Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

upgrade to puppetlabs/firewall 8.1.1 #743

Merged
merged 3 commits into from
Nov 7, 2024
Merged

upgrade to puppetlabs/firewall 8.1.1 #743

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
516a57f
update specs & metatdata for firewall 8
rrotter Nov 6, 2024
9c7a3fe
use firewall 8
rrotter Nov 6, 2024
e8d12f8
rm "legacy" prometheus firewall exported resource
rrotter Nov 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions .fixtures.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,8 @@ fixtures:
augeas_core: {"repo": "puppetlabs/augeas_core", "ref": "1.5.0" }
concat: {"repo": "puppetlabs/concat", "ref": "9.0.2" }
cron_core: {"repo": "puppetlabs/cron_core", "ref": "1.3.0" }
docker: {"repo": "puppetlabs/docker", "ref": "10.0.1" }
# TODO: Upgrading to 7 requires nuking PuppetDB. https://forge.puppet.com/modules/puppetlabs/firewall/8.0.3/changelog
firewall: {"repo": "puppetlabs/firewall", "ref": "6.0.0" }
docker: {"repo": "puppetlabs/docker", "ref": "10.0.1"}
firewall: {"repo": "puppetlabs/firewall", "ref": "8.1.1" }
host_core: {"repo": "puppetlabs/host_core", "ref": "1.3.0" }
inifile: {"repo": "puppetlabs/inifile", "ref": "6.1.1" }
lvm: {"repo": "puppetlabs/lvm", "ref": "2.3.0" }
Expand Down
2 changes: 1 addition & 1 deletion manifests/exposed_port.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@
dport => $port,
source => $cidr['block'],
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}
}
2 changes: 1 addition & 1 deletion manifests/firewall_allow.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@
dport => $port,
source => $cidr,
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}
}
2 changes: 1 addition & 1 deletion manifests/profile/fulcrum/nginx.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,6 @@
proto => 'tcp',
dport => 443,
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}
9 changes: 0 additions & 9 deletions manifests/profile/haproxy.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,15 +139,6 @@
tag => "${::datacenter}_haproxy"
}

@@firewall { "200 HTTP firewall6: HAProxy ${::hostname}":
proto => 'tcp',
dport => [80, 443],
source => $::ipaddress,
state => 'NEW',
action => 'accept',
tag => 'firewall6-haproxy'
}

# HAProxy should listen for kubernetes connections.
nebula::exposed_port { '200 kubectl':
port => 6443,
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/hathitrust/rsync.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
dport => 873,
source => $user['ip'],
state => 'NEW',
action => 'accept'
jump => 'accept'
}
}
}
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/hathitrust/secure_rsync.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@
source => $network['block'],
src_range => $network['range'],
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}
}
2 changes: 1 addition & 1 deletion manifests/profile/kubernetes/dns_server.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@
dport => 53,
source => $node_cidr,
state => 'NEW',
action => 'accept',
jump => 'accept',
;

'200 Nameserver (TCP)':
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/kubernetes/haproxy.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@
default:
proto => 'tcp',
state => 'NEW',
action => 'accept',
jump => 'accept',
;

'200 private api':
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/kubernetes/kubelet.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@
proto => 'tcp',
source => $node_cidr,
state => 'NEW',
action => 'accept',
jump => 'accept',
;

'200 Cluster ssh':
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/kubernetes/router.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
firewall { '001 Do not NAT internal requests':
table => 'nat',
chain => 'POSTROUTING',
action => 'accept',
jump => 'accept',
proto => 'all',
source => $node_cidr,
destination => $node_cidr,
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/letsencrypt.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,6 @@
proto => 'tcp',
dport => 80,
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}
20 changes: 10 additions & 10 deletions manifests/profile/networking/firewall.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@
$firewall_defaults = {
proto => 'tcp',
state => 'NEW',
action => 'accept'
jump => 'accept'
}

create_resources(firewall,$rules,$firewall_defaults)
Expand All @@ -154,41 +154,41 @@
firewall { '001 accept related established rules':
proto => 'all',
state => ['RELATED', 'ESTABLISHED'],
action => 'accept',
jump => 'accept',
}

firewall { '001 accept all to lo interface':
proto => 'all',
iniface => 'lo',
action => 'accept',
jump => 'accept',
}

firewall { '999 drop all':
proto => 'all',
action => 'drop',
jump => 'drop',
before => undef,
}

# Default IPv6 items, sorted by title
firewall { '001 accept related established rules (v6)':
proto => 'all',
state => ['RELATED', 'ESTABLISHED'],
action => 'accept',
provider => 'ip6tables',
jump => 'accept',
protocol => 'ip6tables',
}

firewall { '001 accept all to lo interface (v6)':
proto => 'all',
iniface => 'lo',
action => 'accept',
provider => 'ip6tables',
jump => 'accept',
protocol => 'ip6tables',
}

firewall { '999 drop all (v6)':
proto => 'all',
action => 'drop',
jump => 'drop',
before => undef,
provider => 'ip6tables',
protocol => 'ip6tables',
}

}
2 changes: 1 addition & 1 deletion manifests/profile/networking/firewall/http.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
# @example
# include nebula::profile::networking::firewall::http
class nebula::profile::networking::firewall::http () {
Firewall <<| tag == 'firewall6-haproxy' |>>
Firewall <<| tag == "${::datacenter}_haproxy" |>>
}


2 changes: 1 addition & 1 deletion manifests/profile/networking/firewall/http_datacenters.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
proto => 'tcp',
dport => [80, 443],
state => 'NEW',
action => 'accept'
jump => 'accept'
}

$networks.flatten.each |$network| {
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/networking/firewall/private_ssh.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
$cidrs.each |$cidr| {
firewall { "100 Private SSH: ${cidr}":
state => 'NEW',
action => 'accept',
jump => 'accept',
dport => $port,
source => $cidr,
proto => 'tcp'
Expand Down
73 changes: 2 additions & 71 deletions manifests/profile/prometheus.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,23 +176,10 @@
proto => 'tcp',
dport => [443],
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}

# Delete this once nothing is importing it. It's only here for the
# sake of hosts that aren't in production.
# Referenced in branches: fulcrum_demo, tdx_7298538
# ** intentionally retains puppetlabs/firewall v6.0.0 semantics **
@@firewall { "010 prometheus legacy node exporter ${::hostname}":
tag => "${::datacenter}_prometheus_node_exporter",
proto => 'tcp',
dport => 9100,
source => $::ipaddress,
state => 'NEW',
action => 'accept',
}

case $facts["mlibrary_ip_addresses"] {
Hash[String, Array[String]]: {
$all_public_addresses = $facts["mlibrary_ip_addresses"]["public"]
Expand Down Expand Up @@ -244,25 +231,6 @@
dport => 9290,
;
}

@@firewall {
default:
proto => 'tcp',
source => $address,
state => 'NEW',
action => 'accept',
;

"010 prometheus public node exporter firewall6 ${::hostname} ${address}":
tag => "firewall6-${::datacenter}_prometheus_public_node_exporter",
dport => 9100,
;

"010 prometheus public ipmi exporter firewall6 ${::hostname} ${address}":
tag => "firewall6-${::datacenter}_prometheus_public_ipmi_exporter",
dport => 9290,
;
}
}

$all_private_addresses.each |$address| {
Expand All @@ -284,25 +252,6 @@
dport => 9290,
;
}

@@firewall {
default:
proto => 'tcp',
source => $address,
state => 'NEW',
action => 'accept',
;

"010 prometheus firewall6 private node exporter ${::hostname} ${address}":
tag => "firewall6-${::datacenter}_prometheus_private_node_exporter",
dport => 9100,
;

"010 prometheus firewall6 private ipmi exporter ${::hostname} ${address}":
tag => "firewall6-${::datacenter}_prometheus_private_ipmi_exporter",
dport => 9290,
;
}
}

@@firewall { "010 prometheus haproxy exporter ${::hostname}":
Expand All @@ -314,15 +263,6 @@
jump => 'accept',
}

@@firewall { "010 prometheus firewall6 haproxy exporter ${::hostname}":
tag => "firewall6-${::datacenter}_prometheus_haproxy_exporter",
proto => 'tcp',
dport => 9101,
source => $::ipaddress,
state => 'NEW',
action => 'accept',
}

@@firewall { "010 prometheus mysql exporter ${::hostname}":
tag => "${::datacenter}_prometheus_mysql_exporter",
proto => 'tcp',
Expand All @@ -332,14 +272,5 @@
jump => 'accept',
}

@@firewall { "010 prometheus firewall6 mysql exporter ${::hostname}":
tag => "firewall6-${::datacenter}_prometheus_mysql_exporter",
proto => 'tcp',
dport => 9104,
source => $::ipaddress,
state => 'NEW',
action => 'accept',
}

Firewall <<| tag == "firewall6-${::datacenter}_pushgateway_node" |>>
Firewall <<| tag == "${::datacenter}_pushgateway_node" |>>
}
2 changes: 1 addition & 1 deletion manifests/profile/prometheus/exporter/haproxy.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,6 @@
content => template('nebula/profile/prometheus/exporter/haproxy/target.yaml.erb')
}

Firewall <<| tag == "firewall6-${::datacenter}_prometheus_haproxy_exporter" |>>
Firewall <<| tag == "${::datacenter}_prometheus_haproxy_exporter" |>>

}
4 changes: 2 additions & 2 deletions manifests/profile/prometheus/exporter/ipmi.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,10 @@
fail('Host cannot be scraped without a public or private IP address')
} elsif $all_private_addresses != [] {
$ipaddress = $all_private_addresses[0]
Firewall <<| tag == "firewall6-${::datacenter}_prometheus_private_ipmi_exporter" |>>
Firewall <<| tag == "${::datacenter}_prometheus_private_ipmi_exporter" |>>
} else {
$ipaddress = $all_public_addresses[0]
Firewall <<| tag == "firewall6-${::datacenter}_prometheus_public_ipmi_exporter" |>>
Firewall <<| tag == "${::datacenter}_prometheus_public_ipmi_exporter" |>>
}

@@concat_fragment { "prometheus ipmi scrape config ${::hostname}":
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/prometheus/exporter/mysql.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
content => template('nebula/profile/prometheus/exporter/mysql/target.yaml.erb')
}

Firewall <<| tag == "firewall6-${::datacenter}_prometheus_mysql_exporter" |>>
Firewall <<| tag == "${::datacenter}_prometheus_mysql_exporter" |>>

$role = lookup_role()

Expand Down
13 changes: 2 additions & 11 deletions manifests/profile/prometheus/exporter/node.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,11 +139,11 @@
fail("${datacenter} host cannot be scraped by ${monitoring_datacenter} prometheus server without a public IP address")
} elsif $all_private_addresses != [] and $monitoring_datacenter == $datacenter {
$ipaddresses = $all_private_addresses
Firewall <<| tag == "firewall6-${monitoring_datacenter}_prometheus_private_node_exporter" |>>
Firewall <<| tag == "${monitoring_datacenter}_prometheus_private_node_exporter" |>>
Concat_fragment <<| title == "02 pushgateway advanced private url ${monitoring_datacenter}" |>>
} else {
$ipaddresses = $all_public_addresses
Firewall <<| tag == "firewall6-${monitoring_datacenter}_prometheus_public_node_exporter" |>>
Firewall <<| tag == "${monitoring_datacenter}_prometheus_public_node_exporter" |>>
Concat_fragment <<| title == "02 pushgateway advanced public url ${monitoring_datacenter}" |>>
}

Expand All @@ -157,15 +157,6 @@
state => 'NEW',
jump => 'accept',
}

@@firewall { "300 pushgateway firewall6 ${::hostname} ${address}":
tag => "firewall6-${monitoring_datacenter}_pushgateway_node",
proto => 'tcp',
dport => 9091,
source => $address,
state => 'NEW',
action => 'accept',
}
}

ensure_packages(['curl', 'jq'])
Expand Down
2 changes: 1 addition & 1 deletion manifests/role/webhost/htvm/test.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
dport => [80,443],
source => $network['block'],
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}

Expand Down
9 changes: 0 additions & 9 deletions manifests/unison/client.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,13 +42,4 @@
jump => 'accept',
tag => "unison-client-${title}"
}

@@firewall { "200 Unison firewall6: ${title} ${::hostname}":
proto => 'tcp',
dport => [$port],
source => $::ipaddress,
state => 'NEW',
action => 'accept',
tag => "firewall6-unison-client-${title}"
}
}
Loading