fix dvsm config deprecations

The [firewall] group was deprecated but our devstack still uses it.  This
patch replaces the IRONIC_INSPECTOR_MANAGE_FIREWALL=True/False variable
with an IRONIC_INSPECTOR_DHCP_FILTER variable with a default of 'iptables'
and sets the [pxe_filter]driver config value. The
IRONIC_INSPECTOR_INTERFACE is now set in the [iptables] config section.

Change-Id: Icf6fe6c6a98ab815edefe3c0e1ec3ce9a064bf2e

devstack/plugin.sh

@@ -16,7 +16,22 @@ IRONIC_INSPECTOR_DHCP_CONF_FILE=$IRONIC_INSPECTOR_CONF_DIR/dnsmasq.conf
 IRONIC_INSPECTOR_ROOTWRAP_CONF_FILE=$IRONIC_INSPECTOR_CONF_DIR/rootwrap.conf
 IRONIC_INSPECTOR_ADMIN_USER=${IRONIC_INSPECTOR_ADMIN_USER:-ironic-inspector}
 IRONIC_INSPECTOR_AUTH_CACHE_DIR=${IRONIC_INSPECTOR_AUTH_CACHE_DIR:-/var/cache/ironic-inspector}
-IRONIC_INSPECTOR_MANAGE_FIREWALL=$(trueorfalse True IRONIC_INSPECTOR_MANAGE_FIREWALL)
+IRONIC_INSPECTOR_DHCP_FILTER=${IRONIC_INSPECTOR_DHCP_FILTER:-iptables}
+if [[ -n ${IRONIC_INSPECTOR_MANAGE_FIREWALL} ]] ; then
+    echo "IRONIC_INSPECTOR_MANAGE_FIREWALL is deprecated." >&2
+    echo "Please, use IRONIC_INSPECTOR_DHCP_FILTER == noop/iptables/dnsmasq instead." >&2
+    if [[ "$IRONIC_INSPECTOR_DHCP_FILTER" != "iptables" ]] ; then
+        # both manage firewall and filter driver set together but driver isn't iptables
+        echo "Inconsistent configuration: IRONIC_INSPECTOR_MANAGE_FIREWALL used while" >&2
+        echo "IRONIC_INSPECTOR_DHCP_FILTER == $IRONIC_INSPECTOR_DHCP_FILTER" >&2
+        exit 1
+    fi
+    if [[ $(trueorfalse True IRONIC_INSPECTOR_MANAGE_FIREWALL) == "False" ]] ; then
+        echo "IRONIC_INSPECTOR_MANAGE_FIREWALL == False" >&2
+        echo "Setting IRONIC_INSPECTOR_DHCP_FILTER=noop" >&2
+        IRONIC_INSPECTOR_DHCP_FILTER=noop
+    fi
+fi
 IRONIC_INSPECTOR_HOST=$HOST_IP
 IRONIC_INSPECTOR_PORT=5050
 IRONIC_INSPECTOR_URI="http://$IRONIC_INSPECTOR_HOST:$IRONIC_INSPECTOR_PORT"
@@ -81,6 +96,11 @@ function start_inspector {
     run_process ironic-inspector "$IRONIC_INSPECTOR_CMD"
 }
 
+function is_inspector_dhcp_required {
+    [[ "$IRONIC_INSPECTOR_MANAGE_FIREWALL" == "True" ]] || \
+    [[ "${IRONIC_INSPECTOR_DHCP_FILTER:-iptables}" != "noop" ]]
+}
+
 function start_inspector_dhcp {
     # NOTE(dtantsur): USE_SYSTEMD requires an absolute path
     run_process ironic-inspector-dhcp \
@@ -181,8 +201,8 @@ function configure_inspector {
     inspector_iniset DEFAULT listen_port $IRONIC_INSPECTOR_PORT
     inspector_iniset DEFAULT listen_address 0.0.0.0  # do not change
 
-    inspector_iniset firewall manage_firewall $IRONIC_INSPECTOR_MANAGE_FIREWALL
-    inspector_iniset firewall dnsmasq_interface $IRONIC_INSPECTOR_INTERFACE
+    inspector_iniset pxe_filter driver $IRONIC_INSPECTOR_DHCP_FILTER
+    inspector_iniset iptables dnsmasq_interface $IRONIC_INSPECTOR_INTERFACE
     inspector_iniset database connection `database_connection_url ironic_inspector`
 
     # FIXME(ankit) Remove this when swift supports python3
@@ -298,7 +318,7 @@ function cleanup_inspector {
     sudo rm -rf $IRONIC_INSPECTOR_AUTH_CACHE_DIR
     sudo rm -rf "$IRONIC_INSPECTOR_RAMDISK_LOGDIR"
 
-    # Try to clean up firewall rules
+    # Always try to clean up firewall rules, no matter filter driver used
     sudo iptables -D INPUT -i $IRONIC_INSPECTOR_INTERFACE -p udp \
         --dport 69 -j ACCEPT | true
     sudo iptables -D INPUT -i $IRONIC_INSPECTOR_INTERFACE -p tcp \
@@ -324,7 +344,7 @@ function sync_inspector_database {
 
 if [[ "$1" == "stack" && "$2" == "install" ]]; then
     echo_summary "Installing ironic-inspector"
-    if [[ "$IRONIC_INSPECTOR_MANAGE_FIREWALL" == "True" ]]; then
+    if is_inspector_dhcp_required; then
         install_inspector_dhcp
     fi
     install_inspector
@@ -332,7 +352,7 @@ if [[ "$1" == "stack" && "$2" == "install" ]]; then
 elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
     echo_summary "Configuring ironic-inspector"
     cleanup_inspector
-    if [[ "$IRONIC_INSPECTOR_MANAGE_FIREWALL" == "True" ]]; then
+    if is_inspector_dhcp_required; then
         configure_inspector_dhcp
     fi
     configure_inspector
@@ -340,7 +360,7 @@ elif [[ "$1" == "stack" && "$2" == "post-config" ]]; then
 elif [[ "$1" == "stack" && "$2" == "extra" ]]; then
     echo_summary "Initializing ironic-inspector"
     prepare_environment
-    if [[ "$IRONIC_INSPECTOR_MANAGE_FIREWALL" == "True" ]]; then
+    if is_inspector_dhcp_required; then
         start_inspector_dhcp
     fi
     start_inspector
@@ -355,7 +375,7 @@ fi
 
 if [[ "$1" == "unstack" ]]; then
     stop_inspector
-    if [[ "$IRONIC_INSPECTOR_MANAGE_FIREWALL" == "True" ]]; then
+    if is_inspector_dhcp_required; then
         stop_inspector_dhcp
     fi
     cleanup_inspector

devstack/upgrade/shutdown.sh

@@ -24,6 +24,6 @@ source $INSPECTOR_DEVSTACK_DIR/plugin.sh
 set -o xtrace
 
 stop_inspector
-if [[ "$IRONIC_INSPECTOR_MANAGE_FIREWALL" == "True" ]]; then
+if is_inspector_dhcp_required; then
     stop_inspector_dhcp
 fi

devstack/upgrade/upgrade.sh

@@ -75,7 +75,7 @@ fi
 # https://github.com/openstack-dev/devstack/blob/dec121114c3ea6f9e515a452700e5015d1e34704/lib/stack#L32
 stack_install_service inspector
 
-if [[ "$IRONIC_INSPECTOR_MANAGE_FIREWALL" == "True" ]]; then
+if is_inspector_dhcp_required; then
     stack_install_service inspector_dhcp
 fi
 
@@ -86,15 +86,14 @@ upgrade_project ironic-inspector $RUN_DIR $BASE_DEVSTACK_BRANCH $TARGET_DEVSTACK
 
 
 start_inspector
-
-if [[ "$IRONIC_INSPECTOR_MANAGE_FIREWALL" == "True" ]]; then
+if is_inspector_dhcp_required; then
     start_inspector_dhcp
 fi
 
 # Don't succeed unless the services come up
 ensure_services_started ironic-inspector
 
-if [[ "$IRONIC_INSPECTOR_MANAGE_FIREWALL" == "True" ]]; then
+if is_inspector_dhcp_required; then
     ensure_services_started dnsmasq
 fi
 

playbooks/legacy/ironic-inspector-grenade-dsvm/run.yaml

@@ -133,7 +133,7 @@
           # Make IPXE configuration consistent between Mitaka and Master
           export DEVSTACK_LOCAL_CONFIG+=$'\n'"IRONIC_IPXE_ENABLED=True"
           export DEVSTACK_LOCAL_CONFIG+=$'\n'"IRONIC_INSPECTOR_RAMDISK_ELEMENT=ironic-agent"
-          export DEVSTACK_LOCAL_CONFIG+=$'\n'"IRONIC_INSPECTOR_MANAGE_FIREWALL=True"
+          export DEVSTACK_LOCAL_CONFIG+=$'\n'"IRONIC_INSPECTOR_DHCP_FILTER=iptables"
 
           EOF
         chdir: '{{ ansible_user_dir }}/workspace'

playbooks/legacy/ironic-inspector-tempest-dsvm-discovery/run.yaml

@@ -92,7 +92,7 @@
           # Make IPXE configuration consistent between Mitaka and Master
           export DEVSTACK_LOCAL_CONFIG+=$'\n'"IRONIC_IPXE_ENABLED=True"
           export DEVSTACK_LOCAL_CONFIG+=$'\n'"IRONIC_INSPECTOR_RAMDISK_ELEMENT=ironic-agent"
-          export DEVSTACK_LOCAL_CONFIG+=$'\n'"IRONIC_INSPECTOR_MANAGE_FIREWALL=True"
+          export DEVSTACK_LOCAL_CONFIG+=$'\n'"IRONIC_INSPECTOR_DHCP_FILTER=iptables"
 
           EOF
         chdir: '{{ ansible_user_dir }}/workspace'

playbooks/legacy/ironic-inspector-tempest-dsvm-python3/run.yaml

@@ -97,6 +97,9 @@
                export DEVSTACK_LOCAL_CONFIG+=$'\n'"IRONIC_INSPECTOR_CLEAN_UP_PERIOD=5"
           fi
 
+          # PXE Filter Driver
+          export DEVSTACK_LOCAL_CONFIG+=$'\n'"IRONIC_INSPECTOR_DHCP_FILTER=iptables"
+
           EOF
         chdir: '{{ ansible_user_dir }}/workspace'
       environment: '{{ zuul | zuul_legacy_vars }}'