Imported changes from MN

Author: Alex-Welsh

etc/kayobe/environments/ci-multinode/networks.yml

@@ -77,55 +77,55 @@ internal_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
 internal_allocation_pool_start: 192.168.37.3
 internal_allocation_pool_end: 192.168.37.254
 internal_vlan: 101
-internal_zone: "internal" 
+internal_zone: "internal_net_zone" 
 
 # External network
 external_cidr: 192.168.38.0/24
 external_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
 external_allocation_pool_start: 192.168.38.3
 external_allocation_pool_end: 192.168.38.128
 external_vlan: 102
-external_zone: "external" 
+external_zone: "external_net_zone" 
 
 # Public network
 public_cidr: 192.168.39.0/24
 public_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
 public_allocation_pool_start: 192.168.39.3
 public_allocation_pool_end: 192.168.39.254
 public_vlan: 103
-public_zone: "public" 
+public_zone: "public_net_zone" 
 
 # Tunnel network
 tunnel_cidr: 192.168.40.0/24
 tunnel_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
 tunnel_allocation_pool_start: 192.168.40.3
 tunnel_allocation_pool_end: 192.168.40.254
 tunnel_vlan: 104
-tunnel_zone: "tunnel" 
+tunnel_zone: "tunnel_net_zone" 
 
 # Storage network
 storage_cidr: 192.168.41.0/24
 storage_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
 storage_allocation_pool_start: 192.168.41.3
 storage_allocation_pool_end: 192.168.41.254
 storage_vlan: 105
-storage_zone: "storage" 
+storage_zone: "storage_net_zone" 
 
 # Storage management network
 storage_mgmt_cidr: 192.168.42.0/24
 storage_mgmt_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
 storage_mgmt_allocation_pool_start: 192.168.42.3
 storage_mgmt_allocation_pool_end: 192.168.42.254
 storage_mgmt_vlan: 106
-storage_mgmt_zone: "storage_mgmt" 
+storage_mgmt_zone: "storage_mgmt_net_zone" 
 
 # Provision overcloud network
 provision_oc_cidr: 192.168.33.0/24
 provision_oc_mtu: "{{ ansible_facts.default_ipv4.mtu - 50 }}"
 provision_oc_allocation_pool_start: 192.168.33.128
 provision_oc_allocation_pool_end: 192.168.33.254
 provision_oc_vlan: 107
-provision_oc_zone: "provision_oc" 
+provision_oc_zone: "provision_oc_net_zone" 
 
 ###############################################################################
 # Network virtual patch link configuration.

etc/kayobe/inventory/group_vars/all/firewall

@@ -28,7 +28,7 @@ stackhpc_firewalld_rules: |
   {% set stackhpc_firewalld_rules_verified = [] %}
   {% for rule in stackhpc_firewalld_rules_unverified | unique %}
   {% if rule | ansible.utils.remove_keys('state') in stackhpc_firewalld_rules_verified | map('ansible.utils.remove_keys', 'state') %}
-  {% set stackhpc_firewalld_rules_verified = 'Invalid configuration! Two matching firewalld rules exist with different states' + 1 %}
+  {% set stackhpc_firewalld_rules_verified = 'Invalid configuration! Two matching firewalld rules probably exist with different states' + 1 %}
   {% elif rule.network in network_interfaces and rule.network | net_zone is not none %}
   {% set _ = stackhpc_firewalld_rules_verified.append(rule) %}
   {% endif %}
@@ -78,17 +78,17 @@ stackhpc_common_firewalld_rules_template:
       - service: dhcpv6-client
         network: "{{ public_net_name }}"
         state: disabled
-    enabled: "{{ 'public' in stackhpc_firewalld_zones }}"
+    enabled: "{{ public_net_name | net_zone in stackhpc_firewalld_zones }}"
   - rules:
       - service: ssh
         network: "{{ public_net_name }}"
         state: disabled
-    enabled: "{{ 'public' in stackhpc_firewalld_zones && admin_oc_net_name | net_zone != 'public' }}"
+    enabled: "{{ public_net_name | net_zone in stackhpc_firewalld_zones and admin_oc_net_name | net_zone != public_net_name | net_zone }}"
 
 stackhpc_common_firewalld_rules_extra: []
 
 ###############################################################################
-# Common firewalld rules
+# Controller firewalld rules
 
 stackhpc_controller_firewalld_rules: "{{ stackhpc_controller_firewalld_rules_default + stackhpc_controller_firewalld_rules_extra }}"
 
@@ -142,6 +142,39 @@ stackhpc_controller_firewalld_rules_template:
         network: "{{ public_net_name }}"
         state: enabled
     enabled: "{{ kolla_enable_designate | bool }}"
+  # Vault & Consul
+  - rules:
+      - port: 8200/tcp
+        network: "{{ internal_net_name }}"
+        state: enabled
+      - port: 8300/tcp
+        network: "{{ internal_net_name }}"
+        state: enabled
+      - port: 8301/tcp
+        network: "{{ internal_net_name }}"
+        state: enabled
+      - port: 8301/udp
+        network: "{{ internal_net_name }}"
+        state: enabled
+      - port: 8302/tcp
+        network: "{{ internal_net_name }}"
+        state: enabled
+      - port: 8302/udp
+        network: "{{ internal_net_name }}"
+        state: enabled
+      - port: 8500/tcp
+        network: "{{ internal_net_name }}"
+        state: enabled
+      - port: 8501/tcp
+        network: "{{ internal_net_name }}"
+        state: enabled
+      - port: 8600/tcp
+        network: "{{ internal_net_name }}"
+        state: enabled
+      - port: 8600/udp
+        network: "{{ internal_net_name }}"
+        state: enabled
+    enabled: true # FIXME add condition
   # GENEVE
   - rules:
       - port: 6081/udp
@@ -386,7 +419,7 @@ stackhpc_seed_firewalld_rules_template:
       - port: 9610/tcp
         network: "{{ provision_oc_net_name }}"
         state: enabled
-    enabled: "{{ stackhpc_enable_redfish_exporter }}"
+    enabled: "{{ stackhpc_enable_redfish_exporter | default(false) }}"
 
 stackhpc_seed_firewalld_rules_extra: []