iptables is dropping rules on package update.

[Sofer Athlan-Guyot]

Hi,

originally reported there https://bugzilla.redhat.com/show_bug.cgi?id=1544211

When performing a yum update on iptables, i saw my rules being dropped after the update, causing a service disruption on my deployment.

It appears that at least iptables-services-1.4.21-18.0.1.el7.centos.x86_64 has a faulty postuninstal script where it stop the everything and thus drop the current rules which causes disruption in the network.

No clean backport can be done to newton as the upgrade process has changed a lot, so a specify newton patch will be needed.

This as potentially affecting all version of tripleo.

[Sofer Athlan-Guyot (sofer-athlan-guyot)]

For newton https://review.openstack.org/#/c/554647/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/554647
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=19e25fe2fdba56300d69f66067a90d4910eb9410
Submitter: Zuul
Branch: stable/newton

commit 19e25fe2fdba56300d69f66067a90d4910eb9410
Author: Sofer Athlan-Guyot <email address hidden>
Date: Tue Mar 20 18:53:54 2018 +0100

    Work around packaging issue in iptables-services.

    When iptables-services is upgraded it restarts the iptables services
    which breaks connectivity because it looses the current iptables
    rules.

    So we add another network workaround. This time around the
    iptables-services package.

    The first target is the update process as this is where the problem
    should arise, but as the framework for network workaround is already
    is place, we cover upgrade as well.

    Partial-Bug: #1758291

    Change-Id: Ia2f94058bac6cf28b4bd425385ffd629555c9609