oxidecomputer / oxidecomputer/omicron
Consider adding a background task for propagating instance-specific firewall rules
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 572
- Forks
- 97
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 96
Description
While working on #10305, I noticed that we do not have a background task for periodically pushing out firewall rules to the sled-agents specifically for instance rules. We do have (1) a task for pushing service FW rules; (2) a task for pushing v2p (virtual-to-physical) mappings; and (3) VPC routes. We should consider adding one specifically for the FW rules for instances, for all the same reasons we added the others.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the existing background tasks for service firewall rules, v2p mappings, and VPC routes, since the issue identifies these as related precedents. Determine how instance-specific firewall rules are gathered and sent to sled-agents; the work is done when a periodic task propagates those rules for all instances.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- distributed-systems, networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100