Not all firewall rules are applied, leading to timeouts

[Emilien Macchi]

It was initially found in the tripleo-ci-centos-7-containers-undercloud-minion CI job which timeouts because MySQL can't be reached.
The reason is the firewall rule for MySQL isn't created anymore on the Undercloud; which seems to happen to all the firewall rules not defined in the main template.

Example: the mysql rules are defined in deployment/database/mysql-base.yaml which later is imported by deployment/database/mysql-container-puppet.yaml. It seems like the current YAQL query can't find the firewall_rules for that service, therefore the rule is missing and some jobs timeout.

[Emilien Macchi (emilienm)]

FTR here is the minion logs, timing out on the db sync (mysql is unreachable due to missing firewall rules): https://6965fd4aef581b711f1e-c46dc4d37fef1869c0d0d51dc6a4d27f.ssl.cf5.rackcdn.com/699505/1/check/tripleo-ci-centos-7-containers-undercloud-minion/eb9c291/logs/subnode-1/var/log/containers/stdouts/heat_engine_db_sync.log.txt.gz

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/699712

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/train
Review: https://review.opendev.org/699866

[OpenStack Infra (hudson-openstack)]

Change abandoned by Emilien Macchi (<email address hidden>) on branch: stable/train
Review: https://review.opendev.org/699866

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/699712
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=7c2fa7b8e916a31218347f3ca6bfd79958fdd2e9
Submitter: Zuul
Branch: master

commit 7c2fa7b8e916a31218347f3ca6bfd79958fdd2e9
Author: Emilien Macchi <email address hidden>
Date: Wed Dec 18 10:47:31 2019 -0500

    mysql: move firewall_rules to mysql-container-puppet

    The firewall_rules need to be in the service template and can't be in
    the base, that is imported.
    The current YAQL is looking for firewall_rules in the role_data:
    $.data.role_data, []).where($ != null).select($.get('firewall_rules')

    So moving the firewall_rules from mysql-base to mysql-container-puppet
    will allow the data to be found by the query and the firewall rules to
    be applied.

    Change-Id: I6183cdf63ea628cc86742d56b5e2cc0ec5e3aab9
    Closes-Bug: #1856864

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 12.1.0 release.