fix(infra): allow SSH from the run's VPC so the agent can reach the UUT

README.md

@@ -128,7 +128,7 @@ the end. In `infra.region` of `perfkit.yaml`, it creates, in this order:
 3. two `ubuntu-24-04-x64` droplets in it, `perfkit-<run id>-uut` and
    `perfkit-<run id>-loadgen`, tagged `perfkit` and `perfkit-run-<run id>`;
 4. a firewall, `perfkit-<run id>`: SIP (5060-5063 tcp/udp) and OTLP (4318 tcp) from the VPC only,
-   SSH (22) from this machine's public IP only (from `https://api.ipify.org`).
+   SSH (22) from this machine's public IP (from `https://api.ipify.org`) and from the VPC, where the agent on the load generator reaches the server under test.
 
 Both droplets get Docker Engine with the compose plugin, 25 MiB socket buffers
 (`net.core.rmem_max`, `wmem_max`, `rmem_default`, `wmem_default`) and 1048576 open files, through
@@ -161,7 +161,7 @@ plan for Routr 2.31.6 (dry run, nothing created)
   region     nyc3, new VPC (range assigned by DigitalOcean)
   uut        c-8   ubuntu-24-04-x64
   loadgen    c-16  ubuntu-24-04-x64
-  firewall   SIP (5060-5063 tcp/udp) and OTLP (4318 tcp) from the VPC only; SSH (22) from 203.0.113.7 only
+  firewall   SIP (5060-5063 tcp/udp) and OTLP (4318 tcp) from the VPC only; SSH (22) from 203.0.113.7 and the VPC only
   tags       perfkit, perfkit-run-20261103T141210Z-bd3254a
   images     fonoster/routr-edgeport:2.31.6@sha256:8bca…1866
              fonoster/routr-echo:2.31.6@sha256:14a4…a43f

package.json

@@ -1,6 +1,6 @@
 {
   "name": "perfkit",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Benchmark harness for Fonoster projects: DigitalOcean runs, one report.json schema, one branded report page",
   "license": "MIT",
   "author": "Pedro Sanders <psanders@fonoster.com>",

src/cli/formatPlan.ts

@@ -60,7 +60,7 @@ export function formatPlan(
       `${plan.loadgen.size.padEnd(sizeWidth)}${plan.loadgen.image}`
     ]),
     ...field("firewall", [
-      `SIP (${SIP_PORTS} tcp/udp) and OTLP (${OTLP_PORT} tcp) from the VPC only; SSH (22) from ${plan.sshSource.replace(/\/32$/, "")} only`
+      `SIP (${SIP_PORTS} tcp/udp) and OTLP (${OTLP_PORT} tcp) from the VPC only; SSH (22) from ${plan.sshSource.replace(/\/32$/, "")} and the VPC only`
     ]),
     ...field("tags", [plan.tags.join(", ")]),
     ...field(

src/infra/buildFirewall.ts

@@ -8,8 +8,9 @@ const ANYWHERE = { addresses: ["0.0.0.0/0", "::/0"] };
 
 /**
  * A run's firewall: SIP (tcp and udp) and OTLP (tcp) from the VPC's range
- * only, SSH (22) from `sshSources` only, and every outbound connection. It
- * applies to the run's droplets.
+ * only, SSH (22) from `sshSources` and from the VPC (the agent on the load
+ * generator drives the UUT over SSH at its private IP), and every outbound
+ * connection. It applies to the run's droplets.
  */
 export function buildFirewall(input: {
   name: string;
@@ -24,7 +25,11 @@ export function buildFirewall(input: {
       { protocol: "udp", ports: SIP_PORTS, sources: vpc },
       { protocol: "tcp", ports: SIP_PORTS, sources: vpc },
       { protocol: "tcp", ports: OTLP_PORT, sources: vpc },
-      { protocol: "tcp", ports: "22", sources: { addresses: input.sshSources } }
+      {
+        protocol: "tcp",
+        ports: "22",
+        sources: { addresses: [...input.sshSources, input.vpcRange] }
+      }
     ],
     outbound_rules: [
       { protocol: "tcp", ports: "all", destinations: ANYWHERE },

test/infra/createAllowSsh.unit.test.ts

@@ -36,6 +36,7 @@ describe("createAllowSsh", () => {
         firewall.inbound_rules.find(({ ports }) => ports === "22")!;
       expect(ssh(after).sources.addresses).to.deep.equal([
         "203.0.113.7/32",
+        "10.116.0.0/20",
         "198.51.100.20/32"
       ]);
       const strip = (firewall: typeof after) => ({

test/infra/createProvision.unit.test.ts

@@ -55,7 +55,7 @@ describe("createProvision", () => {
       ]);
     });
 
-    it("should create the droplets in the VPC with the tags and a firewall open to SSH from this machine only", async () => {
+    it("should create the droplets in the VPC with the tags and a firewall open to SSH from this machine and the VPC only", async () => {
       // Arrange
       const { provision, client } = setup();
       const plan = await makePlan();
@@ -83,7 +83,7 @@ describe("createProvision", () => {
       expect(firewall.droplet_ids).to.have.length(2);
       expect(
         firewall.inbound_rules.find(({ ports }) => ports === "22")?.sources
-      ).to.deep.equal({ addresses: ["203.0.113.7/32"] });
+      ).to.deep.equal({ addresses: ["203.0.113.7/32", "10.116.0.0/20"] });
       expect(
         firewall.inbound_rules
           .filter(({ ports }) => ports !== "22")

test/infra/helpers.unit.test.ts

@@ -92,7 +92,7 @@ describe("buildFirewall", () => {
       "udp 5060-5063 10.1.0.0/20",
       "tcp 5060-5063 10.1.0.0/20",
       "tcp 4318 10.1.0.0/20",
-      "tcp 22 203.0.113.7/32"
+      "tcp 22 203.0.113.7/32,10.1.0.0/20"
     ]);
     expect(
       firewall.outbound_rules.map(({ protocol }) => protocol)

test/infra/run.unit.test.ts

@@ -24,7 +24,7 @@ const PLAN = `plan for Routr 2.31.5 (dry run, nothing created)
   region     nyc3, new VPC (range assigned by DigitalOcean)
   uut        c-8   ubuntu-24-04-x64
   loadgen    c-16  ubuntu-24-04-x64
-  firewall   SIP (5060-5063 tcp/udp) and OTLP (4318 tcp) from the VPC only; SSH (22) from 203.0.113.7 only
+  firewall   SIP (5060-5063 tcp/udp) and OTLP (4318 tcp) from the VPC only; SSH (22) from 203.0.113.7 and the VPC only
   tags       perfkit, perfkit-run-${RUN_ID}
   images     fonoster/routr-edgeport:2.31.5@sha256:4f1c…e2a0
              fonoster/routr-echo:2.31.5@sha256:41ab…77d0