diff options
author | Dan Prince <dprince@redhat.com> | 2016-07-20 10:05:47 -0400 |
---|---|---|
committer | Emilien Macchi <emilien@redhat.com> | 2016-07-21 17:35:13 +0000 |
commit | 5881826559a01b987348b273877e4ebc1e748d22 (patch) | |
tree | cfc2950a0e2518f48c3b3caf4332f53f42f88e22 /manifests/firewall.pp | |
parent | e2fe8ce79906c105e793752df8f32560fbce602c (diff) |
Add firewall::service_rules define
This patch updates the tripleo::firewall class so that it will
support loading firewall rules defined in composable services
via the following hiera keys (for nova-api for example):
tripleo.nova_api.firewall_rules
This patch relies on a new 'service_names' hiera array that should be
provided on all TripleO overcloud nodes.
Depends-On: I60861c5aa760534db3e314bba16a13b90ea72f0c
Change-Id: Id370362ab57347b75b1ab25afda877885b047263
Diffstat (limited to 'manifests/firewall.pp')
-rw-r--r-- | manifests/firewall.pp | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/manifests/firewall.pp b/manifests/firewall.pp index 7698881..edcb5e7 100644 --- a/manifests/firewall.pp +++ b/manifests/firewall.pp @@ -86,6 +86,24 @@ class tripleo::firewall( 'stage' => 'runtime', 'firewall_settings' => $firewall_post_extras, }) + + # Allow composable services to load their own custom + # example with Hiera. + # NOTE(dprince): In the future when we have a better hiera + # heat hook we might refactor this to use hiera's merging + # capabilities instead. Until then rolling up the flat service + # keys and dynamically creating firewall rules for each service + # will allow us to compose and should work fine. + # + # Each service can load its rules by using this form: + # + # tripleo.<service name with underscores>.firewall_rules: + # '300 allow custom application 1': + # dport: 999 + # proto: udp + # action: accept + $service_names = reject(hiera('service_names', []), '^$') + tripleo::firewall::service_rules { $service_names: } } } |