Duplicates in /etc/sysconfig/iptable

[Harald Jensås]

Since changes[1] merged we get duplicate entries in /etc/sysconfig/iptables

The reason is that the sed command used to modify the file will print every line containing '-m comment --comment'.

We probably want to change these to:
/bin/sed -i "/-m comment --comment.*ironic-inspector/p;/ironic-inspector/d

                                  ^^ anything and then 'ironic-inspector' string as well.

https://review.openstack.org/#/q/topic:bug/1765700+(status:open+OR+status:merged)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/568351

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/568352

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/568351
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=cafb998f9ed0375fc856913d0223da86197d09be
Submitter: Zuul
Branch: master

commit cafb998f9ed0375fc856913d0223da86197d09be
Author: Harald Jensås <email address hidden>
Date: Mon May 14 20:38:18 2018 +0200

    Fix duplicate entries in /etc/sysconfig/iptables

    Commit 94ca328e5d309a5617043b2944e65df79271e0cd
    introduced filters for ephemeral firewall rules
    managed by Ironic Inspectors iptables PXE filter.
    These new filters cause duplicate entries in the
    persisted firewall rules.

    sed expression '/-m comment --comment/p' was used
    to ensure the ironic-inspector api port is not
    accidentally removed. But the expression also
    matches several other entries causing duplicates
    to be written.

    This change enhances the expression to check for
    '-m comment --comment' and 'ironic-inspector'.

    Closes-Bug: #1771128
    Change-Id: I0a75a7aff9b1a0afbad63e4b6b5159f4351c7ee8

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/570673

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/568352
Committed: https://git.openstack.org/cgit/openstack/instack-undercloud/commit/?id=4366fa8b1411c57e0c37a86f078e958d05fc8b51
Submitter: Zuul
Branch: master

commit 4366fa8b1411c57e0c37a86f078e958d05fc8b51
Author: Harald Jensås <email address hidden>
Date: Mon May 14 20:51:12 2018 +0200

    Fix duplicate entries in /etc/sysconfig/iptables

    Commit e49688be9844b9ae32e14747ad95a07be0fa142c
    introduced filters for ephemeral firewall rules
    managed by Ironic Inspectors iptables PXE filter.
    These new filters cause duplicate entries in the
    persisted firewall rules.

    sed expression '/-m comment --comment/p' was used
    to ensure the ironic-inspector api port is not
    accidentally removed. But the expression also
    matches several other entries causing duplicates
    to be written.

    This change enhances the expression to check for
    '-m comment --comment' and 'ironic-inspector'.

    Related-Bug: #1771128
    Change-Id: I6ac397e786f66e33c523edb94613181040c15f19

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/570673
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=d255260b225a52a8042b2200b6578714c4648ed4
Submitter: Zuul
Branch: stable/queens

commit d255260b225a52a8042b2200b6578714c4648ed4
Author: Harald Jensås <email address hidden>
Date: Mon May 14 20:38:18 2018 +0200

    Fix duplicate entries in /etc/sysconfig/iptables

    Commit 94ca328e5d309a5617043b2944e65df79271e0cd
    introduced filters for ephemeral firewall rules
    managed by Ironic Inspectors iptables PXE filter.
    These new filters cause duplicate entries in the
    persisted firewall rules.

    sed expression '/-m comment --comment/p' was used
    to ensure the ironic-inspector api port is not
    accidentally removed. But the expression also
    matches several other entries causing duplicates
    to be written.

    This change enhances the expression to check for
    '-m comment --comment' and 'ironic-inspector'.

    Closes-Bug: #1771128
    Change-Id: I0a75a7aff9b1a0afbad63e4b6b5159f4351c7ee8
    (cherry picked from commit cafb998f9ed0375fc856913d0223da86197d09be)

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/queens
Review: https://review.openstack.org/571222

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 9.1.0 release.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/571222
Committed: https://git.openstack.org/cgit/openstack/instack-undercloud/commit/?id=89f960cde2fd0b34c480befbd1a1b03fdf5eae20
Submitter: Zuul
Branch: stable/queens

commit 89f960cde2fd0b34c480befbd1a1b03fdf5eae20
Author: Harald Jensås <email address hidden>
Date: Mon May 14 20:51:12 2018 +0200

    Fix duplicate entries in /etc/sysconfig/iptables

    Commit e49688be9844b9ae32e14747ad95a07be0fa142c
    introduced filters for ephemeral firewall rules
    managed by Ironic Inspectors iptables PXE filter.
    These new filters cause duplicate entries in the
    persisted firewall rules.

    sed expression '/-m comment --comment/p' was used
    to ensure the ironic-inspector api port is not
    accidentally removed. But the expression also
    matches several other entries causing duplicates
    to be written.

    This change enhances the expression to check for
    '-m comment --comment' and 'ironic-inspector'.

    Related-Bug: #1771128
    Change-Id: I6ac397e786f66e33c523edb94613181040c15f19
    (cherry picked from commit 4366fa8b1411c57e0c37a86f078e958d05fc8b51)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 8.3.4 release.