CWNP: Default Deny Not Working

[eberlep]

When creating a new database, a corresponding ClusterWideNetworkPolicy is created as well.

However, access is still possible. I assume this is becaus the source list is not present at all rather then empty:

kubectl --kubeconfig ~/pgaas-admin -n firewall get clusterwidenetworkpolicy projectida-a022f1a15f07407f8cdb -o yaml | k neat
apiVersion: metal-stack.io/v1
kind: ClusterwideNetworkPolicy
metadata:
  name: projectida-a022f1a15f07407f8cdb
  namespace: firewall
spec:
  ingress:
  - ports:
    - port: 5432
      protocol: TCP

netcat can connect on the service port:

$ netcat -v 212.34.X.Y 32000
Connection to 212.34.X.Y 32000 port [tcp/*] succeeded!
^C

psql as well:

$ psql --host 212.34.X.Y --port 32000 --username=postgres                                                                                130
Password for user postgres: 
psql (12.5 (Ubuntu 12.5-0ubuntu0.20.10.1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.

postgres=# 

However, an unused port times out:

$ netcat -v 212.34.X.Y 32001                                                                                                             130
^C

We probably need to add an empty IPBlock to that CWNP.

[eberlep]

With this fix (and without kubectl neat), it now looks like this:

apiVersion: metal-stack.io/v1
kind: ClusterwideNetworkPolicy
metadata: 
  name: projectida-1745ffbb74a84103bc47
  namespace: firewall
spec:
  ingress:
  - from:
    - cidr: ""
    ports:
    - port: 5432
      protocol: TCP

And behaves like that:

$ psql --host 212.34.X.Y --port 32000 --username=postgres
psql: error: could not connect to server: Die Wartezeit für die Verbindung ist abgelaufen
        Is the server running on host "212.34.X.Y" and accepting
        TCP/IP connections on port 32000?

Note the additional, empty cidr in the CWNP.

[LimKianAn]

apiVersion: database.fits.cloud/v1
kind: Postgres
metadata:
  name: sample-name-b
  namespace: database
spec:
  accessList:
    sourceRanges: []

It would be better if the user can see the empty sourceRagnes in his Postgres even when he specified nothing.

[majst01]

If he specifies nothing, the cloudctl defaults to "0.0.0.0/0"

[eberlep]

Is that sufficient for you @LimKianAn ? We have one default value in the cloudctl tool which creates the resource, and one default value in the postgreslet which proceses the resource. In theory, the first default shoud accomplish that desired "visibility" for the user, and the second default works as a failsafe if the first default does not work for some reason.

[majst01]

I will also add a default in the cloud-api as well if someone uses the rest api of the the cloud-api without the defaulting of cloudctl.

[LimKianAn]

Since at the moment cloud-api is the only upstream of postgreslet and the default value are dealt with nicely there. The concern of not showing an empty slice [] for sourceRange when the user doesn't specify anthing becomes trivial and there's no quick fix at the moment. Thus, I close this issue.