Browse Source

Merge "Revert "[train/backport] Prevent nftables to interfere with tripleo firewall"" into stable/train

changes/11/741011/3
Zuul 2 months ago
committed by Gerrit Code Review
parent
commit
a8c4160ec5
1 changed files with 10 additions and 29 deletions
  1. +10
    -29
      deployment/tripleo-firewall/tripleo-firewall-baremetal-puppet.yaml

+ 10
- 29
deployment/tripleo-firewall/tripleo-firewall-baremetal-puppet.yaml View File

@@ -68,35 +68,16 @@ outputs:
include ::tripleo::firewall

host_prep_tasks:
list_concat:
- - name: Prevent Nftables to set up any rules
copy:
dest: /etc/sysconfig/nftables.conf
content: |
# This file has been explicitely emptied and disabled by TripleO
# so that nftables and iptables do not race each other
register: nftablesconf
- when: nftablesconf is changed
block:
- name: Flush Nftables rules when nftables.conf changed
shell: if [[ -x /usr/sbin/nft ]]; then /usr/sbin/nft flush ruleset; fi
- name: Restart iptables to restore firewall after flushing nftables
systemd:
state: reloaded
name: "{{item}}"
loop:
- iptables.service
- ip6tables.service
- if:
- no_ctlplane
- -
name: Ensure ctlplane subnet is set
fail:
msg: |
No CIDRs found in the ctlplane network tags.
Please refer to the documentation in order to
set the correct network tags in DeployedServerPortMap.
- null
if:
- no_ctlplane
-
name: Ensure ctlplane subnet is set
fail:
msg: |
No CIDRs found in the ctlplane network tags.
Please refer to the documentation in order to
set the correct network tags in DeployedServerPortMap.
- null

deploy_steps_tasks:
- when: step|int == 0


Loading…
Cancel
Save