use firewall 8 for all firewall resources

- s/action/jump/ - s/provider/protocol/
mlibrary · Nov 6, 2024 · 2facdc0 · 2facdc0
1 parent 4995513
commit 2facdc0
Show file tree

Hide file tree

Showing 15 changed files with 25 additions and 25 deletions.
diff --git a/manifests/exposed_port.pp b/manifests/exposed_port.pp
@@ -66,7 +66,7 @@
       dport  => $port,
       source => $cidr['block'],
       state  => 'NEW',
-      action => 'accept',
+      jump   => 'accept',
     }
   }
 }
diff --git a/manifests/firewall_allow.pp b/manifests/firewall_allow.pp
@@ -76,7 +76,7 @@
       dport  => $port,
       source => $cidr,
       state  => 'NEW',
-      action => 'accept',
+      jump   => 'accept',
     }
   }
 }
diff --git a/manifests/profile/fulcrum/nginx.pp b/manifests/profile/fulcrum/nginx.pp
@@ -197,6 +197,6 @@
     proto  => 'tcp',
     dport  => 443,
     state  => 'NEW',
-    action => 'accept',
+    jump   => 'accept',
   }
 }
diff --git a/manifests/profile/hathitrust/rsync.pp b/manifests/profile/hathitrust/rsync.pp
@@ -48,7 +48,7 @@
         dport  => 873,
         source => $user['ip'],
         state  => 'NEW',
-        action => 'accept'
+        jump   => 'accept'
       }
     }
   }

diff --git a/manifests/profile/hathitrust/secure_rsync.pp b/manifests/profile/hathitrust/secure_rsync.pp
@@ -69,7 +69,7 @@
       source    => $network['block'],
       src_range => $network['range'],
       state     => 'NEW',
-      action    => 'accept',
+      jump      => 'accept',
     }
   }
 }
diff --git a/manifests/profile/kubernetes/dns_server.pp b/manifests/profile/kubernetes/dns_server.pp
@@ -76,7 +76,7 @@
       dport  => 53,
       source => $node_cidr,
       state  => 'NEW',
-      action => 'accept',
+      jump   => 'accept',
     ;
 
     '200 Nameserver (TCP)':

diff --git a/manifests/profile/kubernetes/haproxy.pp b/manifests/profile/kubernetes/haproxy.pp
@@ -52,7 +52,7 @@
     default:
       proto  => 'tcp',
       state  => 'NEW',
-      action => 'accept',
+      jump   => 'accept',
     ;
 
     '200 private api':

diff --git a/manifests/profile/kubernetes/kubelet.pp b/manifests/profile/kubernetes/kubelet.pp
@@ -53,7 +53,7 @@
       proto  => 'tcp',
       source => $node_cidr,
       state  => 'NEW',
-      action => 'accept',
+      jump   => 'accept',
     ;
 
     '200 Cluster ssh':

diff --git a/manifests/profile/kubernetes/router.pp b/manifests/profile/kubernetes/router.pp
@@ -20,7 +20,7 @@
   firewall { '001 Do not NAT internal requests':
     table       => 'nat',
     chain       => 'POSTROUTING',
-    action      => 'accept',
+    jump        => 'accept',
     proto       => 'all',
     source      => $node_cidr,
     destination => $node_cidr,

diff --git a/manifests/profile/letsencrypt.pp b/manifests/profile/letsencrypt.pp
@@ -22,6 +22,6 @@
     proto  => 'tcp',
     dport  => 80,
     state  => 'NEW',
-    action => 'accept',
+    jump   => 'accept',
   }
 }
diff --git a/manifests/profile/networking/firewall.pp b/manifests/profile/networking/firewall.pp
@@ -144,7 +144,7 @@
   $firewall_defaults = {
     proto  => 'tcp',
     state  => 'NEW',
-    action => 'accept'
+    jump   => 'accept'
   }
 
   create_resources(firewall,$rules,$firewall_defaults)
@@ -154,41 +154,41 @@
   firewall { '001 accept related established rules':
     proto  => 'all',
     state  => ['RELATED', 'ESTABLISHED'],
-    action => 'accept',
+    jump   => 'accept',
   }
 
   firewall { '001 accept all to lo interface':
     proto   => 'all',
     iniface => 'lo',
-    action  => 'accept',
+    jump    => 'accept',
   }
 
   firewall { '999 drop all':
     proto  => 'all',
-    action => 'drop',
+    jump   => 'drop',
     before => undef,
   }
 
   # Default IPv6 items, sorted by title
   firewall { '001 accept related established rules (v6)':
     proto    => 'all',
     state    => ['RELATED', 'ESTABLISHED'],
-    action   => 'accept',
-    provider => 'ip6tables',
+    jump     => 'accept',
+    protocol => 'ip6tables',
   }
 
   firewall { '001 accept all to lo interface (v6)':
     proto    => 'all',
     iniface  => 'lo',
-    action   => 'accept',
-    provider => 'ip6tables',
+    jump     => 'accept',
+    protocol => 'ip6tables',
   }
 
   firewall { '999 drop all (v6)':
     proto    => 'all',
-    action   => 'drop',
+    jump     => 'drop',
     before   => undef,
-    provider => 'ip6tables',
+    protocol => 'ip6tables',
   }
 
 }
diff --git a/manifests/profile/networking/firewall/http_datacenters.pp b/manifests/profile/networking/firewall/http_datacenters.pp
@@ -16,7 +16,7 @@
     proto  => 'tcp',
     dport  => [80, 443],
     state  => 'NEW',
-    action => 'accept'
+    jump   => 'accept'
   }
 
   $networks.flatten.each |$network| {

diff --git a/manifests/profile/networking/firewall/private_ssh.pp b/manifests/profile/networking/firewall/private_ssh.pp
@@ -9,7 +9,7 @@
   $cidrs.each |$cidr| {
     firewall { "100 Private SSH: ${cidr}":
       state  => 'NEW',
-      action => 'accept',
+      jump   => 'accept',
       dport  => $port,
       source => $cidr,
       proto  => 'tcp'

diff --git a/manifests/profile/prometheus.pp b/manifests/profile/prometheus.pp
@@ -176,7 +176,7 @@
       proto  => 'tcp',
       dport  => [443],
       state  => 'NEW',
-      action => 'accept',
+      jump   => 'accept',
     }
   }
 
@@ -190,7 +190,7 @@
     dport  => 9100,
     source => $::ipaddress,
     state  => 'NEW',
-    action => 'accept',
+    jump   => 'accept',
   }
 
   case $facts["mlibrary_ip_addresses"] {

diff --git a/manifests/role/webhost/htvm/test.pp b/manifests/role/webhost/htvm/test.pp
@@ -13,7 +13,7 @@
       dport  => [80,443],
       source => $network['block'],
       state  => 'NEW',
-      action => 'accept',
+      jump   => 'accept',
     }
   }