Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit df25dd4

Browse files
agneumNikolayS
authored andcommitted
feat: new configuration option cloneAccessAddresses to control port publishing for clone containers; restrict to 127.0.0.1 by default (#528)
1 parent 167979f commit df25dd4

9 files changed

+85
-21
lines changed

‎engine/configs/config.example.logical_generic.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,12 @@ provision:
143143
# existing users to log in with old passwords.
144144
keepUserPasswords: false
145145

146+
# IP addresses that can be used to access clones.
147+
# By default, using a loop-back to accept only local connections.
148+
# The empty string means "all available addresses".
149+
# The option supports multiple IPs (using comma-separated format) and IPv6 addresses (for example, [::1])
150+
cloneAccessAddresses: "127.0.0.1"
151+
146152
# Data retrieval flow. This section defines both initial retrieval, and rules
147153
# to keep the data directory in a synchronized state with the source. Both are optional:
148154
# you may already have the data directory, so neither initial retrieval nor

‎engine/configs/config.example.logical_rds_iam.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,12 @@ provision:
142142
# existing users to log in with old passwords.
143143
keepUserPasswords: false
144144

145+
# IP addresses that can be used to access clones.
146+
# By default, using a loop-back to accept only local connections.
147+
# The empty string means "all available addresses".
148+
# The option supports multiple IPs (using comma-separated format) and IPv6 addresses (for example, [::1])
149+
cloneAccessAddresses: "127.0.0.1"
150+
145151
# Data retrieval flow. This section defines both initial retrieval, and rules
146152
# to keep the data directory in a synchronized state with the source. Both are optional:
147153
# you may already have the data directory, so neither initial retrieval nor

‎engine/configs/config.example.physical_generic.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,12 @@ provision:
140140
# existing users to log in with old passwords.
141141
keepUserPasswords: false
142142

143+
# IP addresses that can be used to access clones.
144+
# By default, using a loop-back to accept only local connections.
145+
# The empty string means "all available addresses".
146+
# The option supports multiple IPs (using comma-separated format) and IPv6 addresses (for example, [::1])
147+
cloneAccessAddresses: "127.0.0.1"
148+
143149
# Data retrieval flow. This section defines both initial retrieval, and rules
144150
# to keep the data directory in a synchronized state with the source. Both are optional:
145151
# you may already have the data directory, so neither initial retrieval nor

‎engine/configs/config.example.physical_pgbackrest.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,12 @@ provision:
140140
# existing users to log in with old passwords.
141141
keepUserPasswords: false
142142

143+
# IP addresses that can be used to access clones.
144+
# By default, using a loop-back to accept only local connections.
145+
# The empty string means "all available addresses".
146+
# The option supports multiple IPs (using comma-separated format) and IPv6 addresses (for example, [::1])
147+
cloneAccessAddresses: "127.0.0.1"
148+
143149
# Data retrieval flow. This section defines both initial retrieval, and rules
144150
# to keep the data directory in a synchronized state with the source. Both are optional:
145151
# you may already have the data directory, so neither initial retrieval nor

‎engine/configs/config.example.physical_walg.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,12 @@ provision:
140140
# existing users to log in with old passwords.
141141
keepUserPasswords: false
142142

143+
# IP addresses that can be used to access clones.
144+
# By default, using a loop-back to accept only local connections.
145+
# The empty string means "all available addresses".
146+
# The option supports multiple IPs (using comma-separated format) and IPv6 addresses (for example, [::1])
147+
cloneAccessAddresses: "127.0.0.1"
148+
143149
# Data retrieval flow. This section defines both initial retrieval, and rules
144150
# to keep the data directory in a synchronized state with the source. Both are optional:
145151
# you may already have the data directory, so neither initial retrieval nor

‎engine/internal/provision/docker/docker.go‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ func RunContainer(r runners.Runner, c *resources.AppConfig) error {
7878
"docker run",
7979
"--name", c.CloneName,
8080
"--detach",
81-
"--publish", fmt.Sprintf("%[1]s:%[1]s", instancePort),
81+
publishPorts(c.ProvisionHosts, instancePort),
8282
"--env", "PGDATA=" + c.DataDir(),
8383
"--env", "PG_UNIX_SOCKET_DIR=" + unixSocketCloneDir,
8484
"--env", "PG_SERVER_PORT=" + instancePort,
@@ -101,6 +101,20 @@ func RunContainer(r runners.Runner, c *resources.AppConfig) error {
101101
return nil
102102
}
103103

104+
func publishPorts(provisionHosts string, instancePort string) string {
105+
if provisionHosts == "" {
106+
return fmt.Sprintf("--publish %[1]s:%[1]s", instancePort)
107+
}
108+
109+
pub := []string{}
110+
111+
for _, s := range strings.Split(provisionHosts, ",") {
112+
pub = append(pub, "--publish", fmt.Sprintf("%[1]s:%[2]s:%[2]s", s, instancePort))
113+
}
114+
115+
return strings.Join(pub, " ")
116+
}
117+
104118
func createDefaultVolumes(c *resources.AppConfig) (string, []string) {
105119
unixSocketCloneDir := c.Pool.SocketCloneDir(c.CloneName)
106120

‎engine/internal/provision/docker/docker_test.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,3 +94,20 @@ func TestDefaultVolumes(t *testing.T) {
9494
"--volume /tmp/test/default:/tmp/test/default",
9595
"--volume /tmp/test/default/socket:/tmp/test/default/socket"}, volumes)
9696
}
97+
98+
func TestPublishPorts(t *testing.T) {
99+
testCases := []struct {
100+
provisionHosts string
101+
instancePort string
102+
expectedResult string
103+
}{
104+
{provisionHosts: "", instancePort: "6000", expectedResult: "--publish 6000:6000"},
105+
{provisionHosts: "127.0.0.1", instancePort: "6000", expectedResult: "--publish 127.0.0.1:6000:6000"},
106+
{provisionHosts: "127.0.0.1,172.0.0.1", instancePort: "6000", expectedResult: "--publish 127.0.0.1:6000:6000 --publish 172.0.0.1:6000:6000"},
107+
{provisionHosts: "[::1]", instancePort: "6000", expectedResult: "--publish [::1]:6000:6000"},
108+
}
109+
110+
for _, tc := range testCases {
111+
assert.Equal(t, publishPorts(tc.provisionHosts, tc.instancePort), tc.expectedResult)
112+
}
113+
}

‎engine/internal/provision/mode_local.go‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,12 @@ type PortPool struct {
5151

5252
// Config defines configuration for provisioning.
5353
type Config struct {
54-
PortPool PortPool `yaml:"portPool"`
55-
DockerImage string `yaml:"dockerImage"`
56-
UseSudo bool `yaml:"useSudo"`
57-
KeepUserPasswords bool `yaml:"keepUserPasswords"`
58-
ContainerConfig map[string]string `yaml:"containerConfig"`
54+
PortPool PortPool `yaml:"portPool"`
55+
DockerImage string `yaml:"dockerImage"`
56+
UseSudo bool `yaml:"useSudo"`
57+
KeepUserPasswords bool `yaml:"keepUserPasswords"`
58+
ContainerConfig map[string]string `yaml:"containerConfig"`
59+
CloneAccessAddresses string `yaml:"cloneAccessAddresses"`
5960
}
6061

6162
// Provisioner describes a struct for ports and clones management.
@@ -598,14 +599,15 @@ func (p *Provisioner) stopPoolSessions(fsm pool.FSManager, exceptClones map[stri
598599

599600
func (p *Provisioner) getAppConfig(pool *resources.Pool, name string, port uint) *resources.AppConfig {
600601
appConfig := &resources.AppConfig{
601-
CloneName: name,
602-
DockerImage: p.config.DockerImage,
603-
Host: pool.SocketCloneDir(name),
604-
Port: port,
605-
DB: p.dbCfg,
606-
Pool: pool,
607-
ContainerConf: p.config.ContainerConfig,
608-
NetworkID: p.networkID,
602+
CloneName: name,
603+
DockerImage: p.config.DockerImage,
604+
Host: pool.SocketCloneDir(name),
605+
Port: port,
606+
DB: p.dbCfg,
607+
Pool: pool,
608+
ContainerConf: p.config.ContainerConfig,
609+
NetworkID: p.networkID,
610+
ProvisionHosts: p.config.CloneAccessAddresses,
609611
}
610612

611613
return appConfig

‎engine/internal/provision/resources/appconfig.go‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,14 @@ import (
1010

1111
// AppConfig currently stores Postgres configuration (other application in the future too).
1212
type AppConfig struct {
13-
CloneName string
14-
DockerImage string
15-
Pool *Pool
16-
Host string
17-
Port uint
18-
DB *DB
19-
NetworkID string
13+
CloneName string
14+
DockerImage string
15+
Pool *Pool
16+
Host string
17+
Port uint
18+
DB *DB
19+
NetworkID string
20+
ProvisionHosts string
2021

2122
ContainerConf map[string]string
2223
pgExtraConf map[string]string

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /