From 50f160a148b6a973891ffc6d0882f4c0d597336e Mon Sep 17 00:00:00 2001
From: Damien Ciabrini <dciabrin@redhat.com>
Date: Thu, 20 Jul 2017 11:48:22 -0400
Subject: Prevent haproxy to run iptables during docker-puppet configuration

When docker-puppet runs module tripleo::haproxy to generate haproxy
configuration file, and tripleo::firewall::manage_firewall is true,
iptables is called to set up firewall rules for the proxied services
and fails due to lack of NET_ADMIN capability.

Make the generation of firewall rule configurable by exposing a
new argument to the puppet module. That way, firewall management can
be temporarily disabled when being run through docker-puppet.

Change-Id: I2d6274d061039a9793ad162ed8e750bd87bf71e9
Partial-Bug: #1697921
---
 manifests/profile/base/haproxy.pp      |  7 +++++++
 manifests/profile/pacemaker/haproxy.pp | 10 +++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

(limited to 'manifests/profile')

diff --git a/manifests/profile/base/haproxy.pp b/manifests/profile/base/haproxy.pp
index 4f3322c..145f283 100644
--- a/manifests/profile/base/haproxy.pp
+++ b/manifests/profile/base/haproxy.pp
@@ -36,6 +36,11 @@
 #   (Optional) Whether or not loadbalancer is enabled.
 #   Defaults to hiera('enable_load_balancer', true).
 #
+# [*manage_firewall*]
+#  (optional) Enable or disable firewall settings for ports exposed by HAProxy
+#  (false means disabled, and true means enabled)
+#  Defaults to hiera('tripleo::firewall::manage_firewall', true)
+#
 # [*step*]
 #   (Optional) The current step in deployment. See tripleo-heat-templates
 #   for more details.
@@ -44,12 +49,14 @@
 class tripleo::profile::base::haproxy (
   $certificates_specs            = {},
   $enable_load_balancer          = hiera('enable_load_balancer', true),
+  $manage_firewall               = hiera('tripleo::firewall::manage_firewall', true),
   $step                          = Integer(hiera('step')),
 ) {
   if $step >= 1 {
     if $enable_load_balancer {
       class {'::tripleo::haproxy':
         internal_certificates_specs => $certificates_specs,
+        manage_firewall             => $manage_firewall,
       }
 
       unless hiera('tripleo::haproxy::haproxy_service_manage', true) {
diff --git a/manifests/profile/pacemaker/haproxy.pp b/manifests/profile/pacemaker/haproxy.pp
index 7331071..5198243 100644
--- a/manifests/profile/pacemaker/haproxy.pp
+++ b/manifests/profile/pacemaker/haproxy.pp
@@ -26,6 +26,11 @@
 #   (Optional) Whether load balancing is enabled for this cluster
 #   Defaults to hiera('enable_load_balancer', true)
 #
+# [*manage_firewall*]
+#  (optional) Enable or disable firewall settings for ports exposed by HAProxy
+#  (false means disabled, and true means enabled)
+#  Defaults to hiera('tripleo::firewall::manage_firewall', true)
+#
 # [*step*]
 #   (Optional) The current step in deployment. See tripleo-heat-templates
 #   for more details.
@@ -38,10 +43,13 @@
 class tripleo::profile::pacemaker::haproxy (
   $bootstrap_node       = hiera('haproxy_short_bootstrap_node_name'),
   $enable_load_balancer = hiera('enable_load_balancer', true),
+  $manage_firewall      = hiera('tripleo::firewall::manage_firewall', true),
   $step                 = Integer(hiera('step')),
   $pcs_tries            = hiera('pcs_tries', 20),
 ) {
-  include ::tripleo::profile::base::haproxy
+  class {'::tripleo::profile::base::haproxy':
+    manage_firewall => $manage_firewall,
+  }
 
   if $::hostname == downcase($bootstrap_node) {
     $pacemaker_master = true
-- 
cgit 1.2.3-korg