Uh oh!
There was an error while loading. Please reload this page.
github-bot: add IPs of Jenkins workers - #985
Conversation
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
phillipj
commented
Nov 8, 2017
@maclover7 thanks! Pushed a commit adding a comment with a friendly reminder. |
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
maclover7
commented
Nov 23, 2017
@phillipj This should be ready to go, right? Would you be able to merge this, and check and see if it helps at all with nodejs/node#17151 (comment)? |
phillipj
commented
Nov 23, 2017
@maclover7 I'm not able to immediately, but I'll at least have a look tomorrow. I'm unsure if it would help any issues ATM, if anything probably make it worse? Currently it will happily respond to requests from anywhere, having this whitelist activated could if anything, make it worse? Or have I misunderstood the issue in the PR you referenced? |
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
rvagg
commented
Nov 25, 2017
LGTM, although it should be possible to insert some python in plugins/inventory/nodejs_yaml.py to pull out the IP addresses with the But as I've mentioned in nodejs/node#17151 (comment) I think the effect of this on non-pipeline jobs is that it's going to stop status reporting completely because the @phillipj do you have access to update the bot machine with this change? |
phillipj
commented
Nov 27, 2017
Yepp. I'll merge this and update the env variables on the machine out shortly. |
Instead of keeping the list of whitelisted Jenkins worker IPs up-to-date manually, it would be ideal to automate that with a python script instead. Refs nodejs#985 (comment)
Providing `$JENKINS_WORKER_IPS` environment variable at startup will activate the whitelist implemented in the bot, validating who's allowed to pushed Jenkins job updates as inline PR statuses on github.com. Refs: nodejs/github-bot#142 PR-URL: nodejs#985 Reviewed-By: Jon Moss <me@jonathanmoss.me> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>
The github-bot has a whitelist of IPs that's allowed to push Jenkins job status as inline PR status on github.com. Whenever we change our Jenkins worker IPs, we should remember to update the bot's whitelist as well. PR-URL: nodejs#985 Reviewed-By: Jon Moss <me@jonathanmoss.me> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>
Instead of keeping the list of whitelisted Jenkins worker IPs up-to-date manually, it would be ideal to automate that with a python script instead. Refs: nodejs#985 (comment) PR-URL: nodejs#985
18b9ca3 to
5050016CompareProviding `$JENKINS_WORKER_IPS` environment variable at startup will activate the whitelist implemented in the bot, validating who's allowed to pushed Jenkins job updates as inline PR statuses on github.com. Refs: nodejs/github-bot#142 PR-URL: #985 Reviewed-By: Jon Moss <me@jonathanmoss.me> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>
The github-bot has a whitelist of IPs that's allowed to push Jenkins job status as inline PR status on github.com. Whenever we change our Jenkins worker IPs, we should remember to update the bot's whitelist as well. PR-URL: #985 Reviewed-By: Jon Moss <me@jonathanmoss.me> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org>
phillipj
commented
Nov 27, 2017
@maclover7 this is live in production now. |
After the Jenkins IP whitelist was activated, the inline PR status reports for nodejs/node seems to be broken. Seems like the issue here is that IPv4 remote addresses are converted to IPv6, which wasn't expected too happen.. Stripping any IPv6 parts off the remote addresses should make our IPv4 comparisons work as expected. Refs nodejs/build#1016 Refs nodejs/build#985
After the Jenkins IP whitelist was activated, the inline PR status reports for nodejs/node seems to be broken. Seems like the issue here is that IPv4 remote addresses are converted to IPv6, which wasn't expected too happen.. Stripping any IPv6 parts off the remote addresses should make our IPv4 comparisons work as expected. Refs nodejs/build#1016 Refs nodejs/build#985
Providing
$JENKINS_WORKER_IPSenvironment variable at startup will activate the whitelist implemented in the bot, validating who's allowed to pushed Jenkins job updates as inline PR statuses on github.com.Refs nodejs/github-bot#142
/cc @nodejs/github-bot