Two modules are available for this task: allow-all-hosts and allow-hosts.

The first module, allow-all-hosts, configures the most open situation which is to accept hosts from anywhere. This is only recommended in network restricted environments such as a local machine’s virtual machine network or other such closed down situations.

The second module, allow-hosts, uses cfbs module input to let you decide which hosts (specified by IP addresses and subnets) are allowed to connect to your hub, authenticate, fetch policy, etc. This is by far the more common scenario.

By default the hub will accept requests from hosts on it’s own subnet e.g. hub-ip/16.

Add the allow-hosts module

When you install allow-hosts in the Build app in Mission Portal you will see an input field to enter one or more allowed hosts.

I add several IPs for hosts in my environment, including the hub itself, 192.168.1.196:

and then make sure I push and deploy the policy:

Remove an IP and test

Next I remove one hosts IP: 192.168.1.103 and test if it can connect and pull policy from the hub.

The ip a command shows the IP address:

ip a | grep 192

inet 192.168.1.103/24 brd 192.168.1.255 scope global dynamic noprefixroute wlp3s0

If we try to fetch policy we see that the hub rejects the connection:

cf-agent -KIf update.cf

error: Failed to establish TLS connection: underlying network error (Connection reset by peer)
 info: Unable to establish connection to '192.168.1.196'

The policy that has already been fetched will still be used but updates will not be received.

When I add that IP address back in, it can fetch policy again as desired.

Test with cf-net

An alternate way to test connectivity would be to use cf-net command:

cf-net -H 192.168.1.196 opendir /var/cfengine/data

...
host_specific.json

and if the IP is not included in the list of IPs you would get

cf-net -H 192.168.1.196 opendir /var/cfengine/data

error: Failed to establish TLS connection: underlying network error (Connection reset by peer)
Failed to connect to '192.168.1.196'

Questions?

If you have questions or need help reach out on the mailing list or GitHub discussions. If you have a support contract feel free to open a ticket in our support system.