Bug 1403331
| Summary: | We need to be able to run firewalld on atomic host as a system container. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Daniel Walsh <dwalsh> |
| Component: | firewalld | Assignee: | Eric Garver <egarver> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | bmeng, dustymabe, ghuang, gscrivan, jonte.regnell, rteague, twoerner, walters |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-02-12 15:18:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1422673 | ||
|
Description
Daniel Walsh
2016-12-09 16:49:16 UTC
Thomas, if you could take a quick look at this to see if there was anything specific that would prevent us from doing this with firewalld. All firewalls in a container have some limitations in my opinion because of possible packet changes in the host before even reaching the container. I do not see a reason that would prevent from using firewalld in a container as long as there is a way to properly use netfilter utilities like iptables etc. This would also apply to other firewalls. The only question for me right now is how to make the D-Bus interface usable within other containers, if this is needed. You'd clearly have to use host's network namespace - we have a number of other containers that do this, like the OpenShift router. You'd also have the iptables binaries inside the container. The DBus interface I think can be done by just binding in the host system bus socket. One long term question is around the higher level interactions with other host processes and other containers. Right now NetworkManager talks to firewalld - and we're bus activated even right? The "host exposure" of firewalld includes the polkit rules, and some other processes on the host or other containers may run firewall-cmd. So ultimately this would work best with https://github.com/projectatomic/atomic/pull/767 It looks like the OCP installer uses Ansible's firewalld module which requires the `python-firewall` bindings on the host currently (as all Ansible tends to do). That's going to be a pain. Long term, the biggest win will be teaching Ansible how to delegate operations to containers on the host. Short term...what openshift-ansible is doing seems relatively simplistic - "ensure these rules are allow, ensure these rules are deny", and perhaps it could be reworked to pass that data off to the firewalld container. This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle. Changing version to '26'. This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle. Changing version to '27'. system container work being done here: https://github.com/projectatomic/atomic-system-containers/pull/150 we are shipping firewalld in atomic host with RHELAH 7.5 so we should not longer need to do this work. |