Just got this to work, so no need to manually open any NodePort ranges for e2e tests!

so no need to manually open any NodePort ranges for e2e tests

Does that mean we don't need the extra firewall rule?

Sorry, what I mean is that previously I had set up this rule manually (i.e. by running the commands directly), and I was concerned that this would be problematic for automated testing. I don't know that we're ready to have these ports be opened up for everyone that runs cluster/kube-up. However, it seems pretty safe to do it only for e2e testing.

Expect a follow up PR to open it for all users, but we'll want to think that one through pretty carefully. I don't think the security threshold needs to be as high for our e2e setup!

LGTM

LGTM. @justinsb I am merging this one to run jenkin for tonight. Will let you know the result tomorrow.

Expect a follow up PR to open it for all users, but we'll want to think that one through pretty carefully.

Agreed that we'll need to consider this carefully. FYI, this is going to break GKE's e2e testing since these extra ports will not be opened on the GKE cluster where the e2e tests run.

I'm not at all sure that we want to open these ports in general. We
usually err on the side of caution regarding opening up firewalls.

On Fri, May 22, 2015 at 9:15 PM, Robert Bailey [email protected]
wrote:

Expect a follow up PR to open it for all users, but we'll want to think
that one through pretty carefully.

Agreed that we'll need to consider this carefully. FYI, this is going to
break GKE's e2e testing since these extra ports will not be opened on the
GKE cluster where the e2e tests run.

—
Reply to this email directly or view it on GitHub
#8728 (comment)
.

Justin: Something we may want to change for more compat (short term): We
currently retain publicIPs but don't use it. Maybe we should reinstate the
kube-proxy support for public IPs, until we kill off that field along with
v1b3. Not sure how I missed that before.

On Fri, May 22, 2015 at 9:16 PM, Tim Hockin [email protected] wrote:

I'm not at all sure that we want to open these ports in general. We
usually err on the side of caution regarding opening up firewalls.

On Fri, May 22, 2015 at 9:15 PM, Robert Bailey [email protected]
wrote:

Expect a follow up PR to open it for all users, but we'll want to think
that one through pretty carefully.

Agreed that we'll need to consider this carefully. FYI, this is going to
break GKE's e2e testing since these extra ports will not be opened on the
GKE cluster where the e2e tests run.

—
Reply to this email directly or view it on GitHub
#8728 (comment)
.

@thockin OK, I can do that. I know some people would want the ability to totally prevent public IP specification, but if it is going away I will reinstate it until we are ready to remove support for it. Sorry for removing it!

As for the need for firewalls - can we do e2e to node ports without
traversing outside the GCE project? That should dodge the need for
firewalls.

On Fri, May 22, 2015 at 9:28 PM, Justin Santa Barbara <
[email protected]> wrote:

@thockin https://github.com/thockin OK, I can do that. I know some
people would want the ability to totally prevent public IP specification,
but if it is going away I will reinstate it until we are ready to remove
support for it. Sorry for removing it!

—
Reply to this email directly or view it on GitHub
#8728 (comment)
.