openstack
/
puppet-tripleo
Code Issues Proposed changes
RETIRED, Lightweight composition layer for Puppet TripleO
2,330 Commits 3 Branches 39 Tags 63 MiB
Go to file
Cédric Jeanneret f25c27aa2c Ensure we get a clean firewall 
The iptables-services package pushes a bunch of default rules, activated as soon
as we start the "iptables" systemd unit.

This patch intends to remove those default rules, in order to ensure we get
only managed firewall rules (either by puppet, or by any openstack service like
neutron).

In order to prevent any issue, instead of erasing the file, we actually save the
current state prior the iptables-services installation and subsequent service startup.

The iptables-services installation and activation is done at the "include ::firewall"
step.
Prior that, iptables is empty, meaning if we save, and pre-create the
/etc/sysconfig/iptables and /etc/sysconfig/ip6tables files before we include the
"::firewall" class, we will get an empty, clean ruleset.

Please note, this won't correct already deployed infrastructure though - that will
probably requires an upgrade_tasks directly in tripleo-heat-templates.

SecurityImpact
Related: https://bugzilla.redhat.com/show_bug.cgi?id=1667887
Partial-Bug: #1812695
Change-Id: I74d15b8de216984ac42a0839430ae9afe2554d16
 		2019-01-23 15:40:16 +01:00
doc Follow the new PTI for document build 2018-02-28 14:42:12 +08:00
files Add support for libvirt VNC TLS with option of a dedicated CA 2018-02-14 10:23:26 +00:00
lib Configure switchedv while there is no vfs bounded 2019-01-08 07:08:09 +00:00
manifests Ensure we get a clean firewall 2019-01-23 15:40:16 +01:00
releasenotes Remove MongoDB 2019-01-04 12:48:43 +00:00
spec Merge "Explicitly set certmonger's CA cert's permissions" 2019-01-17 14:19:51 +00:00
templates Make the neutron-haproxy-wrapper compatible with haproxy 1.8 2019-01-16 10:52:21 +00:00
zuul.d Use the tripleo-standalone-scenarios-full template 2019-01-14 12:13:35 +02:00
.gitignore Dissuade .gitignore references to personal tools 2018-10-08 11:47:08 +08:00
.gitreview Update .gitreview file for project rename 2015-06-12 23:12:30 +00:00
.sync.yml Initial msync run for all Puppet OpenStack modules 2015-08-18 14:30:54 +02:00
Gemfile Load puppet-openstack_spec_helper locally during tests 2018-02-12 10:53:40 +08:00
LICENSE Add basic structure for a Puppet module 2015-02-02 11:39:21 -05:00
Puppetfile_extras Pin puppet-snmp 2018-10-31 16:30:08 -06:00
README.md Add release note link in README 2018-06-27 22:47:34 +08:00
Rakefile Composable HA 2017-01-25 19:32:31 +00:00
bindep.txt Add Puppet package to bindep, for module build 2017-10-27 13:50:15 -07:00
metadata.json Prepare stein-2 2019-01-10 10:51:08 -05:00
setup.cfg Update mailinglist from dev to discuss 2018-12-05 09:46:02 +08:00
setup.py chmod +x setup.py 2017-10-06 12:28:56 -07:00
tox.ini Update min tox version to 2.0 2018-10-16 11:40:19 +08:00

README.md

Team and repository tags

Team and repository tags

puppet-tripleo

Lightweight composition layer for Puppet TripleO.

Contributing