search

EngineerBetter / concourse-up

Deprecated - used Control Tower instead
https://github.com/EngineerBetter/control-tower
Apache License 2.0
203 stars 29 forks source link

Allow distinct CIDR ranges access to Concourse vs Credhub #45

Open archgrove opened 6 years ago

archgrove commented 6 years ago

We treat our Credhub and Concourse as distinct security zones. The Concourse interface has generally wider access than we'd like our Credhub instance to have.

We've been accommodating this by altering the ATC security group after running concourse-up, restricting access on 8844/8443 to a tighter set of ranges. Of course, when we rerun concourse-up deploy, this gets reset (as the group is managed by the Terraform module).

It would be super if we could specify distinct ranges for Concourse vs Credhub in concourse-up to avoid this.

archgrove commented 6 years ago

FYI, this might be something we can do a PR for, if it's of interest.

crsimmons commented 6 years ago

Personally I think this is a good idea. I'd welcome a PR.