Skip to content

Limit aproxy nftables redirection to egress traffic only #807

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
weiiwang01 merged 2 commits into from
Aug 13, 2026
Merged

Limit aproxy nftables redirection to egress traffic only #807

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
14519eb
Limit aproxy nftables redirection to egress traffic only
weiiwang01 Jul 14, 2026
3394408
Merge branch 'main' into feat/aproxy-nftables
weiiwang01 Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions docs/changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@

This changelog documents user-relevant changes to the GitHub runner charm.

## 2026-07-14

Check warning on line 5 in docs/changelog.md

View workflow job for this annotation

GitHub Actions / docs-checks / vale 

[vale] reported by reviewdog 🐶
[Canonical.012-date-format] Use the 'January 1, 1970' format instead of '2026-07-14'

Raw Output:
{"message": "[Canonical.012-date-format] Use the 'January 1, 1970' format instead of '2026-07-14'", "location": {"path": "docs/changelog.md", "range": {"start": {"line": 5, "column": 4}}}, "severity": "WARNING"}

- aproxy now only redirects traffic leaving the runner's default-route interface(s), so local traffic is no longer captured and private ranges no longer need to be added to `aproxy-exclude-addresses`.

## 2026-06-26

- Fixed runners whose cloud VM entered an error state being kept until the creation timeout (~23 minutes) before cleanup. Such VMs are now cleaned up immediately, freeing the slot for a replacement runner.
Expand Down
2 changes: 1 addition & 1 deletion github-runner-manager/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

[project]
name = "github-runner-manager"
version = "0.18.2"
version = "0.18.3"
authors = [
{ name = "Canonical IS DevOps", email = "is-devops-team@canonical.com" },
]
Expand Down
3 changes: 3 additions & 0 deletions github-runner-manager/src/github_runner_manager/templates/openstack-userdata.sh.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ snap install aproxy --edge
snap set aproxy proxy={{ aproxy_address }} listen=:54969
cat << EOF > /etc/nftables.conf
define default-ipv4 = $(ip route get $(ip route show 0.0.0.0/0 | grep -oP 'via \K\S+') | grep -oP 'src \K\S+')
Comment thread
weiiwang01 marked this conversation as resolved.
define nics = { $(ip route show 0.0.0.0/0 | grep -oP 'dev \K\S+' | sort -u | sed 's/.*/"&"/' | paste -sd,) }
table ip aproxy
flush table ip aproxy
table ip aproxy {
Expand All @@ -25,10 +26,12 @@ table ip aproxy {
}
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
fib daddr oifname != \$nics return
ip daddr != @exclude tcp dport { {{ aproxy_redirect_ports }} } counter dnat to \$default-ipv4:54969
}
chain output {
type nat hook output priority -100; policy accept;
oifname != \$nics return
Comment thread
weiiwang01 marked this conversation as resolved.
ip daddr != @exclude tcp dport { {{ aproxy_redirect_ports }} } counter dnat to \$default-ipv4:54969
}
}
Expand Down
4 changes: 4 additions & 0 deletions github-runner-manager/tests/unit/openstack_cloud/test_openstack_runner_manager.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,10 +100,12 @@ def runner_metrics_mock_fixture(monkeypatch: pytest.MonkeyPatch) -> MagicMock:
}
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
fib daddr oifname != \\$nics return
ip daddr != @exclude tcp dport { 80, 443 } counter dnat to \\$default-ipv4:54969
}
chain output {
type nat hook output priority -100; policy accept;
oifname != \\$nics return
Comment thread
weiiwang01 marked this conversation as resolved.
ip daddr != @exclude tcp dport { 80, 443 } counter dnat to \\$default-ipv4:54969
}
}
Expand All @@ -123,10 +125,12 @@ def runner_metrics_mock_fixture(monkeypatch: pytest.MonkeyPatch) -> MagicMock:
}
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
fib daddr oifname != \\$nics return
ip daddr != @exclude tcp dport { 80, 443 } counter dnat to \\$default-ipv4:54969
}
chain output {
type nat hook output priority -100; policy accept;
oifname != \\$nics return
Comment thread
weiiwang01 marked this conversation as resolved.
ip daddr != @exclude tcp dport { 80, 443 } counter dnat to \\$default-ipv4:54969
}
}
Expand Down
Loading