Conversation
This reverts commit 314e21a. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
The subscription is not locked down, we can access VM with public IP Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
|
Wouldn't using a private IP be preferable security-wise? |
With this flag, it means that we use a private IP to access the VM but the VM will still have a public IP. See: https://github.com/flatcar/mantle/blob/1147d638804f6c25e10c60bbbea8e25525849182/platform/api/azure/instance.go#L251-L319 We needed to use private IP on the previous subscription because firewall was blocking requests on external IPs. |
chewi
left a comment
There was a problem hiding this comment.
Okay, but would it be better to have an option to not allocate a public IP in the first place? Feel free to say "maybe, but later."
Sure, that seems to be a good idea but let's not forget that those created instances have a short time to live and don't have any associated credentials (e.g managed identities) - so to me the security risk is low but happy to get your input here (and even more happy to update the codebase!) |
|
Cherry-picked
|
In this PR:
This has been partially tested here: https://jenkins.flatcar.org/job/container/job/test/48/console
NOTE:
test/azure: use public IPneeds to be backported on maintainance channel but let's try onmaina full run first