2

My GCP project has an instance running a Jenkins server behind an IAP-protected load balancer.

Adding the IAP protection has caused me 2 related issues that I didn't manage to resolve (and I guess both could be resolved in a similar manner):

  1. I used to have a physical Jenkins slave (that must be physical as it's connected to special hardware) that was connected to the cloud Jenkins server. Now that the cloud server is protected by IAP, the on-premises Jenkins slave can no longer cannot to it as the slave JNLP app doesn't know how to authorize with the Google login interface. (EDIT: I got around this specific issue eventually by creating an SSH tunnel for the slave directly to the Jenkins server machine)

  2. I used to have a BitBucket-Cloud repository that POSTs to the Jenkins server via BitBucket's webhook functionality. BitBucket also doesn't know how to authorize with IAP so it too doesn't work anymore.

It seems that Google supports authorization programmatically but in both cases I have no programmatic control over the entity that needs to communicate with the Jenkins server.

Is there any way to get around this issue? I have several directions in mind, but I'm not sure what's the best way to do it / if it's even possible:

  • Is there any way to simply white-list specific URL's in IAP so they don't require any authorization? For example, allow authorization-free access for everyone to https://my.jenkins.domain.com/bitbucket-scmsource-hook/notify so BitBucket can webhook? (I know it's not optimal security-wise)

  • Is there any way to white-list access from specific IP's? Allow all requests from BitBucket Cloud and all requests from the physical slave to go through without IAP requiring their authentication. It's obviously also not optimal security wise.

  • Maybe create another parallel IAP-less load-balancer that also routes to the Jenkins server which I will specifically configure to white-list the URL/IP's as I described above and black-list everything else, and have BitBucket and the physical slave connect to it instead of the regular load-balancer. Same security issues considerations as the solutions above, very complicated, required another domain name. Not optimal at all. But it's the only practical solution I can think of.

What do you think? Do you have better, simpler, more secure ideas? Maybe I'm missing some obvious way to do this? I couldn't find anything in the IAP documentation regarding how to achieve something like this.

1

So the top answer here is basically what you're after. I have a separate small VM with an Nginx Reverse Proxy that is solely used to handle webhooks. It routes to the same Jenkins Backend as my Google IAP load balancer.

I'm using GitHub for my webhooks but I imagine it probably works similar for Bitbucket.

Actually, I would have a Jenkins job that would run periodically (daily?) that would grab the CIDR entries from here and update your firewall rule for your Other load balancer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.