Update PG Firewall rules for MOS

Change-Id: I0309dd9bf00a9d0f340653b977dfa8f05a54ceab
Ticket: [SOL-904]
Signed-off-by: Muhammad Shahzeb <mshahzeb@plumgrid.com>
This commit is contained in:
Muhammad Shahzeb 2016-06-08 15:56:53 -07:00
parent 75ee8d4327
commit 41f19ebf86
6 changed files with 43 additions and 65 deletions

View File

@ -70,17 +70,15 @@ class { 'plumgrid':
fabric_dev => $fabric_dev,
lvm_keypath => "/var/lib/plumgrid/zones/$plumgrid_zone/id_rsa.pub",
md_ip => $md_ip,
source_net => $mgmt_net,
dest_net => $mgmt_net,
}
class { 'sal':
plumgrid_ip => $controller_ipaddresses,
virtual_ip => $plumgrid_vip,
md_ip => $md_ip,
}
class { plumgrid::firewall:
source_net => $mgmt_net,
dest_net => $mgmt_net,
}
# Setup Neutron PLUMgrid Configurations

View File

@ -40,11 +40,8 @@ class { 'plumgrid':
fabric_dev => $fabric_dev,
lvm_keypath => "/var/lib/plumgrid/zones/$plumgrid_zone/id_rsa.pub",
md_ip => $md_ip,
}
class { plumgrid::firewall:
source_net=> $mgmt_net,
dest_net=> $mgmt_net,
source_net => $mgmt_net,
dest_net => $mgmt_net,
}
package { 'nova-api':

View File

@ -36,11 +36,8 @@ class { 'plumgrid':
gateway_devs => split($plumgrid_gw_devs, ','),
lvm_keypath => "/var/lib/plumgrid/zones/$plumgrid_zone/id_rsa.pub",
md_ip => $md_ip,
}
class { plumgrid::firewall:
source_net => $mgmt_net,
dest_net => $mgmt_net,
source_net => $mgmt_net,
dest_net => $mgmt_net,
}
package { 'iptables-persistent':

View File

@ -1,51 +0,0 @@
#
# Copyright (c) 2016, PLUMgrid Inc, http://plumgrid.com
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
class plumgrid::firewall (
$source_net = undef,
$dest_net = undef,
) {
if $source_net != undef {
firewall { '001 plumgrid udp':
proto => 'udp',
action => 'accept',
state => ['NEW'],
destination => $dest_net,
source => $source_net,
before => Class['plumgrid'],
}
firewall { '001 plumgrid rpc':
proto => 'tcp',
action => 'accept',
state => ['NEW'],
destination => $dest_net,
source => $source_net,
before => Class['plumgrid'],
}
firewall { '040 allow vrrp':
proto => 'vrrp',
action => 'accept',
before => Class['plumgrid'],
}
firewall { '040 keepalived':
proto => 'all',
action => 'accept',
destination => '224.0.0.18/32',
source => $source_net,
before => Class['plumgrid'],
}
}
}

View File

@ -31,6 +31,8 @@ class plumgrid (
$repo_baseurl = '',
$repo_component = '',
$physical_location = '',
$source_net = undef,
$dest_net = undef,
) inherits plumgrid::params {
Exec { path => [ '/bin', '/sbin' , '/usr/bin', '/usr/sbin', '/usr/local/bin', ] }
@ -106,6 +108,25 @@ class plumgrid (
notify => Service['plumgrid'],
}
if $source_net != undef {
firewall { '001 plumgrid udp':
proto => 'udp',
action => 'accept',
state => ['NEW'],
destination => $dest_net,
source => $source_net,
before => Service['plumgrid'],
}
firewall { '001 plumgrid rpc':
proto => 'tcp',
action => 'accept',
state => ['NEW'],
destination => $dest_net,
source => $source_net,
before => Service['plumgrid'],
}
}
service { 'plumgrid':
ensure => running,
enable => true,

View File

@ -17,6 +17,7 @@ class sal ($plumgrid_ip = '',
$virtual_ip = '',
$rest_port = '9180',
$mgmt_dev = '%AUTO_DEV%',
$source_net = undef,
$md_ip = '127.0.0.1',
) {
$lxc_root_path = '/var/lib/libvirt/filesystems/plumgrid'
@ -30,6 +31,21 @@ class sal ($plumgrid_ip = '',
before => [ Class['sal::nginx'], Class['sal::keepalived'] ],
}
if $source_net != undef {
firewall { '040 allow vrrp':
proto => 'vrrp',
action => 'accept',
before => [ Class['sal::nginx'], Class['sal::keepalived'] ],
}
firewall { '040 keepalived':
proto => 'all',
action => 'accept',
destination => '224.0.0.18/32',
source => $source_net,
before => [ Class['sal::nginx'], Class['sal::keepalived'] ],
}
}
class { 'sal::nginx':
plumgrid_ip => $plumgrid_ip,
md_ip => $md_ip,