openstack
/
tripleo-heat-templates
Code Issues Proposed changes

implement default ssh-from-ctlplane rule via hiera 

With the accompanying change in puppet-tripleo, this removes the
hardcoded firewall rule allowing ssh traffic in tripleo::firewall::pre
and replaces it with a configuration in tripleo-firewall.yaml that
allows only ssh access from the undercloud's controlplane network
address. This allows operators to define more granular ssh
firewall rules via tripleo::firewall::firewall_rules.

Change-Id: I89cff59947dda3f51482486c41a3d67c4aa36a3e
Related-Bug: #1826829
(cherry picked from commit a433e05e66)
This commit is contained in:
Lars Kellogg-Stedman 2018-07-12 15:36:48 -04:00 committed by Cédric Jeanneret
parent a7da172e3d
commit 123535d8c9
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
puppet/services/tripleo-firewall.yaml
View File

@ -47,6 +47,12 @@ outputs:
config_settings:
tripleo::firewall::manage_firewall: {get_param: ManageFirewall}
tripleo::firewall::purge_firewall_rules: {get_param: PurgeFirewallRules}
tripleo::tripleo_firewall::firewall_rules:
'003 accept ssh from controlplane':
source: "%{hiera('ctlplane_subnet')}"
proto: 'tcp'
dport: 22
step_config: |
include ::tripleo::firewall
upgrade_tasks: