diff options
| -rw-r--r-- | manifests/firewall.pp | 18 | ||||
| -rw-r--r-- | manifests/firewall/service_rules.pp | 38 |
2 files changed, 56 insertions, 0 deletions
diff --git a/manifests/firewall.pp b/manifests/firewall.pp index 7698881..edcb5e7 100644 --- a/manifests/firewall.pp +++ b/manifests/firewall.pp @@ -86,6 +86,24 @@ class tripleo::firewall( 'stage' => 'runtime', 'firewall_settings' => $firewall_post_extras, }) + + # Allow composable services to load their own custom + # example with Hiera. + # NOTE(dprince): In the future when we have a better hiera + # heat hook we might refactor this to use hiera's merging + # capabilities instead. Until then rolling up the flat service + # keys and dynamically creating firewall rules for each service + # will allow us to compose and should work fine. + # + # Each service can load its rules by using this form: + # + # tripleo.<service name with underscores>.firewall_rules: + # '300 allow custom application 1': + # dport: 999 + # proto: udp + # action: accept + $service_names = reject(hiera('service_names', []), '^$') + tripleo::firewall::service_rules { $service_names: } } } diff --git a/manifests/firewall/service_rules.pp b/manifests/firewall/service_rules.pp new file mode 100644 index 0000000..4739f16 --- /dev/null +++ b/manifests/firewall/service_rules.pp @@ -0,0 +1,38 @@ +# Copyright 2016 Red Hat, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# == Define: tripleo::firewall::service_rules +# +# Define used to create firewall rules for composable services. +# +# === Parameters: +# +# [*service_name*] +# (optional) The service_name to load firewall rules for. +# Defaults to $title +# +define tripleo::firewall::service_rules ($service_name = $title) { + + $underscore_name = regsubst($service_name, '-', '_') + + # This allows each composable service to load its own custom rules by + # creating its own flat hiera key named: + # tripleo.<service name with underscores>.firewall_rules + $service_firewall_rules = hiera("tripleo.${underscore_name}.firewall_rules", {}) + + if !empty($service_firewall_rules) { + create_resources('tripleo::firewall::rule', $service_firewall_rules) + } + +} |