As iptables-services injects default rules, we must ensure,
upon upgrade, that none of those unmanaged rules are present
in the firewall, nor in the iptables saved state.
We cannot remove them with puppet nor ansible due to the following
reasons:
- puppetlabs-firewall, the puppet module used in TripleO, manages
the firewall resources with comments - the comment value is the
name of the puppet resource. As the default rules have no comment,
puppet doesn't "see" them as managed resources, and can't affect
them.
- we can't simply "flush" all the rules and reapply them, because
puppet does not manage all the rules - some are managed by neutron,
for example.
- ansible "iptables" module doesn't make a full match of the chain,
and might drop the unwanted ones, keeping the unmanaged in place.
Also, it doesn't take care of the saved state.
SecurityImpact
Related: https://bugzilla.redhat.com/show_bug.cgi?id=1667887
Closes-Bug: #1812695
Change-Id: I59733cb9a0323bbce4e20838a78103a70ec0d426
65041ed9d8