Skip to content

Commit

Permalink
upgrade firewall module to 8.0.0
Browse files Browse the repository at this point in the history 
To support firewall >= 7.0.0
s/jump/action/, s/provider/protocol/
see https://github.com/puppetlabs/puppetlabs-firewall?tab=readme-ov-file#migration-path-to-v700
  • Loading branch information
@rrotter
rrotter committed Nov 4, 2024
1 parent 39bda2f commit b33891e
Show file tree
Hide file tree
Showing 29 changed files with 57 additions and 57 deletions.
2 changes: 1 addition & 1 deletion .fixtures.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ fixtures:
cron_core: {"repo": "puppetlabs/cron_core", "ref": "1.3.0" }
docker: {"repo": "puppetlabs/docker", "ref": "10.0.1" }
# TODO: Upgrading to 7 requires nuking PuppetDB. https://forge.puppet.com/modules/puppetlabs/firewall/8.0.3/changelog
firewall: {"repo": "puppetlabs/firewall", "ref": "6.0.0" }
firewall: {"repo": "puppetlabs/firewall", "ref": "8.0.0" }
host_core: {"repo": "puppetlabs/host_core", "ref": "1.3.0" }
inifile: {"repo": "puppetlabs/inifile", "ref": "6.1.1" }
lvm: {"repo": "puppetlabs/lvm", "ref": "2.3.0" }
Expand Down
2 changes: 1 addition & 1 deletion manifests/exposed_port.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@
dport => $port,
source => $cidr['block'],
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}
}
2 changes: 1 addition & 1 deletion manifests/firewall_allow.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@
dport => $port,
source => $cidr,
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}
}
2 changes: 1 addition & 1 deletion manifests/profile/fulcrum/nginx.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,6 @@
proto => 'tcp',
dport => 443,
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}
2 changes: 1 addition & 1 deletion manifests/profile/haproxy.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@
dport => [80, 443],
source => $::ipaddress,
state => 'NEW',
action => 'accept',
jump => 'accept',
tag => 'haproxy'
}

Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/hathitrust/rsync.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
dport => 873,
source => $user['ip'],
state => 'NEW',
action => 'accept'
jump => 'accept'
}
}
}
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/hathitrust/secure_rsync.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@
source => $network['block'],
src_range => $network['range'],
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}
}
2 changes: 1 addition & 1 deletion manifests/profile/kubernetes/dns_server.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@
dport => 53,
source => $node_cidr,
state => 'NEW',
action => 'accept',
jump => 'accept',
;

'200 Nameserver (TCP)':
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/kubernetes/haproxy.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@
default:
proto => 'tcp',
state => 'NEW',
action => 'accept',
jump => 'accept',
;

'200 private api':
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/kubernetes/kubelet.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@
proto => 'tcp',
source => $node_cidr,
state => 'NEW',
action => 'accept',
jump => 'accept',
;

'200 Cluster ssh':
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/kubernetes/router.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
firewall { '001 Do not NAT internal requests':
table => 'nat',
chain => 'POSTROUTING',
action => 'accept',
jump => 'accept',
proto => 'all',
source => $node_cidr,
destination => $node_cidr,
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/letsencrypt.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,6 @@
proto => 'tcp',
dport => 80,
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}
20 changes: 10 additions & 10 deletions manifests/profile/networking/firewall.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@
$firewall_defaults = {
proto => 'tcp',
state => 'NEW',
action => 'accept'
jump => 'accept'
}

create_resources(firewall,$rules,$firewall_defaults)
Expand All @@ -154,41 +154,41 @@
firewall { '001 accept related established rules':
proto => 'all',
state => ['RELATED', 'ESTABLISHED'],
action => 'accept',
jump => 'accept',
}

firewall { '001 accept all to lo interface':
proto => 'all',
iniface => 'lo',
action => 'accept',
jump => 'accept',
}

firewall { '999 drop all':
proto => 'all',
action => 'drop',
jump => 'drop',
before => undef,
}

# Default IPv6 items, sorted by title
firewall { '001 accept related established rules (v6)':
proto => 'all',
state => ['RELATED', 'ESTABLISHED'],
action => 'accept',
provider => 'ip6tables',
jump => 'accept',
protocol => 'ip6tables',
}

firewall { '001 accept all to lo interface (v6)':
proto => 'all',
iniface => 'lo',
action => 'accept',
provider => 'ip6tables',
jump => 'accept',
protocol => 'ip6tables',
}

firewall { '999 drop all (v6)':
proto => 'all',
action => 'drop',
jump => 'drop',
before => undef,
provider => 'ip6tables',
protocol => 'ip6tables',
}

}
2 changes: 1 addition & 1 deletion manifests/profile/networking/firewall/http_datacenters.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
proto => 'tcp',
dport => [80, 443],
state => 'NEW',
action => 'accept'
jump => 'accept'
}

$networks.flatten.each |$network| {
Expand Down
10 changes: 5 additions & 5 deletions manifests/profile/prometheus.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -188,7 +188,7 @@
dport => 9100,
source => $::ipaddress,
state => 'NEW',
action => 'accept',
jump => 'accept',
}

case $facts["mlibrary_ip_addresses"] {
Expand Down Expand Up @@ -229,7 +229,7 @@
proto => 'tcp',
source => $address,
state => 'NEW',
action => 'accept',
jump => 'accept',
;

"010 prometheus public node exporter ${::hostname} ${address}":
Expand All @@ -250,7 +250,7 @@
proto => 'tcp',
source => $address,
state => 'NEW',
action => 'accept',
jump => 'accept',
;

"010 prometheus private node exporter ${::hostname} ${address}":
Expand All @@ -271,7 +271,7 @@
dport => 9101,
source => $::ipaddress,
state => 'NEW',
action => 'accept',
jump => 'accept',
}

@@firewall { "010 prometheus mysql exporter ${::hostname}":
Expand All @@ -280,7 +280,7 @@
dport => 9104,
source => $::ipaddress,
state => 'NEW',
action => 'accept',
jump => 'accept',
}

Firewall <<| tag == "${::datacenter}_pushgateway_node" |>>
Expand Down
2 changes: 1 addition & 1 deletion manifests/profile/prometheus/exporter/node.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -155,7 +155,7 @@
dport => 9091,
source => $address,
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}

Expand Down
2 changes: 1 addition & 1 deletion manifests/role/webhost/htvm/test.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
dport => [80,443],
source => $network['block'],
state => 'NEW',
action => 'accept',
jump => 'accept',
}
}

Expand Down
2 changes: 1 addition & 1 deletion manifests/unison/client.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
dport => [$port],
source => $::ipaddress,
state => 'NEW',
action => 'accept',
jump => 'accept',
tag => "unison-client-${title}"
}

Expand Down
2 changes: 1 addition & 1 deletion metadata.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
{"name": "puppetlabs/concat", "version_requirement": ">= 9.0.2 < 10.0.0"},
{"name": "puppetlabs/cron_core", "version_requirement": ">= 1.3.0 < 2.0.0" },
{"name": "puppetlabs/docker", "version_requirement": ">= 10.0.1 < 11.0.0"},
{"name": "puppetlabs/firewall", "version_requirement": "6.0.0"},
{"name": "puppetlabs/firewall", "version_requirement": ">= 8.0.0 < 9.0.0" },
{"name": "puppetlabs/host_core", "version_requirement": ">= 1.3.0 < 2.0.0" },
{"name": "puppetlabs/inifile", "version_requirement": ">= 6.1.1 < 7.0.0" },
{"name": "puppetlabs/lvm", "version_requirement": ">= 2.3.0 < 3.0.0" },
Expand Down
2 changes: 1 addition & 1 deletion spec/classes/profile/kubernetes/dns_server_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
.with_dport(53)
.with_source('172.28.0.0/14')
.with_state('NEW')
.with_action('accept')
.with_jump('accept')
end
end

Expand Down
4 changes: 2 additions & 2 deletions spec/classes/profile/kubernetes/haproxy_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@
is_expected.to contain_firewall("200 public #{service}")
.with_proto('tcp')
.with_state('NEW')
.with_action('accept')
.with_jump('accept')
.with_dport(port)
.without_source
end
Expand All @@ -81,7 +81,7 @@
is_expected.to contain_firewall("200 private #{service}")
.with_proto('tcp')
.with_state('NEW')
.with_action('accept')
.with_jump('accept')
.with_dport(port)
.with_source('172.28.0.0/14')
end
Expand Down
2 changes: 1 addition & 1 deletion spec/classes/profile/kubernetes/kubelet_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@
.with_dport(ports)
.with_source('172.28.0.0/14')
.with_state('NEW')
.with_action('accept')
.with_jump('accept')
end
end
end
Expand Down
2 changes: 1 addition & 1 deletion spec/classes/profile/kubernetes/router_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
is_expected.to contain_firewall('001 Do not NAT internal requests')
.with_table('nat')
.with_chain('POSTROUTING')
.with_action('accept')
.with_jump('accept')
.with_proto('all')
.with_source('172.28.0.0/14')
.with_destination('172.28.0.0/14')
Expand Down
24 changes: 12 additions & 12 deletions spec/classes/profile/networking/firewall_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,33 +16,33 @@
is_expected.to contain_firewall('001 accept related established rules').with(
proto: 'all',
state: %w[RELATED ESTABLISHED],
action: 'accept',
jump: 'accept',
)
end

it do
is_expected.to contain_firewall('001 accept related established rules (v6)').with(
proto: 'all',
state: %w[RELATED ESTABLISHED],
action: 'accept',
provider: 'ip6tables',
jump: 'accept',
protocol: 'ip6tables',
)
end

it do
is_expected.to contain_firewall('001 accept all to lo interface').with(
proto: 'all',
iniface: 'lo',
action: 'accept',
jump: 'accept',
)
end

it do
is_expected.to contain_firewall('001 accept all to lo interface (v6)').with(
proto: 'all',
iniface: 'lo',
action: 'accept',
provider: 'ip6tables',
jump: 'accept',
protocol: 'ip6tables',
)
end

Expand All @@ -53,7 +53,7 @@
dport: %w[8081 8082],
source: '10.2.3.4',
state: 'NEW',
action: 'accept',
jump: 'accept',
)
end

Expand All @@ -63,7 +63,7 @@
dport: 123,
source: '10.4.5.6',
state: 'NEW',
action: 'accept',
jump: 'accept',
)
end

Expand All @@ -77,23 +77,23 @@
toports: '1234',
)
is_expected.not_to contain_firewall('900 port forwarding: an advanced rule').with(
action: 'accept',
jump: 'accept',
state: 'NEW',
)
end

it do
is_expected.to contain_firewall('999 drop all').with(
proto: 'all',
action: 'drop',
jump: 'drop',
)
end

it do
is_expected.to contain_firewall('999 drop all (v6)').with(
proto: 'all',
action: 'drop',
provider: 'ip6tables',
jump: 'drop',
protocol: 'ip6tables',
)
end

Expand Down
2 changes: 1 addition & 1 deletion spec/classes/profile/prometheus/exporter/node_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@
.with_dport(9091)
.with_source(facts[:ipaddress])
.with_state('NEW')
.with_action('accept')
.with_jump('accept')
end

context 'with both public and private mlibrary_ip_addresses' do
Expand Down
Loading

0 comments on commit b33891e

Please sign in to comment.