[terraform] Hide prod Tunnelbroker gRPC endpoint from the Internet
ClosedPublic
Actions

Authored by bartek on Sep 5 2024, 1:26 AM.

Details

Reviewers

will
kamil

Commits

rCOMMf13d8767d2bb: [terraform] Hide prod Tunnelbroker gRPC endpoint from the Internet

Summary

Addresses a part of ENG-9129.

This stops exposing publicly the Tunnelbroker gRPC endpoint.

Test Plan

terraform plan for staging contains no changes, for prod removes the resource.

Diff Detail

Repository

rCOMM Comm

Branch

barthap/dev

Lint

No Lint Coverage

Unit

No Test Coverage

Event Timeline

bartek created this revision.Sep 5 2024, 1:26 AM

bartek held this revision as a draft.

Herald added subscribers: tomek, ashoat. · View Herald TranscriptSep 5 2024, 1:26 AM

Harbormaster completed remote builds in B31433: Diff 43891.Sep 5 2024, 1:43 AM

bartek published this revision for review.Sep 5 2024, 2:01 AM

kamil accepted this revision.Sep 5 2024, 5:32 AM

Looks good to me. There shouldn't be any issues with load balancer health checks correct?

This revision is now accepted and ready to land.Sep 5 2024, 7:02 AM

Closed by commit rCOMMf13d8767d2bb: [terraform] Hide prod Tunnelbroker gRPC endpoint from the Internet (authored by bartek). · Explain WhySep 9 2024, 6:11 AM

This revision was automatically updated to reflect the committed changes.

bartek added a commit: rCOMMf13d8767d2bb: [terraform] Hide prod Tunnelbroker gRPC endpoint from the Internet.

Revision Contents
Changeset List

Path

Size

services/

terraform/

remote/

service_tunnelbroker.tf

1 line

Diff 43891

View Options

services/terraform/remote/service_tunnelbroker.tf

Show First 20 Lines • Show All 156 Lines • ▼ Show 20 Lines	() => ({
sessionID,		sessionID,
},		},
},		},
}),		}),
[preRequestUserInfo, keyserverID, cookie, sessionID],		[preRequestUserInfo, keyserverID, cookie, sessionID],
);		);

// We only need to do a "spot check" on this value below.		// We only need to do a "spot check" on this value below.
// - To avoid regenerating performRecovery whenever it changes, we want to		// - To avoid regenerating below callbacks whenever it changes, we want to
// make sure it's not in that function's dep list.		// make sure it's not in those callbacks' dep lists.
// - If we exclude it from that function's dep list, we'll end up binding in		// - If we exclude it from those callbacks' dep lists, we'll end up binding in
// the value of preRequestUserState at the time performRecovery is updated.		// the value of preRequestUserState at the time the callbacks are updated.
// Instead, by assigning to a ref, we are able to use the latest value.		// Instead, by assigning to a ref, we are able to use the latest value.
const preRequestUserStateRef = React.useRef(preRequestUserState);		const preRequestUserStateRef = React.useRef(preRequestUserState);
preRequestUserStateRef.current = preRequestUserState;		preRequestUserStateRef.current = preRequestUserState;

const dispatch = useDispatch();		const dispatch = useDispatch();
const urlPrefix = useSelector(urlPrefixSelector(keyserverID));		const urlPrefix = useSelector(urlPrefixSelector(keyserverID));

const logOut = useLogOut();		const logOut = useLogOut();
const dispatchActionPromise = useDispatchActionPromise();		const dispatchActionPromise = useDispatchActionPromise();

const invalidateKeyserverSession = React.useCallback(		const invalidateKeyserverSession = React.useCallback(
(		(
source: RecoveryActionSource,		source: RecoveryActionSource,
sessionChange: ClientSessionChange,		sessionChange: ClientSessionChange,
userStateBeforeRecovery: PreRequestUserState,
hasBeenCancelled: () => boolean,		hasBeenCancelled: () => boolean,
) => {		) => {
if (hasBeenCancelled()) {		if (hasBeenCancelled()) {
return;		return;
}		}
setNewSession(		setNewSession(
dispatch,		dispatch,
sessionChange,		sessionChange,
userStateBeforeRecovery,		preRequestUserStateRef.current,
null,		null,
source,		source,
keyserverID,		keyserverID,
);		);
if (		if (
keyserverID === authoritativeKeyserverID() &&		keyserverID === authoritativeKeyserverID() &&
relyingOnAuthoritativeKeyserver		relyingOnAuthoritativeKeyserver
) {		) {
Show All 30 Lines	) => {
);		);
const sessionChange =		const sessionChange =
recoverySessionChange ?? genericCookieInvalidation;		recoverySessionChange ?? genericCookieInvalidation;
if (		if (
sessionChange.cookieInvalidated \|\|		sessionChange.cookieInvalidated \|\|
!sessionChange.cookie \|\|		!sessionChange.cookie \|\|
!sessionChange.cookie.startsWith('user=')		!sessionChange.cookie.startsWith('user=')
) {		) {
invalidateKeyserverSession(		invalidateKeyserverSession(source, sessionChange, hasBeenCancelled);
source,
sessionChange,
userStateBeforeRecovery,
hasBeenCancelled,
);
}		}
} catch (e) {		} catch (e) {
if (hasBeenCancelled()) {		if (hasBeenCancelled()) {
return;		return;
}		}
console.log(		console.log(
`Error during recovery login with keyserver ${keyserverID}`,		`Error during recovery login with keyserver ${keyserverID}`,
e,		e,
);		);
invalidateKeyserverSession(		invalidateKeyserverSession(
source,		source,
genericCookieInvalidation,		genericCookieInvalidation,
userStateBeforeRecovery,
hasBeenCancelled,		hasBeenCancelled,
);		);
throw e;		throw e;
}		}
},		},
[keyserverID, dispatch, cookie, urlPrefix, invalidateKeyserverSession],		[keyserverID, dispatch, cookie, urlPrefix, invalidateKeyserverSession],
);		);
}		}

export {		export {
canResolveKeyserverSessionInvalidation,		canResolveKeyserverSessionInvalidation,
resolveKeyserverSessionInvalidation,		resolveKeyserverSessionInvalidation,
useKeyserverRecoveryLogIn,		useKeyserverRecoveryLogIn,
};		};

[terraform] Hide prod Tunnelbroker gRPC endpoint from the InternetClosedPublicActions