Configure firewall rules

This change configures explicitly the firewall rules for the node
running the Elasticsearch-Kibana plugin. This is needed because
otherwise the node becomes unavailable on CentOS after a reboot.

Change-Id: I6b123fac74e01c4cc4b16ff6a9f58654b9366fa1

deployment_scripts/puppet/manifests/firewall.pp

@@ -0,0 +1,60 @@
+#    Copyright 2015 Mirantis, Inc.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+$elasticsearch_kibana = hiera('elasticsearch_kibana')
+
+if $elasticsearch_kibana['node_name'] == hiera('user_node_name') {
+  class {'::firewall':}
+
+  firewall { '000 accept all icmp requests':
+    proto  => 'icmp',
+    action => 'accept',
+  }
+
+  firewall { '001 accept all to lo interface':
+    proto   => 'all',
+    iniface => 'lo',
+    action  => 'accept',
+  }
+
+  firewall { '002 accept related established rules':
+    proto  => 'all',
+    state  => ['RELATED', 'ESTABLISHED'],
+    action => 'accept',
+  }
+
+  firewall {'020 ssh':
+    port   => 22,
+    proto  => 'tcp',
+    action => 'accept',
+  }
+
+  firewall { '100 elasticsearch':
+    port   => 9200,
+    proto  => 'tcp',
+    action => 'accept',
+  }
+
+  firewall { '101 kibana':
+    port   => 80,
+    proto  => 'tcp',
+    action => 'accept',
+  }
+
+  firewall { '999 drop all other requests':
+    proto  => 'all',
+    chain  => 'INPUT',
+    action => 'drop',
+  }
+}

tasks.yaml

@@ -6,6 +6,14 @@
     puppet_modules: /etc/puppet/modules
     timeout: 720
 
+- role: ['base-os']
+  stage: post_deployment
+  type: puppet
+  parameters:
+    puppet_manifest: puppet/manifests/firewall.pp
+    puppet_modules: /etc/puppet/modules
+    timeout: 300
+
 - role: ['base-os']
   stage: post_deployment
   type: puppet