Method access_ssh_over_nat

tools/marvin/marvin/lib/base.py:457–518

Program NAT and PF rules to open up ssh access to deployed guest @return:

(
            cls, apiclient, services, virtual_machine, allow_egress=False,
            networkid=None, vpcid=None)

    @classmethod
    def access_ssh_over_nat(
            cls, apiclient, services, virtual_machine, allow_egress=False,
            networkid=None, vpcid=None):
        """
        Program NAT and PF rules to open up ssh access to deployed guest
        @return:
        """
        # VPCs have ACLs managed differently
        if vpcid:
            public_ip = PublicIPAddress.create(
                apiclient=apiclient,
                accountid=virtual_machine.account,
                zoneid=virtual_machine.zoneid,
                domainid=virtual_machine.domainid,
                services=services,
                vpcid=vpcid
            )

            nat_rule = NATRule.create(
                apiclient=apiclient,
                virtual_machine=virtual_machine,
                services=services,
                ipaddressid=public_ip.ipaddress.id,
                networkid=networkid)
        else:
            public_ip = PublicIPAddress.create(
                apiclient=apiclient,
                accountid=virtual_machine.account,
                zoneid=virtual_machine.zoneid,
                domainid=virtual_machine.domainid,
                services=services,
                networkid=networkid,
            )

            FireWallRule.create(
                apiclient=apiclient,
                ipaddressid=public_ip.ipaddress.id,
                protocol='TCP',
                cidrlist=['0.0.0.0/0'],
                startport=22,
                endport=22
            )
            nat_rule = NATRule.create(
                apiclient=apiclient,
                virtual_machine=virtual_machine,
                services=services,
                ipaddressid=public_ip.ipaddress.id)

        if allow_egress and not vpcid:
            try:
                EgressFireWallRule.create(
                    apiclient=apiclient,
                    networkid=virtual_machine.nic[0].networkid,
                    protocol='All',
                    cidrlist='0.0.0.0/0'
                )
            except CloudstackAPIException as e:
                # This could fail because we've already set up the same rule