New issue
Advanced search Search tips

Issue 766399 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: 3
NextAction: ----
OS: Chrome
Pri: 0
Type: Feature

Blocked on:
issue 706138

Blocking:
issue 766386


Show other hotlists

Hotlists containing this issue:
CrOSParallelCQ


Sign in to add a comment

Remove ChromeOS IP Whitelisting for CloudSql

Project Member Reported by dgarr...@chromium.org, Sep 19 2017

Issue description

ChromeOS builders currently access these instances of CIDB:

  cidb, cidb-replica, debug-cidb.

And uses IP address whitelisting to allow access. We would like to instead access via a proxy so we can remove the whitelists, and remove the static IPs from our builders.

This CL creates the mechanism we hope to use.

https://chromium-review.googlesource.com/c/chromiumos/chromite/+/609591/6/lib/cidb.py
 
Owner: xixuan@chromium.org
This work is pending being able to do a swarming build on a specified pool.

Comment 2 by xixuan@chromium.org, Sep 19 2017

Status: I will wait for @don to give me a testable builder, then start.

Comment 3 by nxia@chromium.org, Sep 28 2017

Blocking: 706138

Comment 4 by xixuan@chromium.org, Mar 19 2018

Status: Assigned (was: Untriaged)

Comment 5 by nxia@chromium.org, Jun 8 2018

Cc: -nxia@chromium.org
Cc: -akes...@chromium.org -xixuan@chromium.org
Components: -Infra>Client>ChromeOS Infra>Client>ChromeOS>CI
Owner: ----
Status: Untriaged (was: Assigned)
Pass to CI team.
Blocking: -706138
Blockedon: 706138
Labels: -Type-Bug -Pri-3 CrOSParallelCQ OS-Chrome Pri-0 Type-Feature
Owner: mikenichols@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 10 by sheriffbot@chromium.org, Nov 13

Pri-0 bugs are critical regressions or serious emergencies, and this bug has not been updated in three days. Could you please provide an update, or adjust the priority to a more appropriate level if applicable?

If a fix is in active development, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: Disable-Nags
EstimatedDays: 3
At a first glance, to remove the whitelisting will require us to utilize service accounts for connecting.  Based on our current implementation, service accounts will require the deployment and configuration of the cloud proxy to all builders.  

Separate bugs will be opened to track those initiatives.  

-- Mike
Cc: dhanyaganesh@chromium.org
My understanding is that we have to deploy the proxy, and manage it's runtime process ourselves (not as a system service). That is feasible, but a little more tricky, probably similar to what we do with tsmon today.
Why could this not be deployed/started as a service?  Normally all dependent services that are not part of the actual build process, would be started and managed as a service.  

Is there something specific here that would prevent that?  

-- Mike
Maybe it can, I'm not sure.

Sign in to add a comment