Comment 4 for bug 1812695

Reviewed: https://review.openstack.org/634403
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=65041ed9d8618cf3762d6d1a811e98fe69cb1ce9
Submitter: Zuul
Branch: master

commit 65041ed9d8618cf3762d6d1a811e98fe69cb1ce9
Author: Cédric Jeanneret <email address hidden>
Date: Fri Feb 1 10:02:20 2019 +0100

    Clean unmanaged rules pushed by iptables-services package

    As iptables-services injects default rules, we must ensure,
    upon upgrade, that none of those unmanaged rules are present
    in the firewall, nor in the iptables saved state.

    We cannot remove them with puppet nor ansible due to the following
    reasons:

    - puppetlabs-firewall, the puppet module used in TripleO, manages
      the firewall resources with comments - the comment value is the
      name of the puppet resource. As the default rules have no comment,
      puppet doesn't "see" them as managed resources, and can't affect
      them.

    - we can't simply "flush" all the rules and reapply them, because
      puppet does not manage all the rules - some are managed by neutron,
      for example.

    - ansible "iptables" module doesn't make a full match of the chain,
      and might drop the unwanted ones, keeping the unmanaged in place.
      Also, it doesn't take care of the saved state.

    SecurityImpact
    Related: https://bugzilla.redhat.com/show_bug.cgi?id=1667887
    Closes-Bug: #1812695
    Change-Id: I59733cb9a0323bbce4e20838a78103a70ec0d426