iptables rules are missing from haproxy when horizon is split off to separate role

[Michele Baldessari]

This should have been fixed via:
https://review.openstack.org/#/c/460175/2

where we did:
service_config_settings:
  haproxy:
    tripleo.horizon.firewall_rules:
     '127 horizon':
        dport:
          - 80
          - 443

The problem is that the above does not work. Reason for this is the way tripleo::firewall works.
It will only apply iptables rules for that show up in hiera('service_names'):
    $service_names = hiera('service_names', [])
    tripleo::firewall::service_rules { $service_names: }

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/625258

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/625258
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=3114300c9cd922998d426e4d33269a9fc96630c0
Submitter: Zuul
Branch: master

commit 3114300c9cd922998d426e4d33269a9fc96630c0
Author: Michele Baldessari <email address hidden>
Date: Fri Dec 14 14:40:08 2018 +0100

    Fix horizon's iptables rules for haproxy when split off a separate role

    This should have been fixed via:
    https://review.openstack.org/#/c/460175/2

    where we did:
    service_config_settings:
      haproxy:
        tripleo.horizon.firewall_rules:
         '127 horizon':
            dport:
              - 80
              - 443

    The problem is that the above does not work. Reason for this is the way
    tripleo::firewall works. It will only apply iptables rules for that
    show up in hiera('service_names'):
        $service_names = hiera('service_names', [])
        tripleo::firewall::service_rules { $service_names: }

    And since horizon is not in the service running on the haproxy role, the
    above rule would never have been created.

    Tested this change and now I correctly get the iptables rules on the
    haproxy role for horizon:
    [root@overcloud-core-0 ~]# iptables -nvL |grep horizon
        0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443 state NEW /* 127 horizon ipv4 */
    [root@overcloud-core-0 ~]# hiera -c /etc/puppet/hiera.yaml service_names |grep horizon
    [root@overcloud-core-0 ~]#

    Closes-Bug: #1808530

    Change-Id: Ia4a795d1a7fb926f5900c739c1932b20d81ed7fc
    Co-Authored-By: Damien Ciabrini <email address hidden>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.openstack.org/625598

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/625600

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/625598
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=e770e364fb0840d1f192530af8ec453f118327eb
Submitter: Zuul
Branch: stable/rocky

commit e770e364fb0840d1f192530af8ec453f118327eb
Author: Michele Baldessari <email address hidden>
Date: Fri Dec 14 14:40:08 2018 +0100

    Fix horizon's iptables rules for haproxy when split off a separate role

    This should have been fixed via:
    https://review.openstack.org/#/c/460175/2

    where we did:
    service_config_settings:
      haproxy:
        tripleo.horizon.firewall_rules:
         '127 horizon':
            dport:
              - 80
              - 443

    The problem is that the above does not work. Reason for this is the way
    tripleo::firewall works. It will only apply iptables rules for that
    show up in hiera('service_names'):
        $service_names = hiera('service_names', [])
        tripleo::firewall::service_rules { $service_names: }

    And since horizon is not in the service running on the haproxy role, the
    above rule would never have been created.

    Tested this change and now I correctly get the iptables rules on the
    haproxy role for horizon:
    [root@overcloud-core-0 ~]# iptables -nvL |grep horizon
        0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443 state NEW /* 127 horizon ipv4 */
    [root@overcloud-core-0 ~]# hiera -c /etc/puppet/hiera.yaml service_names |grep horizon
    [root@overcloud-core-0 ~]#

    Closes-Bug: #1808530

    Change-Id: Ia4a795d1a7fb926f5900c739c1932b20d81ed7fc
    Co-Authored-By: Damien Ciabrini <email address hidden>
    (cherry picked from commit 3114300c9cd922998d426e4d33269a9fc96630c0)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/625600
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=3f8ce6fd96bc4f28a052b4c87a19b4b152734091
Submitter: Zuul
Branch: stable/queens

commit 3f8ce6fd96bc4f28a052b4c87a19b4b152734091
Author: Michele Baldessari <email address hidden>
Date: Fri Dec 14 14:40:08 2018 +0100

    Fix horizon's iptables rules for haproxy when split off a separate role

    This should have been fixed via:
    https://review.openstack.org/#/c/460175/2

    where we did:
    service_config_settings:
      haproxy:
        tripleo.horizon.firewall_rules:
         '127 horizon':
            dport:
              - 80
              - 443

    The problem is that the above does not work. Reason for this is the way
    tripleo::firewall works. It will only apply iptables rules for that
    show up in hiera('service_names'):
        $service_names = hiera('service_names', [])
        tripleo::firewall::service_rules { $service_names: }

    And since horizon is not in the service running on the haproxy role, the
    above rule would never have been created.

    Tested this change and now I correctly get the iptables rules on the
    haproxy role for horizon:
    [root@overcloud-core-0 ~]# iptables -nvL |grep horizon
        0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443 state NEW /* 127 horizon ipv4 */
    [root@overcloud-core-0 ~]# hiera -c /etc/puppet/hiera.yaml service_names |grep horizon
    [root@overcloud-core-0 ~]#

    Closes-Bug: #1808530

    Change-Id: Ia4a795d1a7fb926f5900c739c1932b20d81ed7fc
    Co-Authored-By: Damien Ciabrini <email address hidden>
    (cherry picked from commit 3114300c9cd922998d426e4d33269a9fc96630c0)
    (cherry picked from commit e770e364fb0840d1f192530af8ec453f118327eb)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 9.2.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 10.3.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 8.3.0 release.