5d51ff6dd7
A problem may occur if puppet attempts to inject a firewall rule while the underlying iptables/ip6tables has existing rules which use the --random-fully flag in the NAT table. The issue occurs because puppet-firewall first makes a call to iptables-save/ip6tables-save to parse the existing rules (to determine if the rule already exists). If it finds a rule with --random-fully, it will immediately bail out. The current version(s) of puppet-firewall in StarlingX are old enough that they don't have parsing logic for the --random-fully flag that was initially supported in iptables version 1.6.2+. Now that StarlingX uses iptables 1.8.4, we must account for the possibility that various components (ie. kubernetes) will make use of --random-fully rules. This feature has been implemented upstream in the following commits: https://github.com/puppetlabs/puppetlabs-firewall/commits/ 9a4bc6a81cf0cd4a56ba458fadac830a2c4df529 0ea2b74c0b4a451a37bae8c2ff105b72481ab485 The above commits have been ported back to: CentOS: puppet-firewall-1.8.2 Debian: puppetlabs-firewall-1.12.0 Since StarlingX does not currently build it's own version of puppet-firewall in either CentOS or Debian, this commit also contains the infrastructure to do so. Testing: Note: Since the issue is intermittent on unlock, the functional tests were performed with a custom runtime manifest that installed a dummy iptables/ip6tables rule when an interface was modified. At this time, it was guaranteed that there were rules with the --random-fully flag present. CentOS: Package build: PASS Present in iso: PASS IPv4 functional test (iptables): PASS IPv6 functional test (ip6tables): PASS Debian: Package build: PASS Present in iso: PASS IPv4 functional test (iptables): PASS IPv6 functional test (ip6tables): PASS Closes-Bug: #1971900 Signed-off-by: Steven Webster <steven.webster@windriver.com> Change-Id: I7dbb9e1b99d95df0aa5a7db7aa22c3c314253788
78 lines
2.1 KiB
Plaintext
78 lines
2.1 KiB
Plaintext
base/base-passwd
|
|
base/cluster-resource-agents
|
|
base/dhcp
|
|
base/dnsmasq
|
|
base/haproxy
|
|
base/libfdt
|
|
base/lighttpd
|
|
base/linuxptp
|
|
base/lsb
|
|
base/pf-bb-config
|
|
base/systemd
|
|
base/watchdog
|
|
centos-debian-compat
|
|
ceph/ceph
|
|
config/facter
|
|
config/puppet-5.5.22
|
|
config/puppet-modules/openstack/puppet-ceph-2.4.1
|
|
config/puppet-modules/openstack/puppet-keystone-17.4.0
|
|
config/puppet-modules/openstack/puppet-openstacklib-17.4.0
|
|
config/puppet-modules/openstack/puppet-oslo-17.4.0
|
|
config/puppet-modules/puppet-boolean-2.0.2
|
|
config/puppet-modules/puppet-dnsmasq
|
|
config/puppet-modules/puppet-drbd-0.5.2
|
|
config/puppet-modules/puppet-etcd-1.12.3
|
|
config/puppet-modules/puppetlabs-firewall-1.12.0
|
|
config/puppet-modules/puppetlabs-haproxy-2.1.0
|
|
config/puppet-modules/puppetlabs-postgresql-6.7.0
|
|
config/puppet-modules/puppetlabs-stdlib-5.0.0
|
|
config/puppet-modules/puppet-ldap
|
|
config/puppet-modules/puppet-lvm-1.4.0
|
|
config/puppet-modules/puppet-network
|
|
config/puppet-modules/puppet-nslcd
|
|
config/puppet-modules/puppet-puppi
|
|
config/puppet-modules/puppet-rabbitmq-8.5.0
|
|
config/puppet-modules/puppet-staging
|
|
docker/python-docker
|
|
filesystem/drbd/drbd-tools
|
|
filesystem/parted
|
|
golang-github-dev/golang-github-appc-cni
|
|
golang-github-dev/golang-github-checkpoint-restore-go-criu-dev
|
|
golang-github-dev/golang-github-cilium-ebpf-dev
|
|
golang-github-dev/golang-github-coreos-go-systemd-dev
|
|
golang-github-dev/golang-github-opencontainers-specs-dev
|
|
golang-github-dev/golang-github-vishvananda-netlink
|
|
grub/grub2
|
|
grub/grubby
|
|
kubernetes/armada
|
|
kubernetes/armada-helm-toolkit
|
|
kubernetes/chartmuseum
|
|
kubernetes/cni/bond-cni
|
|
kubernetes/cni/plugins
|
|
kubernetes/containerd
|
|
kubernetes/crictl
|
|
kubernetes/docker-distribution
|
|
kubernetes/etcd
|
|
kubernetes/helm
|
|
kubernetes/k8s-pod-recovery
|
|
kubernetes/kubernetes-1.21.8
|
|
kubernetes/kubernetes-unversioned
|
|
kubernetes/plugins/isolcpus-device-plugin
|
|
kubernetes/runc
|
|
ldap/ldapscripts
|
|
ldap/openldap
|
|
livepatch/kpatch
|
|
networking/lldpd
|
|
networking/net-tools
|
|
ostree/initramfs-ostree
|
|
ostree/mttyexec
|
|
ostree/ostree
|
|
ostree/ostree-upgrade-mgr
|
|
python/dh-python
|
|
python/python-nss
|
|
python/python3-setuptools
|
|
security/keyrings.alt
|
|
security/python-keyring
|
|
security/shim-unsigned
|
|
storage-drivers/trident-installer
|