Misc fixes

Author: Alex-Welsh

etc/kayobe/inventory/group_vars/all/firewall

@@ -155,11 +155,13 @@ stackhpc_compute_firewalld_rules_default:
         state: disabled
         zone: "{{ public_net_name | net_zone }}"
         network: "{{ public_net_name }}"
+    enabled: true
+  - rules:
       - service: ssh
         state: disabled
         zone: "{{ public_net_name | net_zone }}"
         network: "{{ public_net_name }}"
-    enabled: true
+    enabled: "{{ public_net_name | net_zone != provision_oc_net_name | net_zone }}"
   # GENEVE
   - rules:
       - port: 6081/udp
@@ -202,11 +204,13 @@ stackhpc_storage_firewalld_rules_default:
         zone: "{{ provision_oc_net_name | net_zone }}"
         network: "{{ provision_oc_net_name }}"
         state: enabled
+    enabled: true
+  - rules:
       - service: ssh
         zone: "{{ storage_net_name | net_zone }}"
         network: "{{ storage_net_name }}"
         state: disabled
-    enabled: true
+    enabled: "{{ storage_net_name | net_zone != provision_oc_net_name | net_zone }}"
   # Ceph
   - rules:
       - service: ceph
@@ -219,7 +223,7 @@ stackhpc_storage_firewalld_rules_default:
         state: "{{ 'enabled' if 'mons' in group_names else 'disabled' }}"
     enabled: "{{ stackhpc_enable_ceph | default(false) | bool }}"
 
-stackhpc_storage_firewalld_extra: []
+stackhpc_storage_firewalld_rules_extra: []
 
 ###############################################################################
 # Monitoring firewalld rules
@@ -354,20 +358,18 @@ stackhpc_seed_firewalld_rules_default:
         zone: "{{ provision_oc_net_name | net_zone }}"
         network: "{{ provision_oc_net_name }}"
         state: enabled
-      - service: ntp
-        zone: "{{ switch_mgmt_net_name | net_zone }}"
-        network: "{{ switch_mgmt_net_name }}"
-        state: enabled
       # Disable default services in public zone
       - service: dhcpv6-client
         state: disabled
         zone: "{{ public_net_name | net_zone }}"
         network: "{{ public_net_name }}"
+    enabled: true
+  - rules:
       - service: ssh
         state: disabled
         zone: "{{ public_net_name | net_zone }}"
         network: "{{ public_net_name }}"
-    enabled: true
+    enabled: "{{ public_net_name | net_zone != provision_oc_net_name | net_zone }}"
   # Pulp server
   - rules:
       - service: http
@@ -399,7 +401,7 @@ stackhpc_seed_firewalld_rules_default:
         zone: "{{ provision_oc_net_name | net_zone }}"
         network: "{{ provision_oc_net_name }}"
         state: enabled
-    enabled: "{{ kolla_enable_bifrost | bool }}"
+    enabled: true  #FIXME: Make rules conditional on Bifrost deployment
   # Redfish exporter
   - rules:
       - port: 9610/tcp