{"action":"created","comment":{"url":"https://api.github.com/repos/yangl900/acs-engine/pulls/comments/120226908","pull_request_review_id":42172019,"id":120226908,"diff_hunk":"@@ -201,8 +201,17 @@ Get-PodGateway(`$podCIDR)\n function\r\n Set-DockerNetwork(`$podCIDR)\r\n {\r\n-    # Turn off Firewall to enable pods to talk to service endpoints. (Kubelet should eventually do this)\r\n-    netsh advfirewall set allprofiles state off\r\n+    # Windows Firewall rules to allow only Master to access Node's kubelet ports\r\n+    # Firewall rules to allow access to container's websockets\r\n+    netsh advfirewall firewall add rule name=\"Container: Allow access to node localport 8080\" dir=in action=allow protocol=TCP localport=8080\r\n+    netsh advfirewall firewall add rule name=\"Container: Allow access to node localport 8888\" dir=in action=allow protocol=TCP localport=8888\r\n+    netsh advfirewall firewall add rule name=\"Container: Allow UDP inbound traffic for Container DNS Port 53\" dir=in action=allow localport=53 protocol=UDP\r\n+    netsh advfirewall firewall add rule name=\"Node: Allow only K8 Master to access localport 4194\" dir=in action=allow protocol=TCP localport=4194 remoteip=`${global:MasterIP}\r","path":"parts/kuberneteswindowssetup.ps1","position":11,"original_position":11,"commit_id":"ed6c430147d9d834aac39fb73ffacf4ff6cbea47","original_commit_id":"ed6c430147d9d834aac39fb73ffacf4ff6cbea47","user":{"login":"robbiezhang","id":9003737,"avatar_url":"https://avatars2.githubusercontent.com/u/9003737?v=3","gravatar_id":"","url":"https://api.github.com/users/robbiezhang","html_url":"https://github.com/robbiezhang","followers_url":"https://api.github.com/users/robbiezhang/followers","following_url":"https://api.github.com/users/robbiezhang/following{/other_user}","gists_url":"https://api.github.com/users/robbiezhang/gists{/gist_id}","starred_url":"https://api.github.com/users/robbiezhang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robbiezhang/subscriptions","organizations_url":"https://api.github.com/users/robbiezhang/orgs","repos_url":"https://api.github.com/users/robbiezhang/repos","events_url":"https://api.github.com/users/robbiezhang/events{/privacy}","received_events_url":"https://api.github.com/users/robbiezhang/received_events","type":"User","site_admin":false},"body":"Multi-master is an ACS-Engine feature. It will introduce a LoadBalancer for the master nodes. The IP address for the LB is 10.240.255.15. However, there is no such LB in the single master node cluster. So the outbound IP address is the node address (10.240.255.5). Do you know how this script handle this?","created_at":"2017-06-05T22:34:35Z","updated_at":"2017-06-05T22:34:35Z","html_url":"https://github.com/yangl900/acs-engine/pull/2#discussion_r120226908","pull_request_url":"https://api.github.com/repos/yangl900/acs-engine/pulls/2","_links":{"self":{"href":"https://api.github.com/repos/yangl900/acs-engine/pulls/comments/120226908"},"html":{"href":"https://github.com/yangl900/acs-engine/pull/2#discussion_r120226908"},"pull_request":{"href":"https://api.github.com/repos/yangl900/acs-engine/pulls/2"}}},"pull_request":{"url":"https://api.github.com/repos/yangl900/acs-engine/pulls/2","id":124037761,"html_url":"https://github.com/yangl900/acs-engine/pull/2","diff_url":"https://github.com/yangl900/acs-engine/pull/2.diff","patch_url":"https://github.com/yangl900/acs-engine/pull/2.patch","issue_url":"https://api.github.com/repos/yangl900/acs-engine/issues/2","number":2,"state":"open","locked":false,"title":"Enable Firewall on Node, Add Windows Firewall rules for required ports","user":{"login":"raghushantha","id":11727200,"avatar_url":"https://avatars3.githubusercontent.com/u/11727200?v=3","gravatar_id":"","url":"https://api.github.com/users/raghushantha","html_url":"https://github.com/raghushantha","followers_url":"https://api.github.com/users/raghushantha/followers","following_url":"https://api.github.com/users/raghushantha/following{/other_user}","gists_url":"https://api.github.com/users/raghushantha/gists{/gist_id}","starred_url":"https://api.github.com/users/raghushantha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raghushantha/subscriptions","organizations_url":"https://api.github.com/users/raghushantha/orgs","repos_url":"https://api.github.com/users/raghushantha/repos","events_url":"https://api.github.com/users/raghushantha/events{/privacy}","received_events_url":"https://api.github.com/users/raghushantha/received_events","type":"User","site_admin":false},"body":"**What this PR does / why we need it**:\r\nSecures K8's Windows Nodes by enabling Firewall.\r\nAllows only Master node to connect to kubelet ports\r\nCreates Firewall exceptions for container websockets for communicating to PowerShell Console workloads\r\n\r\nThe fixes have been verified in DF cluster.\r\n\r\n**Release note**:\r\n\r\n```release-note\r\n- Enable Firewall (with exceptions) for Windows Nodes to lockdown access to the nodes\r\n```\r\n\r\n<!-- Reviewable:start -->\r\n---\r\nThis change is [<img src=\"https://reviewable.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.io/reviews/azure/acs-engine/725)\r\n<!-- Reviewable:end -->\r\n","created_at":"2017-06-05T19:00:47Z","updated_at":"2017-06-05T22:34:35Z","closed_at":null,"merged_at":null,"merge_commit_sha":"41e383f40f5282c30dbf509c8fb18d5ad263be18","assignee":{"login":"raghushantha","id":11727200,"avatar_url":"https://avatars3.githubusercontent.com/u/11727200?v=3","gravatar_id":"","url":"https://api.github.com/users/raghushantha","html_url":"https://github.com/raghushantha","followers_url":"https://api.github.com/users/raghushantha/followers","following_url":"https://api.github.com/users/raghushantha/following{/other_user}","gists_url":"https://api.github.com/users/raghushantha/gists{/gist_id}","starred_url":"https://api.github.com/users/raghushantha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raghushantha/subscriptions","organizations_url":"https://api.github.com/users/raghushantha/orgs","repos_url":"https://api.github.com/users/raghushantha/repos","events_url":"https://api.github.com/users/raghushantha/events{/privacy}","received_events_url":"https://api.github.com/users/raghushantha/received_events","type":"User","site_admin":false},"assignees":[{"login":"raghushantha","id":11727200,"avatar_url":"https://avatars3.githubusercontent.com/u/11727200?v=3","gravatar_id":"","url":"https://api.github.com/users/raghushantha","html_url":"https://github.com/raghushantha","followers_url":"https://api.github.com/users/raghushantha/followers","following_url":"https://api.github.com/users/raghushantha/following{/other_user}","gists_url":"https://api.github.com/users/raghushantha/gists{/gist_id}","starred_url":"https://api.github.com/users/raghushantha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raghushantha/subscriptions","organizations_url":"https://api.github.com/users/raghushantha/orgs","repos_url":"https://api.github.com/users/raghushantha/repos","events_url":"https://api.github.com/users/raghushantha/events{/privacy}","received_events_url":"https://api.github.com/users/raghushantha/received_events","type":"User","site_admin":false}],"requested_reviewers":[{"login":"yangl900","id":8466897,"avatar_url":"https://avatars1.githubusercontent.com/u/8466897?v=3","gravatar_id":"","url":"https://api.github.com/users/yangl900","html_url":"https://github.com/yangl900","followers_url":"https://api.github.com/users/yangl900/followers","following_url":"https://api.github.com/users/yangl900/following{/other_user}","gists_url":"https://api.github.com/users/yangl900/gists{/gist_id}","starred_url":"https://api.github.com/users/yangl900/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yangl900/subscriptions","organizations_url":"https://api.github.com/users/yangl900/orgs","repos_url":"https://api.github.com/users/yangl900/repos","events_url":"https://api.github.com/users/yangl900/events{/privacy}","received_events_url":"https://api.github.com/users/yangl900/received_events","type":"User","site_admin":false},{"login":"mirichmo","id":12738734,"avatar_url":"https://avatars0.githubusercontent.com/u/12738734?v=3","gravatar_id":"","url":"https://api.github.com/users/mirichmo","html_url":"https://github.com/mirichmo","followers_url":"https://api.github.com/users/mirichmo/followers","following_url":"https://api.github.com/users/mirichmo/following{/other_user}","gists_url":"https://api.github.com/users/mirichmo/gists{/gist_id}","starred_url":"https://api.github.com/users/mirichmo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mirichmo/subscriptions","organizations_url":"https://api.github.com/users/mirichmo/orgs","repos_url":"https://api.github.com/users/mirichmo/repos","events_url":"https://api.github.com/users/mirichmo/events{/privacy}","received_events_url":"https://api.github.com/users/mirichmo/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/yangl900/acs-engine/pulls/2/commits","review_comments_url":"https://api.github.com/repos/yangl900/acs-engine/pulls/2/comments","review_comment_url":"https://api.github.com/repos/yangl900/acs-engine/pulls/comments{/number}","comments_url":"https://api.github.com/repos/yangl900/acs-engine/issues/2/comments","statuses_url":"https://api.github.com/repos/yangl900/acs-engine/statuses/ed6c430147d9d834aac39fb73ffacf4ff6cbea47","head":{"label":"yangl900:windows-firewall","ref":"windows-firewall","sha":"ed6c430147d9d834aac39fb73ffacf4ff6cbea47","user":{"login":"yangl900","id":8466897,"avatar_url":"https://avatars1.githubusercontent.com/u/8466897?v=3","gravatar_id":"","url":"https://api.github.com/users/yangl900","html_url":"https://github.com/yangl900","followers_url":"https://api.github.com/users/yangl900/followers","following_url":"https://api.github.com/users/yangl900/following{/other_user}","gists_url":"https://api.github.com/users/yangl900/gists{/gist_id}","starred_url":"https://api.github.com/users/yangl900/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yangl900/subscriptions","organizations_url":"https://api.github.com/users/yangl900/orgs","repos_url":"https://api.github.com/users/yangl900/repos","events_url":"https://api.github.com/users/yangl900/events{/privacy}","received_events_url":"https://api.github.com/users/yangl900/received_events","type":"User","site_admin":false},"repo":{"id":76006538,"name":"acs-engine","full_name":"yangl900/acs-engine","owner":{"login":"yangl900","id":8466897,"avatar_url":"https://avatars1.githubusercontent.com/u/8466897?v=3","gravatar_id":"","url":"https://api.github.com/users/yangl900","html_url":"https://github.com/yangl900","followers_url":"https://api.github.com/users/yangl900/followers","following_url":"https://api.github.com/users/yangl900/following{/other_user}","gists_url":"https://api.github.com/users/yangl900/gists{/gist_id}","starred_url":"https://api.github.com/users/yangl900/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yangl900/subscriptions","organizations_url":"https://api.github.com/users/yangl900/orgs","repos_url":"https://api.github.com/users/yangl900/repos","events_url":"https://api.github.com/users/yangl900/events{/privacy}","received_events_url":"https://api.github.com/users/yangl900/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/yangl900/acs-engine","description":"Azure Container Service Engine - a place for community to collaborate and build the best open Docker container infrastructure for Azure.","fork":true,"url":"https://api.github.com/repos/yangl900/acs-engine","forks_url":"https://api.github.com/repos/yangl900/acs-engine/forks","keys_url":"https://api.github.com/repos/yangl900/acs-engine/keys{/key_id}","collaborators_url":"https://api.github.com/repos/yangl900/acs-engine/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/yangl900/acs-engine/teams","hooks_url":"https://api.github.com/repos/yangl900/acs-engine/hooks","issue_events_url":"https://api.github.com/repos/yangl900/acs-engine/issues/events{/number}","events_url":"https://api.github.com/repos/yangl900/acs-engine/events","assignees_url":"https://api.github.com/repos/yangl900/acs-engine/assignees{/user}","branches_url":"https://api.github.com/repos/yangl900/acs-engine/branches{/branch}","tags_url":"https://api.github.com/repos/yangl900/acs-engine/tags","blobs_url":"https://api.github.com/repos/yangl900/acs-engine/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/yangl900/acs-engine/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/yangl900/acs-engine/git/refs{/sha}","trees_url":"https://api.github.com/repos/yangl900/acs-engine/git/trees{/sha}","statuses_url":"https://api.github.com/repos/yangl900/acs-engine/statuses/{sha}","languages_url":"https://api.github.com/repos/yangl900/acs-engine/languages","stargazers_url":"https://api.github.com/repos/yangl900/acs-engine/stargazers","contributors_url":"https://api.github.com/repos/yangl900/acs-engine/contributors","subscribers_url":"https://api.github.com/repos/yangl900/acs-engine/subscribers","subscription_url":"https://api.github.com/repos/yangl900/acs-engine/subscription","commits_url":"https://api.github.com/repos/yangl900/acs-engine/commits{/sha}","git_commits_url":"https://api.github.com/repos/yangl900/acs-engine/git/commits{/sha}","comments_url":"https://api.github.com/repos/yangl900/acs-engine/comments{/number}","issue_comment_url":"https://api.github.com/repos/yangl900/acs-engine/issues/comments{/number}","contents_url":"https://api.github.com/repos/yangl900/acs-engine/contents/{+path}","compare_url":"https://api.github.com/repos/yangl900/acs-engine/compare/{base}...{head}","merges_url":"https://api.github.com/repos/yangl900/acs-engine/merges","archive_url":"https://api.github.com/repos/yangl900/acs-engine/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/yangl900/acs-engine/downloads","issues_url":"https://api.github.com/repos/yangl900/acs-engine/issues{/number}","pulls_url":"https://api.github.com/repos/yangl900/acs-engine/pulls{/number}","milestones_url":"https://api.github.com/repos/yangl900/acs-engine/milestones{/number}","notifications_url":"https://api.github.com/repos/yangl900/acs-engine/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/yangl900/acs-engine/labels{/name}","releases_url":"https://api.github.com/repos/yangl900/acs-engine/releases{/id}","deployments_url":"https://api.github.com/repos/yangl900/acs-engine/deployments","created_at":"2016-12-09T06:01:30Z","updated_at":"2017-03-02T22:40:59Z","pushed_at":"2017-06-05T19:00:47Z","git_url":"git://github.com/yangl900/acs-engine.git","ssh_url":"git@github.com:yangl900/acs-engine.git","clone_url":"https://github.com/yangl900/acs-engine.git","svn_url":"https://github.com/yangl900/acs-engine","homepage":"","size":17824,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"base":{"label":"yangl900:migration","ref":"migration","sha":"e648d3d5077e44e785bcc949e926f3dc5900bba9","user":{"login":"yangl900","id":8466897,"avatar_url":"https://avatars1.githubusercontent.com/u/8466897?v=3","gravatar_id":"","url":"https://api.github.com/users/yangl900","html_url":"https://github.com/yangl900","followers_url":"https://api.github.com/users/yangl900/followers","following_url":"https://api.github.com/users/yangl900/following{/other_user}","gists_url":"https://api.github.com/users/yangl900/gists{/gist_id}","starred_url":"https://api.github.com/users/yangl900/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yangl900/subscriptions","organizations_url":"https://api.github.com/users/yangl900/orgs","repos_url":"https://api.github.com/users/yangl900/repos","events_url":"https://api.github.com/users/yangl900/events{/privacy}","received_events_url":"https://api.github.com/users/yangl900/received_events","type":"User","site_admin":false},"repo":{"id":76006538,"name":"acs-engine","full_name":"yangl900/acs-engine","owner":{"login":"yangl900","id":8466897,"avatar_url":"https://avatars1.githubusercontent.com/u/8466897?v=3","gravatar_id":"","url":"https://api.github.com/users/yangl900","html_url":"https://github.com/yangl900","followers_url":"https://api.github.com/users/yangl900/followers","following_url":"https://api.github.com/users/yangl900/following{/other_user}","gists_url":"https://api.github.com/users/yangl900/gists{/gist_id}","starred_url":"https://api.github.com/users/yangl900/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yangl900/subscriptions","organizations_url":"https://api.github.com/users/yangl900/orgs","repos_url":"https://api.github.com/users/yangl900/repos","events_url":"https://api.github.com/users/yangl900/events{/privacy}","received_events_url":"https://api.github.com/users/yangl900/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/yangl900/acs-engine","description":"Azure Container Service Engine - a place for community to collaborate and build the best open Docker container infrastructure for Azure.","fork":true,"url":"https://api.github.com/repos/yangl900/acs-engine","forks_url":"https://api.github.com/repos/yangl900/acs-engine/forks","keys_url":"https://api.github.com/repos/yangl900/acs-engine/keys{/key_id}","collaborators_url":"https://api.github.com/repos/yangl900/acs-engine/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/yangl900/acs-engine/teams","hooks_url":"https://api.github.com/repos/yangl900/acs-engine/hooks","issue_events_url":"https://api.github.com/repos/yangl900/acs-engine/issues/events{/number}","events_url":"https://api.github.com/repos/yangl900/acs-engine/events","assignees_url":"https://api.github.com/repos/yangl900/acs-engine/assignees{/user}","branches_url":"https://api.github.com/repos/yangl900/acs-engine/branches{/branch}","tags_url":"https://api.github.com/repos/yangl900/acs-engine/tags","blobs_url":"https://api.github.com/repos/yangl900/acs-engine/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/yangl900/acs-engine/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/yangl900/acs-engine/git/refs{/sha}","trees_url":"https://api.github.com/repos/yangl900/acs-engine/git/trees{/sha}","statuses_url":"https://api.github.com/repos/yangl900/acs-engine/statuses/{sha}","languages_url":"https://api.github.com/repos/yangl900/acs-engine/languages","stargazers_url":"https://api.github.com/repos/yangl900/acs-engine/stargazers","contributors_url":"https://api.github.com/repos/yangl900/acs-engine/contributors","subscribers_url":"https://api.github.com/repos/yangl900/acs-engine/subscribers","subscription_url":"https://api.github.com/repos/yangl900/acs-engine/subscription","commits_url":"https://api.github.com/repos/yangl900/acs-engine/commits{/sha}","git_commits_url":"https://api.github.com/repos/yangl900/acs-engine/git/commits{/sha}","comments_url":"https://api.github.com/repos/yangl900/acs-engine/comments{/number}","issue_comment_url":"https://api.github.com/repos/yangl900/acs-engine/issues/comments{/number}","contents_url":"https://api.github.com/repos/yangl900/acs-engine/contents/{+path}","compare_url":"https://api.github.com/repos/yangl900/acs-engine/compare/{base}...{head}","merges_url":"https://api.github.com/repos/yangl900/acs-engine/merges","archive_url":"https://api.github.com/repos/yangl900/acs-engine/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/yangl900/acs-engine/downloads","issues_url":"https://api.github.com/repos/yangl900/acs-engine/issues{/number}","pulls_url":"https://api.github.com/repos/yangl900/acs-engine/pulls{/number}","milestones_url":"https://api.github.com/repos/yangl900/acs-engine/milestones{/number}","notifications_url":"https://api.github.com/repos/yangl900/acs-engine/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/yangl900/acs-engine/labels{/name}","releases_url":"https://api.github.com/repos/yangl900/acs-engine/releases{/id}","deployments_url":"https://api.github.com/repos/yangl900/acs-engine/deployments","created_at":"2016-12-09T06:01:30Z","updated_at":"2017-03-02T22:40:59Z","pushed_at":"2017-06-05T19:00:47Z","git_url":"git://github.com/yangl900/acs-engine.git","ssh_url":"git@github.com:yangl900/acs-engine.git","clone_url":"https://github.com/yangl900/acs-engine.git","svn_url":"https://github.com/yangl900/acs-engine","homepage":"","size":17824,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/yangl900/acs-engine/pulls/2"},"html":{"href":"https://github.com/yangl900/acs-engine/pull/2"},"issue":{"href":"https://api.github.com/repos/yangl900/acs-engine/issues/2"},"comments":{"href":"https://api.github.com/repos/yangl900/acs-engine/issues/2/comments"},"review_comments":{"href":"https://api.github.com/repos/yangl900/acs-engine/pulls/2/comments"},"review_comment":{"href":"https://api.github.com/repos/yangl900/acs-engine/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/yangl900/acs-engine/pulls/2/commits"},"statuses":{"href":"https://api.github.com/repos/yangl900/acs-engine/statuses/ed6c430147d9d834aac39fb73ffacf4ff6cbea47"}}}}
{"actor":{"display_login":"robbiezhang"}}