Wrong iptables rules for keystone ports

[Aleksandr Didenko]

Puppet creates wrong iptables rules for keystone ports, there's only one management network in rule and it's in destination, not in source:

ACCEPT tcp -- 0.0.0.0/0 10.144.2.0/24 multiport ports 5000,35357 /* 102 keystone */

We should change:

firewall {'102 keystone':
  port => [$keystone_public_port, $keystone_admin_port],
  proto => 'tcp',
  action => 'accept',
  destination => get_routable_networks_for_network_role($network_scheme, 'keystone/api'),
}

to

openstack::firewall::multi_net {'102 keystone':
  port => [$keystone_public_port, $keystone_admin_port],
  proto => 'tcp',
  action => 'accept',
  source_nets => get_routable_networks_for_network_role($network_scheme, 'keystone/api'),
}

in firewall.pp task, it's the only rule that was improperly converted to get_routable_networks_for_network_role, others are fine.

Steps to reproduce:
1. Deploy multirack env
2. Check that "102 keystone" iptables rule exist for every management network

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/255823

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/255823
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=c7c085bbc9678306f7fd397d9c6fb1402d8d375e
Submitter: Jenkins
Branch: master

commit c7c085bbc9678306f7fd397d9c6fb1402d8d375e
Author: Aleksandr Didenko <email address hidden>
Date: Thu Dec 10 12:49:55 2015 +0100

    Fix iptables rules for keystone ports

    We should configure ACCEPT rules for all keystone/api networks.

    Closes-bug: #1524751
    Change-Id: I400e2fcd56915a997fecf1c68e9d0a66acb85512

[Tatyanka (tatyana-leontovich)]

verified 509 iso