opendev/system-config
Code Issues Proposed changes

iptables: handle hosts in allowed groups not having an ipv6 address

Browse Source 
The modified section of the rules.v6 template looks at the groups in
the iptables_allowed_groups list and then allows access for each host
specified in that group.

Currently this extracts the 'public_v6' from the hostvars[host]
directly, but this fails if the host in question doesn't actually have
an ipv6 address.

Modify this so we check if the variable exists, and then reference it
via the hostvars dict.  Note that in gate testing, ipv6 may be empty
string (set from nodepool values), while it may not be a value at all
if it is left out of the production inventory.
"hostvars[host]['public_v6'] | default(False)" should catch both
cases.

Change-Id: I90069efc7d72d881ec57670b9c6b426a8a5422a3
This commit is contained in:
Ian Wienand 2023-01-12 13:43:53 +11:00
parent 9344d8c046
commit efa858c58e
No known key found for this signature in database
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
playbooks/roles/iptables/templates/rules.v6.j2
View File

@ -28,9 +28,9 @@
{% endfor -%} {% endfor -%}
{% endfor -%} {% endfor -%}
{% for group in iptables_allowed_groups -%} {% for group in iptables_allowed_groups -%}
{% for addr in groups.get(group.group) | map('extract', hostvars, 'public_v6') -%} {% for host in groups.get(group.group, []) -%}
{% if addr -%} {% if hostvars[host]['public_v6'] | default(False) -%}
-A openstack-INPUT {% if group.protocol == 'tcp' %}-m state --state NEW {% endif %} -m {{ group.protocol }} -p {{ group.protocol }} -s {{ addr }} --dport {{ group.port }} -j ACCEPT -A openstack-INPUT {% if group.protocol == 'tcp' %}-m state --state NEW {% endif %} -m {{ group.protocol }} -p {{ group.protocol }} -s {{ hostvars[host]['public_v6'] }} --dport {{ group.port }} -j ACCEPT
{% endif -%} {% endif -%}
{% endfor -%} {% endfor -%}
{% endfor -%} {% endfor -%}