Firewall rules removed during undercloud upgrade

[Brendan Shephard]

Description:

During a undercloud upgrade, we create an empty ruleset:
https://github.com/openstack/tripleo-ansible/blob/master/tripleo_ansible/roles/tripleo_bootstrap/tasks/main.yml#L111-L119

But because we are not making any changes to firewall rules. When we check existing iptables rules we find that we don't need to make any changes, so we skip the save task. This would be fine, but we don't validate if the /etc/sysconfig/iptables file is still empty.
This means that the firewall rules are not saved when we get to this point:
https://github.com/openstack/tripleo-ansible/blob/master/tripleo_ansible/roles/tripleo_firewall/tasks/main.yml#L56-L63

So after a reboot, any masquerade rules that are in place are not reloaded.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/tripleo-ansible/+/823893

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/tripleo-ansible/+/823893
Committed: https://opendev.org/openstack/tripleo-ansible/commit/1b37fe386902e4a942eae780ee798c9f72f25173
Submitter: "Zuul (22348)"
Branch: master

commit 1b37fe386902e4a942eae780ee798c9f72f25173
Author: Brendan Shephard <email address hidden>
Date: Sat Jan 8 12:36:31 2022 +0000

    Ensure firewall rules are saved

    If the /etc/sysconfig/ip*tables files are still empty
    when we reach the Firewall save block. Then we should
    ensure the rules are saved.

    Closes-bug: #1956825
    Resolves: rhbz#2033570
    Change-Id: Idfb2ae61c7aa9725f6e5eb495ed7ea301d4df8b3

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/tripleo-ansible/+/833517

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/tripleo-ansible/+/833518

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/c/openstack/tripleo-ansible/+/833519

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/train
Review: https://review.opendev.org/c/openstack/tripleo-ansible/+/833520

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/tripleo-ansible/+/833520
Committed: https://opendev.org/openstack/tripleo-ansible/commit/7f1e4d5e87289de7839cf2b87022bc58e6d24c3e
Submitter: "Zuul (22348)"
Branch: stable/train

commit 7f1e4d5e87289de7839cf2b87022bc58e6d24c3e
Author: Brendan Shephard <email address hidden>
Date: Sat Jan 8 12:36:31 2022 +0000

    Ensure firewall rules are saved

    If the /etc/sysconfig/ip*tables files are still empty
    when we reach the Firewall save block. Then we should
    ensure the rules are saved.

    Closes-bug: #1956825
    Resolves: rhbz#2063232
    Change-Id: Idfb2ae61c7aa9725f6e5eb495ed7ea301d4df8b3
    (cherry picked from commit 1b37fe386902e4a942eae780ee798c9f72f25173)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/tripleo-ansible/+/833519
Committed: https://opendev.org/openstack/tripleo-ansible/commit/4532dd8c78671e02bf9864c1ba07ebd367af4a40
Submitter: "Zuul (22348)"
Branch: stable/ussuri

commit 4532dd8c78671e02bf9864c1ba07ebd367af4a40
Author: Brendan Shephard <email address hidden>
Date: Sat Jan 8 12:36:31 2022 +0000

    Ensure firewall rules are saved

    If the /etc/sysconfig/ip*tables files are still empty
    when we reach the Firewall save block. Then we should
    ensure the rules are saved.

    Closes-bug: #1956825
    Resolves: rhbz#2033570
    Change-Id: Idfb2ae61c7aa9725f6e5eb495ed7ea301d4df8b3
    (cherry picked from commit 1b37fe386902e4a942eae780ee798c9f72f25173)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/tripleo-ansible/+/833518
Committed: https://opendev.org/openstack/tripleo-ansible/commit/3aec3706afd220b8379f0a2f769274964efa144a
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit 3aec3706afd220b8379f0a2f769274964efa144a
Author: Brendan Shephard <email address hidden>
Date: Sat Jan 8 12:36:31 2022 +0000

    Ensure firewall rules are saved

    If the /etc/sysconfig/ip*tables files are still empty
    when we reach the Firewall save block. Then we should
    ensure the rules are saved.

    Closes-bug: #1956825
    Resolves: rhbz#2033570
    Change-Id: Idfb2ae61c7aa9725f6e5eb495ed7ea301d4df8b3
    (cherry picked from commit 1b37fe386902e4a942eae780ee798c9f72f25173)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-ansible 4.2.0 release.

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Brendan Shephard <email address hidden>" on branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/tripleo-ansible/+/833517
Reason: We don't need this because we have this fix instead that is already merged: https://github.com/openstack/tripleo-ansible/commit/93b14c9f3f4b15258207dfb17feccf20e2fcb21c

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-ansible ussuri-eol release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-ansible 2.6.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-ansible train-eol release.