Add firewall::service_rules define
This patch updates the tripleo::firewall class so that it will support loading firewall rules defined in composable services via the following hiera keys (for nova-api for example): tripleo.nova_api.firewall_rules This patch relies on a new 'service_names' hiera array that should be provided on all TripleO overcloud nodes. Depends-On: I60861c5aa760534db3e314bba16a13b90ea72f0c Change-Id: Id370362ab57347b75b1ab25afda877885b047263
This commit is contained in:
parent
e2fe8ce799
commit
5881826559
|
@ -86,6 +86,24 @@ class tripleo::firewall(
|
|||
'stage' => 'runtime',
|
||||
'firewall_settings' => $firewall_post_extras,
|
||||
})
|
||||
|
||||
# Allow composable services to load their own custom
|
||||
# example with Hiera.
|
||||
# NOTE(dprince): In the future when we have a better hiera
|
||||
# heat hook we might refactor this to use hiera's merging
|
||||
# capabilities instead. Until then rolling up the flat service
|
||||
# keys and dynamically creating firewall rules for each service
|
||||
# will allow us to compose and should work fine.
|
||||
#
|
||||
# Each service can load its rules by using this form:
|
||||
#
|
||||
# tripleo.<service name with underscores>.firewall_rules:
|
||||
# '300 allow custom application 1':
|
||||
# dport: 999
|
||||
# proto: udp
|
||||
# action: accept
|
||||
$service_names = reject(hiera('service_names', []), '^$')
|
||||
tripleo::firewall::service_rules { $service_names: }
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
@ -0,0 +1,38 @@
|
|||
# Copyright 2016 Red Hat, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
#
|
||||
# == Define: tripleo::firewall::service_rules
|
||||
#
|
||||
# Define used to create firewall rules for composable services.
|
||||
#
|
||||
# === Parameters:
|
||||
#
|
||||
# [*service_name*]
|
||||
# (optional) The service_name to load firewall rules for.
|
||||
# Defaults to $title
|
||||
#
|
||||
define tripleo::firewall::service_rules ($service_name = $title) {
|
||||
|
||||
$underscore_name = regsubst($service_name, '-', '_')
|
||||
|
||||
# This allows each composable service to load its own custom rules by
|
||||
# creating its own flat hiera key named:
|
||||
# tripleo.<service name with underscores>.firewall_rules
|
||||
$service_firewall_rules = hiera("tripleo.${underscore_name}.firewall_rules", {})
|
||||
|
||||
if !empty($service_firewall_rules) {
|
||||
create_resources('tripleo::firewall::rule', $service_firewall_rules)
|
||||
}
|
||||
|
||||
}
|
Loading…
Reference in New Issue