_playbook: ./wiab-staging-nftables.yaml
tags: nftables
tags: [never, nftables]
2 changes: 1 addition & 1 deletion bin/helm-operations.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ set -Eeo pipefail
# Read values from environment variables with defaults
BASE_DIR="${BASE_DIR:-/wire-server-deploy}"
TARGET_SYSTEM="${TARGET_SYSTEM:-example.com}"
CERT_MASTER_EMAIL="certmaster@${CERT_MASTER_EMAIL}:-certmaster@${TARGET_SYSTEM}"
CERT_MASTER_EMAIL="${CERT_MASTER_EMAIL:-certmaster@example.com}"

# DEPLOY_CERT_MANAGER env variable is used to decide if cert_manager and nginx-ingress-services charts should get deployed
# default is set to TRUE to deploy it unless changed
Expand Down
5 changes: 5 additions & 0 deletions changelog.d/3-deploy-builds/wiab-stag-nftables-snat-fix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
Added: variable private_deployment with default true to disable SNAT on adminhost
Fixed: cert_master_email env var parsing in helm-operations.sh
Fixed: made running wiab-staging-nftables.yaml playbook explicit
Added: wiab-staging.md documentation to add details about default SNAT access being denied and how to enable it
Added: wiab-staging.md network flow diagram
Loading
Loading