docs(changelog): version 1.11.0 [citest skip]#297
Merged
richm merged 1 commit intolinux-system-roles:mainfrom Oct 21, 2025
Merged
docs(changelog): version 1.11.0 [citest skip]#297richm merged 1 commit intolinux-system-roles:mainfrom
richm merged 1 commit intolinux-system-roles:mainfrom
Conversation
Update changelog and .README.html for version 1.11.0 Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Reviewer's GuideThis PR updates the project documentation for version 1.11.0 by adding a new changelog entry and enhancing the .README.html to include ipset_options, IPv6 ipset support, and associated example code adjustments. Class diagram for updated ipset documentation (ipset_options and IPv6 support)classDiagram
class Firewall {
+ipset: string
+ipset_type: string
+short: string
+description: string
+ipset_entries: list
+ipset_options: dict
+state: string
+permanent: bool
}
class ipset_options {
+maxelem: int
+hashsize: int
+family: string
}
Firewall --> ipset_options : has
class ipset_entries {
+address: string
}
Firewall --> ipset_entries : has
note for Firewall "Now supports IPv6 addresses in ipset_entries and ipset_options dict for advanced options."
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- Several example code blocks (for masquerade, service, interface, etc.) appear to have been shifted or replaced with port examples—please verify each example still aligns with its description and isn’t duplicated or out of order.
- Double-check that the new ipset_options TOC entry and section IDs match (including the "Removing options" anchor) so that in-page navigation links work correctly.
- The note about not mixing IPv4/IPv6/MAC addresses is repeated under both ipset and ipset_entries—consider consolidating it into a single, prominent note to reduce redundancy.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Several example code blocks (for masquerade, service, interface, etc.) appear to have been shifted or replaced with port examples—please verify each example still aligns with its description and isn’t duplicated or out of order.
- Double-check that the new ipset_options TOC entry and section IDs match (including the "Removing options" anchor) so that in-page navigation links work correctly.
- The note about not mixing IPv4/IPv6/MAC addresses is repeated under both ipset and ipset_entries—consider consolidating it into a single, prominent note to reduce redundancy.
## Individual Comments
### Comment 1
<location> `.README.html:552` </location>
<code_context>
-<code>description</code>, <code>ipset_entries</code></p>
+<code>description</code>, <code>ipset_entries</code> and
+<code>ipset_options</code>.</p>
+<p><strong>NOTE</strong>: You cannot mix IPv4, IPv6, and MAC addresses
+in the same <code>ipset_entries</code> list. All addresses must be the
+same IP type. This is a limitation of the underlying firewalld
</code_context>
<issue_to_address>
**suggestion:** The note about address mixing is repeated in two places.
Consolidate the warning about address mixing to a single location or use cross-references to reduce redundancy and simplify future maintenance.
Suggested implementation:
```
<code>description</code>, <code>ipset_entries</code> and
<code>ipset_options</code>.</p>
<p><strong>NOTE</strong>: You cannot mix IPv4, IPv6, and MAC addresses in the same <code>ipset_entries</code> list. All addresses must be the same IP type. This is a limitation of the underlying firewalld implementation.</p>
<p>Defining an ipset with all optional fields:</p>
```
```
<!-- See the NOTE above about address type mixing in ipset_entries. -->
```
</issue_to_address>
### Comment 2
<location> `.README.html:647-656` </location>
<code_context>
+<h2 id="ipset_options">ipset_options</h2>
</code_context>
<issue_to_address>
**suggestion:** Consider listing which ipset options are supported or commonly used.
Including a brief list of common options like maxelem, hashsize, and family would improve usability for readers.
</issue_to_address>
### Comment 3
<location> `.README.html:661-663` </location>
<code_context>
+<span id="cb26-2"><a href="#cb26-2" aria-hidden="true" tabindex="-1"></a><span class="at"> </span><span class="fu">maxelem</span><span class="kw">:</span><span class="at"> </span><span class="dv">1000</span></span>
+<span id="cb26-3"><a href="#cb26-3" aria-hidden="true" tabindex="-1"></a><span class="at"> </span><span class="fu">hashsize</span><span class="kw">:</span><span class="at"> </span><span class="dv">512</span></span></code></pre></div>
+<h3 id="removing-options">Removing options</h3>
+<p><strong>NOTE</strong>: Options cannot be modified or removed if
+running the role during a container or image build (e.g. in a
+<code>bootc</code> Containerfile).</p>
</code_context>
<issue_to_address>
**suggestion:** Clarify the limitation on option removal in container builds.
Please specify which container technologies this limitation applies to and clarify if it affects all environments or only specific ones.
```suggestion
<p><strong>NOTE</strong>: Options cannot be modified or removed if
running the role during a container or image build using technologies such as <code>bootc</code>, Podman, or Docker (i.e., within a <code>Containerfile</code> or <code>Dockerfile</code>). This limitation applies specifically to the image build phase, not to containers running in standard environments.</p>
```
</issue_to_address>
### Comment 4
<location> `.README.html:664-669` </location>
<code_context>
+<p>If you want to remove an option, set <code>state: absent</code>, and
</code_context>
<issue_to_address>
**suggestion:** Consider clarifying the behavior when removing options with null values.
Providing a specific example of conditional removal would make the documentation clearer.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| <code>description</code>, <code>ipset_entries</code></p> | ||
| <code>description</code>, <code>ipset_entries</code> and | ||
| <code>ipset_options</code>.</p> | ||
| <p><strong>NOTE</strong>: You cannot mix IPv4, IPv6, and MAC addresses |
There was a problem hiding this comment.
suggestion: The note about address mixing is repeated in two places.
Consolidate the warning about address mixing to a single location or use cross-references to reduce redundancy and simplify future maintenance.
Suggested implementation:
<code>description</code>, <code>ipset_entries</code> and
<code>ipset_options</code>.</p>
<p><strong>NOTE</strong>: You cannot mix IPv4, IPv6, and MAC addresses in the same <code>ipset_entries</code> list. All addresses must be the same IP type. This is a limitation of the underlying firewalld implementation.</p>
<p>Defining an ipset with all optional fields:</p>
<!-- See the NOTE above about address type mixing in ipset_entries. -->
Comment on lines
+647
to
+656
| <h2 id="ipset_options">ipset_options</h2> | ||
| <p>A <code>dict</code> of key/value pairs of ipset options for the given | ||
| ipset. See <a | ||
| href="https://firewalld.org/documentation/ipset/options.html">firewalld | ||
| ipset options</a> for more information.</p> | ||
| <p>You usually do not have to specify the family. The role will default | ||
| to <code>family: inet</code> if <code>ipset_entries</code> contains IPv4 | ||
| addresses, and will default to <code>family: inet6</code> if | ||
| <code>ipset_entries</code> contains IPv6 addresses</p> | ||
| <div class="sourceCode" id="cb26"><pre |
There was a problem hiding this comment.
suggestion: Consider listing which ipset options are supported or commonly used.
Including a brief list of common options like maxelem, hashsize, and family would improve usability for readers.
Comment on lines
+661
to
+663
| <p><strong>NOTE</strong>: Options cannot be modified or removed if | ||
| running the role during a container or image build (e.g. in a | ||
| <code>bootc</code> Containerfile).</p> |
There was a problem hiding this comment.
suggestion: Clarify the limitation on option removal in container builds.
Please specify which container technologies this limitation applies to and clarify if it affects all environments or only specific ones.
Suggested change
| <p><strong>NOTE</strong>: Options cannot be modified or removed if | |
| running the role during a container or image build (e.g. in a | |
| <code>bootc</code> Containerfile).</p> | |
| <p><strong>NOTE</strong>: Options cannot be modified or removed if | |
| running the role during a container or image build using technologies such as <code>bootc</code>, Podman, or Docker (i.e., within a <code>Containerfile</code> or <code>Dockerfile</code>). This limitation applies specifically to the image build phase, not to containers running in standard environments.</p> |
Comment on lines
+664
to
+669
| <p>If you want to remove an option, set <code>state: absent</code>, and | ||
| set the option value to <code>null</code>:</p> | ||
| <div class="sourceCode" id="cb27"><pre | ||
| class="sourceCode yaml"><code class="sourceCode yaml"><span id="cb27-1"><a href="#cb27-1" aria-hidden="true" tabindex="-1"></a><span class="fu">state</span><span class="kw">:</span><span class="at"> absent</span></span> | ||
| <span id="cb27-2"><a href="#cb27-2" aria-hidden="true" tabindex="-1"></a><span class="fu">ipset_options</span><span class="kw">:</span></span> | ||
| <span id="cb27-3"><a href="#cb27-3" aria-hidden="true" tabindex="-1"></a><span class="at"> </span><span class="fu">maxelem</span><span class="kw">:</span><span class="at"> </span><span class="ch">null</span></span></code></pre></div> |
There was a problem hiding this comment.
suggestion: Consider clarifying the behavior when removing options with null values.
Providing a specific example of conditional removal would make the documentation clearer.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #297 +/- ##
==========================================
- Coverage 61.09% 58.26% -2.83%
==========================================
Files 2 2
Lines 910 1294 +384
==========================================
+ Hits 556 754 +198
- Misses 354 540 +186
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update changelog and .README.html for version 1.11.0
Signed-off-by: Rich Megginson rmeggins@redhat.com
Summary by Sourcery
Update documentation and changelog for version 1.11.0 by introducing IPv6 ipset support and ipset_options, and recording recent CI enhancements in the changelog.
New Features:
CI:
Documentation: