SshFirewallAllowAll not taken into account anymore?

[Cédric Jeanneret]

Hello there,

Apparently, the move to the new firewall management thing (pure ansible) doesn't take into account the "SshFirewallAllowAll" param.
This param should inject an ip(6)tables rule opening Ssh service to the world.

As we can see here, it's set to "true" by default in t-h-t:
environments/standalone/standalone-tripleo.yaml: SshFirewallAllowAll: True
environments/undercloud.yaml: SshFirewallAllowAll: true

I need to investigate a bit more, but I'd say it's a regression.

Stay tuned!

C.

[Rabi Mishra (rabi)]

From heat parameter point of view true/True both should work.

https://github.com/openstack/heat/blob/master/heat/engine/parameters.py#L347

[Cédric Jeanneret (cjeanner)]

After some discussions, it's indeed OK - but "master" didn't get promotion in a while, meaning the following patch isn't available in "tripleo-current": https://review.opendev.org/#/c/700829/2/deployment/sshd/sshd-baremetal-puppet.yaml

Hence, if using "master", use tripleo-current-dev for now (matches CI anyway).

[Cédric Jeanneret (cjeanner)]

Already sorted out.