Use eventlet version of subprocess

Eventlet doesn't patch subprocess module, see bug [1]. As result
trying to catch subprocess.CalledProcessError exception wouldn't
work. So use subprocess module from eventlet.

[1] https://github.com/eventlet/eventlet/issues/357

Closes-Bug: #1675744
Change-Id: I4a744cef35e9f58c532d979ce61c912cfdfccd97

ironic_inspector/firewall.py

@@ -14,8 +14,8 @@
 import contextlib
 import os
 import re
-import subprocess
 
+from eventlet.green import subprocess
 from eventlet import semaphore
 from oslo_config import cfg
 from oslo_log import log

ironic_inspector/test/unit/test_firewall.py

@@ -13,7 +13,6 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import subprocess
 
 import mock
 from oslo_config import cfg
@@ -34,7 +33,7 @@ EMAC=02:00:00:61:00:02 IMAC=61:fe:80:00:00:00:00:00:00:7c:fe:90:03:00:29:24:4f
 
 @mock.patch.object(firewall, '_iptables')
 @mock.patch.object(ir_utils, 'get_client')
-@mock.patch.object(subprocess, 'check_call')
+@mock.patch.object(firewall.subprocess, 'check_call')
 class TestFirewall(test_base.NodeTest):
     CLIENT_ID = 'ff:00:00:00:00:00:02:00:00:02:c9:00:7c:fe:90:03:00:29:24:4f'
 
@@ -69,7 +68,7 @@ class TestFirewall(test_base.NodeTest):
                                     mock_iptables):
         rootwrap_path = '/some/fake/path'
         CONF.set_override('rootwrap_config', rootwrap_path)
-        mock_call.side_effect = subprocess.CalledProcessError(2, '')
+        mock_call.side_effect = firewall.subprocess.CalledProcessError(2, '')
         firewall.init()
         init_expected_args = [
             ('-D', 'INPUT', '-i', 'br-ctlplane', '-p', 'udp', '--dport', '67',

releasenotes/notes/fix-CalledProcessError-on-startup-28d9dbed85a81542.yaml

@@ -0,0 +1,9 @@
+---
+fixes:
+  - |
+    Exception CalledProcessError is raised when running `iptables` cmd on start up.
+    The issue is caused by eventlet bug, see:
+    https://github.com/eventlet/eventlet/issues/357
+    The issue affects *ironic-inspector* only if it manages firewall - configured
+    with ``manage_firewall = True`` configuration option.
+