Add new feature to firewalld module allowing the default zone to be set. #405
Conversation
|
Build failed. ❌ ansible-changelog-fragment FAILURE in 16s |
…ewalld default parameter. Update to fail if not explicitly both immedate AND permanent when the firewall daemon is online.
|
Build failed. ❌ ansible-changelog-fragment FAILURE in 17s |
|
recheck |
|
Build failed. ❌ ansible-changelog-fragment FAILURE in 12s |
|
@maxamillion Can you take a look at the proposal here as well? There's a bit of clean up required, but I just want to confirm that you don't object to the description of the implementation above (bullet points 2 & 3). |
|
@gnfzdz this is great, I love the idea. +1 |
|
@gnfzdz it appears we have some merge conflicts :( |
|
hello, is the thread alive? |
|
This still seems to be in Draft PR. |
|
@saito-hideki What would be the necessary steps to get this merged? |
SUMMARY
Implements #296 adding support for setting the default zone in the firewalld module.
This pull request is meant to help visualize the changes mentioned in the linked issue and I'm more interested in feedback than actually having it merged.
Related to my concerns from comments in that issue:
stateparameter is retained although it may have unclear semantics when considering negative values.stateanddefaultparameters would suggest that the zone should NOT be, the module reverts the default zone back to the upstream default, publicISSUE TYPE
COMPONENT NAME
ansible.posix.firewalld
ADDITIONAL INFORMATION
Note: The new integration test cases currently fail for the scenario where the daemon is up AND they are run in a container (as with CI/CD). In that scenario, it correctly updates the default zone to /etc/firewalld/firewalld.conf but fails when attempting to immediately apply the change to nftables. In my tests running on bare metal and a full VM they appear to work without issue.