diff options
author | Jenkins <jenkins@review.openstack.org> | 2016-07-25 13:51:30 +0000 |
---|---|---|
committer | Gerrit Code Review <review@openstack.org> | 2016-07-25 13:51:30 +0000 |
commit | 31278c995f3149a29958d1205001c8ce7aba5884 (patch) | |
tree | 89ff4cefe476166562c381cddaea6eefe9e5c69e /manifests/firewall.pp | |
parent | 0c7a006b1c5e2cf267c0d23c31e65e13489f13b7 (diff) | |
parent | 5881826559a01b987348b273877e4ebc1e748d22 (diff) |
Merge "Add firewall::service_rules define"
Diffstat (limited to 'manifests/firewall.pp')
-rw-r--r-- | manifests/firewall.pp | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/manifests/firewall.pp b/manifests/firewall.pp index 7698881..edcb5e7 100644 --- a/manifests/firewall.pp +++ b/manifests/firewall.pp @@ -86,6 +86,24 @@ class tripleo::firewall( 'stage' => 'runtime', 'firewall_settings' => $firewall_post_extras, }) + + # Allow composable services to load their own custom + # example with Hiera. + # NOTE(dprince): In the future when we have a better hiera + # heat hook we might refactor this to use hiera's merging + # capabilities instead. Until then rolling up the flat service + # keys and dynamically creating firewall rules for each service + # will allow us to compose and should work fine. + # + # Each service can load its rules by using this form: + # + # tripleo.<service name with underscores>.firewall_rules: + # '300 allow custom application 1': + # dport: 999 + # proto: udp + # action: accept + $service_names = reject(hiera('service_names', []), '^$') + tripleo::firewall::service_rules { $service_names: } } } |