aboutsummaryrefslogtreecommitdiffstats
path: root/manifests/firewall.pp
diff options
context:
space:
mode:
authorDan Prince <dprince@redhat.com>2016-07-20 10:05:47 -0400
committerEmilien Macchi <emilien@redhat.com>2016-07-21 17:35:13 +0000
commit5881826559a01b987348b273877e4ebc1e748d22 (patch)
treecfc2950a0e2518f48c3b3caf4332f53f42f88e22 /manifests/firewall.pp
parente2fe8ce79906c105e793752df8f32560fbce602c (diff)
Add firewall::service_rules define
This patch updates the tripleo::firewall class so that it will support loading firewall rules defined in composable services via the following hiera keys (for nova-api for example): tripleo.nova_api.firewall_rules This patch relies on a new 'service_names' hiera array that should be provided on all TripleO overcloud nodes. Depends-On: I60861c5aa760534db3e314bba16a13b90ea72f0c Change-Id: Id370362ab57347b75b1ab25afda877885b047263
Diffstat (limited to 'manifests/firewall.pp')
-rw-r--r--manifests/firewall.pp18
1 files changed, 18 insertions, 0 deletions
diff --git a/manifests/firewall.pp b/manifests/firewall.pp
index 7698881..edcb5e7 100644
--- a/manifests/firewall.pp
+++ b/manifests/firewall.pp
@@ -86,6 +86,24 @@ class tripleo::firewall(
'stage' => 'runtime',
'firewall_settings' => $firewall_post_extras,
})
+
+ # Allow composable services to load their own custom
+ # example with Hiera.
+ # NOTE(dprince): In the future when we have a better hiera
+ # heat hook we might refactor this to use hiera's merging
+ # capabilities instead. Until then rolling up the flat service
+ # keys and dynamically creating firewall rules for each service
+ # will allow us to compose and should work fine.
+ #
+ # Each service can load its rules by using this form:
+ #
+ # tripleo.<service name with underscores>.firewall_rules:
+ # '300 allow custom application 1':
+ # dport: 999
+ # proto: udp
+ # action: accept
+ $service_names = reject(hiera('service_names', []), '^$')
+ tripleo::firewall::service_rules { $service_names: }
}
}