From 14519ebb53f6fdcf5c190d6e007f6fe00f43729d Mon Sep 17 00:00:00 2001 From: Weii Wang Date: Tue, 14 Jul 2026 12:44:46 +0800 Subject: [PATCH] Limit aproxy nftables redirection to egress traffic only --- docs/changelog.md | 4 ++++ github-runner-manager/pyproject.toml | 2 +- .../github_runner_manager/templates/openstack-userdata.sh.j2 | 3 +++ .../unit/openstack_cloud/test_openstack_runner_manager.py | 4 ++++ 4 files changed, 12 insertions(+), 1 deletion(-) diff --git a/docs/changelog.md b/docs/changelog.md index 70faf71a80..6c045cc283 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -2,6 +2,10 @@ This changelog documents user-relevant changes to the GitHub runner charm. +## 2026-07-14 + +- aproxy now only redirects traffic leaving the runner's default-route interface(s), so local traffic is no longer captured and private ranges no longer need to be added to `aproxy-exclude-addresses`. + ## 2026-06-26 - Fixed runners whose cloud VM entered an error state being kept until the creation timeout (~23 minutes) before cleanup. Such VMs are now cleaned up immediately, freeing the slot for a replacement runner. diff --git a/github-runner-manager/pyproject.toml b/github-runner-manager/pyproject.toml index 95a7a78465..a9cdd765ed 100644 --- a/github-runner-manager/pyproject.toml +++ b/github-runner-manager/pyproject.toml @@ -3,7 +3,7 @@ [project] name = "github-runner-manager" -version = "0.18.2" +version = "0.18.3" authors = [ { name = "Canonical IS DevOps", email = "is-devops-team@canonical.com" }, ] diff --git a/github-runner-manager/src/github_runner_manager/templates/openstack-userdata.sh.j2 b/github-runner-manager/src/github_runner_manager/templates/openstack-userdata.sh.j2 index 195805dc51..fb79fbb97d 100644 --- a/github-runner-manager/src/github_runner_manager/templates/openstack-userdata.sh.j2 +++ b/github-runner-manager/src/github_runner_manager/templates/openstack-userdata.sh.j2 @@ -15,6 +15,7 @@ snap install aproxy --edge snap set aproxy proxy={{ aproxy_address }} listen=:54969 cat << EOF > /etc/nftables.conf define default-ipv4 = $(ip route get $(ip route show 0.0.0.0/0 | grep -oP 'via \K\S+') | grep -oP 'src \K\S+') +define nics = { $(ip route show 0.0.0.0/0 | grep -oP 'dev \K\S+' | sort -u | sed 's/.*/"&"/' | paste -sd,) } table ip aproxy flush table ip aproxy table ip aproxy { @@ -25,10 +26,12 @@ table ip aproxy { } chain prerouting { type nat hook prerouting priority dstnat; policy accept; + fib daddr oifname != \$nics return ip daddr != @exclude tcp dport { {{ aproxy_redirect_ports }} } counter dnat to \$default-ipv4:54969 } chain output { type nat hook output priority -100; policy accept; + oifname != \$nics return ip daddr != @exclude tcp dport { {{ aproxy_redirect_ports }} } counter dnat to \$default-ipv4:54969 } } diff --git a/github-runner-manager/tests/unit/openstack_cloud/test_openstack_runner_manager.py b/github-runner-manager/tests/unit/openstack_cloud/test_openstack_runner_manager.py index 556903b328..8f95a154a8 100644 --- a/github-runner-manager/tests/unit/openstack_cloud/test_openstack_runner_manager.py +++ b/github-runner-manager/tests/unit/openstack_cloud/test_openstack_runner_manager.py @@ -100,10 +100,12 @@ def runner_metrics_mock_fixture(monkeypatch: pytest.MonkeyPatch) -> MagicMock: } chain prerouting { type nat hook prerouting priority dstnat; policy accept; + fib daddr oifname != \\$nics return ip daddr != @exclude tcp dport { 80, 443 } counter dnat to \\$default-ipv4:54969 } chain output { type nat hook output priority -100; policy accept; + oifname != \\$nics return ip daddr != @exclude tcp dport { 80, 443 } counter dnat to \\$default-ipv4:54969 } } @@ -123,10 +125,12 @@ def runner_metrics_mock_fixture(monkeypatch: pytest.MonkeyPatch) -> MagicMock: } chain prerouting { type nat hook prerouting priority dstnat; policy accept; + fib daddr oifname != \\$nics return ip daddr != @exclude tcp dport { 80, 443 } counter dnat to \\$default-ipv4:54969 } chain output { type nat hook output priority -100; policy accept; + oifname != \\$nics return ip daddr != @exclude tcp dport { 80, 443 } counter dnat to \\$default-ipv4:54969 } }