Firewall config

[Alex-Welsh]

Testing changes in CI because my AIO died.

[markgoddard]

I've done a quick first pass. I think we need to consider whether these things are set by default or need to be opted into (like the LVM config). In the latter case we might provide some variables that can be referenced to enable the firewall config.

[Alex-Welsh]

I've done a quick first pass. I think we need to consider whether these things are set by default or need to be opted into (like the LVM config). In the latter case we might provide some variables that can be referenced to enable the firewall config.

My opinion would be that we could disable it for Antelope and enable it for Caracal. I'll look into making a single bool to enable/disable all the rules at once.

[markgoddard]

reno pls :)

[markgoddard]

When testing this in one deployment we saw an issue where seed/infra VM networking was blocked by the seed hypervisor firewall. We worked around it like this:

seed_hypervisor_sysctl_parameters:
  # By default this is 1, which causes layer 2 traffic flowing through Linux
  # bridges to pass through iptables. This blocks traffic from VMs (seed, wazuh) to
  # the Internet.
  net.bridge.bridge-nf-call-iptables: 0

This should be documented.

[jovial]

Debug only when firewalld is enabled

We are missing the firewall-cmd executable

[jovial]

This worked pretty nicely for me. I like the way that the rules take into account multiple group membership - really nice job. Lets get this in before it gets stale. It's disabled by default and we can iterate on it once it is.

I've made a jira to fix to the OVS AIO: INFRA-818