65041ed9d8
As iptables-services injects default rules, we must ensure, upon upgrade, that none of those unmanaged rules are present in the firewall, nor in the iptables saved state. We cannot remove them with puppet nor ansible due to the following reasons: - puppetlabs-firewall, the puppet module used in TripleO, manages the firewall resources with comments - the comment value is the name of the puppet resource. As the default rules have no comment, puppet doesn't "see" them as managed resources, and can't affect them. - we can't simply "flush" all the rules and reapply them, because puppet does not manage all the rules - some are managed by neutron, for example. - ansible "iptables" module doesn't make a full match of the chain, and might drop the unwanted ones, keeping the unmanaged in place. Also, it doesn't take care of the saved state. SecurityImpact Related: https://bugzilla.redhat.com/show_bug.cgi?id=1667887 Closes-Bug: #1812695 Change-Id: I59733cb9a0323bbce4e20838a78103a70ec0d426 |
||
|---|---|---|
| .. | ||
| aodh | ||
| cinder | ||
| database | ||
| docker | ||
| etcd | ||
| glance | ||
| haproxy | ||
| heat | ||
| ironic | ||
| iscsid | ||
| keepalived | ||
| kernel | ||
| keystone | ||
| login-defs | ||
| memcached | ||
| mistral | ||
| multipathd | ||
| podman | ||
| sahara | ||
| securetty | ||
| selinux | ||
| snmp | ||
| sshd | ||
| time | ||
| timesync | ||
| tripleo-firewall | ||
| tripleo-packages | ||
| tuned | ||
| zaqar | ||
| README.rst | ||
README.rst
TripleO Deployments
This directory contains files that represent individual service deployments, orchestration tools, and the configuration tools used to deploy them.
Directory Structure
Each logical grouping of services will have a directory. Example: 'timesync'. Within this directory related timesync services would exist to for example configure timesync services on baremetal or via containers.
Filenaming conventions
As a convention each deployments service filename will reflect both the deployment engine (baremetal, or containers) along with the config tool used to deploy that service.
The convention is <service-name>-<engine>-<config management tool>.
Examples:
deployment/aodh/aodh-api-container-puppet.yaml (containerized Aodh service configured with Puppet)
deployment/aodh/aodh-api-container-ansible.yaml (containerized Aodh service configured with Ansible)
deployment/timesync/chrony-baremetal-ansible.yaml (baremetal Chrony service configured with Ansible)
deployment/timesync/chrony-baremetal-puppet.yaml (baremetal Chrony service configured with Puppet)