diff options
author | Yanis Guenane <yguenane@redhat.com> | 2015-07-15 11:58:46 +0200 |
---|---|---|
committer | Yanis Guenane <yguenane@redhat.com> | 2015-07-15 11:58:46 +0200 |
commit | c59650772c8d7d2e84a19782ef8d53cec02deb9b (patch) | |
tree | aec45b9a2d425ee6bac3815a60a5171cc0d25d3b /manifests/firewall.pp | |
parent | 9b22f9f4ddfd511d19f3e34d7be70092a79d18d7 (diff) |
Implement firewalling in tripleo::firewall
Currently firewalling is implemented in tripleo/init.pp this commit
moves it to its own scope tripleo/firewall.pp.
This is done so that in tripleo-heat-templates we can have a simple and
generic `include tripleo::firewall` in every manifest - unconditional.
The rest of the behavior will all be managed by hiera.
If a user wants to enable firewalling:
```
tripleo::firewall::manage_firewall: true
```
If a user wants to specify firewall rules:
```
tripleo::firewall::firewall_rules:
'103 mongod':
port: 27017
```
Change-Id: I144c60db2a568a94dce5b51257f1d10980173325
Diffstat (limited to 'manifests/firewall.pp')
-rw-r--r-- | manifests/firewall.pp | 91 |
1 files changed, 91 insertions, 0 deletions
diff --git a/manifests/firewall.pp b/manifests/firewall.pp new file mode 100644 index 0000000..7698881 --- /dev/null +++ b/manifests/firewall.pp @@ -0,0 +1,91 @@ +# +# Copyright (C) 2015 eNovance SAS <licensing@enovance.com> +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Class: tripleo +# +# Configure the TripleO firewall +# +# === Parameters: +# +# [*manage_firewall*] +# (optional) Completely enable or disable firewall settings +# (false means disabled, and true means enabled) +# Defaults to false +# +# [*firewall_rules*] +# (optional) Allow to add custom firewall rules +# Should be an hash. +# Default to {} +# +# [*purge_firewall_rules*] +# (optional) Boolean, purge all firewall resources +# Defaults to false +# +# [*firewall_pre_extras*] +# (optional) Allow to add custom parameters to firewall rules (pre stage) +# Should be an hash. +# Default to {} +# +# [*firewall_post_extras*] +# (optional) Allow to add custom parameters to firewall rules (post stage) +# Should be an hash. +# Default to {} +# +class tripleo::firewall( + $manage_firewall = false, + $firewall_rules = {}, + $purge_firewall_rules = false, + $firewall_pre_extras = {}, + $firewall_post_extras = {}, +) { + + include ::stdlib + + if $manage_firewall { + + # Only purges IPv4 rules + if $purge_firewall_rules { + resources { 'firewall': + purge => true + } + } + + # anyone can add your own rules + # example with Hiera: + # + # tripleo::firewall::rules: + # '300 allow custom application 1': + # port: 999 + # proto: udp + # action: accept + # '301 allow custom application 2': + # port: 8081 + # proto: tcp + # action: accept + # + create_resources('tripleo::firewall::rule', $firewall_rules) + + ensure_resource('class', 'tripleo::firewall::pre', { + 'firewall_settings' => $firewall_pre_extras, + 'stage' => 'setup', + }) + + ensure_resource('class', 'tripleo::firewall::post', { + 'stage' => 'runtime', + 'firewall_settings' => $firewall_post_extras, + }) + } + +} |