github-bot: add IPs of Jenkins workers #985
Conversation
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
|
@maclover7 thanks! Pushed a commit adding a comment with a friendly reminder. |
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
|
@phillipj This should be ready to go, right? Would you be able to merge this, and check and see if it helps at all with nodejs/node#17151 (comment)? |
|
@maclover7 I'm not able to immediately, but I'll at least have a look tomorrow. I'm unsure if it would help any issues ATM, if anything probably make it worse? Currently it will happily respond to requests from anywhere, having this whitelist activated could if anything, make it worse? Or have I misunderstood the issue in the PR you referenced? |
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
|
LGTM, although it should be possible to insert some python in plugins/inventory/nodejs_yaml.py to pull out the IP addresses with the But as I've mentioned in nodejs/node#17151 (comment) I think the effect of this on non-pipeline jobs is that it's going to stop status reporting completely because the @phillipj do you have access to update the bot machine with this change? |
Yepp. I'll merge this and update the env variables on the machine out shortly. |
Instead of keeping the list of whitelisted Jenkins worker IPs up-to-date manually, it would be ideal to automate that with a python script instead. Refs nodejs#985 (comment)
Providing `$JENKINS_WORKER_IPS` environment variable at startup will activate the whitelist implemented in the bot, validating who's allowed to pushed Jenkins job updates as inline PR statuses on github.com. Refs: nodejs/github-bot#142 PR-URL: nodejs#985 Reviewed-By: Jon Moss <me@jonathanmoss.me> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>
The github-bot has a whitelist of IPs that's allowed to push Jenkins job status as inline PR status on github.com. Whenever we change our Jenkins worker IPs, we should remember to update the bot's whitelist as well. PR-URL: nodejs#985 Reviewed-By: Jon Moss <me@jonathanmoss.me> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>
Instead of keeping the list of whitelisted Jenkins worker IPs up-to-date manually, it would be ideal to automate that with a python script instead. Refs: nodejs#985 (comment) PR-URL: nodejs#985
phillipj
force-pushed
the
add-gh-bot-jenkins-ips
branch
from
18b9ca3
to
5050016
Compare
Providing `$JENKINS_WORKER_IPS` environment variable at startup will activate the whitelist implemented in the bot, validating who's allowed to pushed Jenkins job updates as inline PR statuses on github.com. Refs: nodejs/github-bot#142 PR-URL: #985 Reviewed-By: Jon Moss <me@jonathanmoss.me> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>
The github-bot has a whitelist of IPs that's allowed to push Jenkins job status as inline PR status on github.com. Whenever we change our Jenkins worker IPs, we should remember to update the bot's whitelist as well. PR-URL: #985 Reviewed-By: Jon Moss <me@jonathanmoss.me> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>
|
@maclover7 this is live in production now. |
After the Jenkins IP whitelist was activated, the inline PR status reports for nodejs/node seems to be broken. Seems like the issue here is that IPv4 remote addresses are converted to IPv6, which wasn't expected too happen.. Stripping any IPv6 parts off the remote addresses should make our IPv4 comparisons work as expected. Refs nodejs/build#1016 Refs nodejs/build#985
After the Jenkins IP whitelist was activated, the inline PR status reports for nodejs/node seems to be broken. Seems like the issue here is that IPv4 remote addresses are converted to IPv6, which wasn't expected too happen.. Stripping any IPv6 parts off the remote addresses should make our IPv4 comparisons work as expected. Refs nodejs/build#1016 Refs nodejs/build#985
Providing
$JENKINS_WORKER_IPSenvironment variable at startup will activate the whitelist implemented in the bot, validating who's allowed to pushed Jenkins job updates as inline PR statuses on git.luolix.top.Refs nodejs/github-bot#142
/cc @nodejs/github-bot