Skip to main content
Version: Latest

6. Configure Cloud Foundry Security Groups

info

a9s CF Service Guard is an optional component. It is not required for installing the a9s Data Services Framework.

Cloud Foundry (CF) App Security Groups (ASGs) are necessary to allow CF applications to access any a9s Data Service Instance. Two methods are available for creating these groups:

6.1. Install the a9s CF Service Guard​

The a9s CF Service Guard is intended to ensure that a proper CF ASG exists for each and every Service Instance, so that a CF app can reach out to the provisioned Service Instance from its CF space. This component monitors the topology of each Service Instance for changes, and reactively updates ASGs to reflect the current state and status of the underlying deployment in BOSH.

6.1.1. Register the a9s Data Services​

In order to enable support for any a9s Data Service, the corresponding Ops file must be applied to the a9s CF Service Guard deployment manifest, otherwise the a9s CF Service Guard will not create CF ASGs for the corresponding a9s Data Service.

The supported Ops files are:

  • a9s KeyValue: cf-service-guard/ops/add-keyvalue.yml
  • a9s LogMe2: cf-service-guard/ops/add-logme2.yml
  • a9s MariaDB: cf-service-guard/ops/add-mariadb.yml
  • a9s MongoDB: cf-service-guard/ops/add-mongodb.yml
  • a9s PostgreSQL: cf-service-guard/ops/add-postgresql.yml
  • a9s Messaging: cf-service-guard/ops/add-rabbitmq.yml
  • a9s Search: cf-service-guard/ops/add-search.yml

Multiple a9s Data Services can be supported by adding the corresponding Ops file, one after the other, on the same command.

6.1.2. Manage CF ASGs for Shared Service Instances​

The shared_spaces_updater is disabled by default and can be enabled by applying the Ops file cf-service-guard/ops/support-shared-instances.yml to the a9s CF Service Guard deployment manifest.

6.1.3. Deploy the a9s CF Service Guard​

The deployment is created by executing:

bosh -d cf-service-guard deploy cf-service-guard/cf-service-guard.yml \
  -o cf-service-guard/ops/add-<data-service>.yml \
  -l config/iaas-config.yml

6.2. Add the Service Instances Network to the Allow List​

If the a9s CF Service Guard is not used, then a global CF ASG must be manually created to allow CF apps to access the network where the Service Instances are deployed. Otherwise they will not be able to connect to any Service Instance.

caution

This method is suitable for development and testing purposes but is not recommended for production environments. The a9s CF Service Guard provides per-instance, space-scoped security groups, which follow the principle of least privilege.

6.2.1. Identify the Service Instance Network Range​

The network range for Service Instances is defined in the BOSH Cloud Config under the dynamic network configuration (or the custom network name if the default was changed). This information can be retrieved by inspecting the Cloud Config:

bosh cloud-config

The network definition used for Service Instances should be identified. The subnet CIDR (e.g., 10.244.0.0/24) is the range that must be added to the CF ASG.

Alternatively, if Service Instances are already deployed, their IP addresses can be inspected using:

bosh -d <service-instance-deployment> vms

The network range can be inferred from the deployed instance IPs.

6.2.2. Create the Cloud Foundry ASG​

A JSON file defining the ASG rules must be created (e.g., service-instances-asg.json):

[
  {
    "protocol": "tcp",
    "destination": "10.244.0.0/24",
    "ports": "1-65535",
    "description": "Allow access to a9s Data Service instances"
  }
]

10.244.0.0/24 must be replaced with the actual network range identified in the previous step.

The ASG must be created and bound to all spaces:

cf create-security-group a9s-service-instances service-instances-asg.json
cf bind-running-security-group a9s-service-instances

For more information on manually creating CF ASGs, see App security groups in Cloud Foundry - Creating ASGs in the official Cloud Foundry documentation.