VM防火墙规则更新

Question

Is there an API to update the firewall rules using NodeJS, an example would be really appreciated.

Requirement: I have a list of CDN trusted IPs around 1700, to be allowed to access specific VM in GCP on port 80.

As I understand, we can have a maximum of 256 source ips per firewall rule. I can create and update 8 of them, and tag with the same name,

Question: can we do it using NodeJS API?

This API doesn't return firewall rules.

Equivalent of cli commands is as below

gcloud compute firewall-rules describe alltraffic
gcloud compute firewall-rules update alltraffic --source-ranges="14.201.176.140/32","14.201.176.144/32"
gcloud compute firewall-rules create ramtest1 --allow="tcp:80" --description="ramtest1" --source-ranges="205.251.192.0/19","52.95.174.0/24" --target-tags="tcp-111"

https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/

don't see the update command in the nodejs api https://cloud.google.com/nodejs/docs/reference/compute/0.10.x/Firewall#create https://cloud.google.com/nodejs/docs/reference/compute/0.10.x/Compute#createFirewall

exports.run_process = async (req, res) => {
  const Compute = require('@google-cloud/compute');
  const compute = new Compute();
  const network = compute.network('default');
  const firewalls = (await network.getFirewalls())[0];
  for(const firewall of firewalls) {
    // console.log('firewall == '+JSON.stringify(firewall));
    console.log('firewall = '+firewall.metadata.name);
    if(firewall.metadata.name === 'alltraffic') {
      console.log(' xxxxxxxxxxxxxxxxxxxx changing all traffic xxxxxxxxxxxxxx ');
    }
  }
  return res.status(200).send('ok'); 
};

This code above lists the firewall rule, NFI why its called as firewall, when in the console its called as firewall rules, it's so confusing

Answer 1

You should use the setMetadata function to update a firewall rule. For example, take this nodejs snippet which reads and updates the description of a firewall rule:

async function doit() {
  const Compute = require('@google-cloud/compute');
  const compute = new Compute();
  const f = compute.firewall('default-allow-10000');

  f.get().then(data => {
    const firewall = data[0];
    console.log('initial description: ' + firewall.metadata.description);
    const metadata = {
      description: 'new description for this rule'
    };
    return firewall.setMetadata(metadata);
  }).then(data => {
    const firewall = data[0];
    console.log('description set');
    return compute.firewall('default-allow-10000').get();
  }).then(data => {
    const firewall = data[0];
    console.log('current description: ' + firewall.metadata.description);
  });
}

doit();

In my example, this gives the output of:

initial description: old description
description set
current description: new description for this rule

To see what exists on the metadata object, you should look at the definition of the Firewall resource in the REST API.