Bug 1488492
| Summary: | fail to use jump with tripleo::firewall::rule | |||
|---|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Cyril Lopez <cylopez> | |
| Component: | puppet-tripleo | Assignee: | Emilien Macchi <emacchi> | |
| Status: | CLOSED ERRATA | QA Contact: | nlevinki <nlevinki> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 10.0 (Newton) | CC: | aschultz, cylopez, emacchi, gcaballe.ext, jjoyce, jschluet, ohochman, samccann, slinaber, tvignaud | |
| Target Milestone: | z5 | Keywords: | Triaged, ZStream | |
| Target Release: | 10.0 (Newton) | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | puppet-tripleo-5.6.1-4.el7ost | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1488631 (view as bug list) | Environment: | ||
| Last Closed: | 2017-09-28 16:35:22 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1488631 | |||
|
Description
Cyril Lopez
2017-09-05 14:06:39 UTC
It should be noted that the key is 'extras' not 'extra'. https://github.com/openstack/puppet-tripleo/blob/stable/newton/manifests/firewall/rule.pp#L62 So in theory we dont' need to backport the jump support as it should be available set the correct key in THT. The related bug was for first class support of jump so that it didn't need to be passed via 'extras'. Please have the customer try using 'extras' and let us know if that fixes the issue before we go backporting patches. Alex,
As you can see the example, we test it and also :
'410 allow marking':
port: 10051
proto: tcp
source: 10.0.0.8
action: undef
extra: {
table: mangle,
jump: dscp,
set_dscp: 12
}
But it doesn't work.
We try as t(In reply to Alex Schultz from comment #1)
> It should be noted that the key is 'extras' not 'extra'.
> https://github.com/openstack/puppet-tripleo/blob/stable/newton/manifests/
> firewall/rule.pp#L62 So in theory we dont' need to backport the jump
> support as it should be available set the correct key in THT. The related
> bug was for first class support of jump so that it didn't need to be passed
> via 'extras'. Please have the customer try using 'extras' and let us know
> if that fixes the issue before we go backporting patches.
Your example is wrong. Please try:
'410 allow marking':
port: 10051
proto: tcp
source: 10.0.0.8
action: undef
extras: {
table: mangle,
jump: dscp,
set_dscp: 12
}
This configuration has been tested :
'410 allow marking':
port: 10051
proto: tcp
source: 10.0.0.8
action: undef
extras: {
table: mangle,
jump: dscp,
set_dscp: 12
}
But it does not work either. We still have the default action set, not allowing us to use the jump parameter.
Ah I see, the problem is with the action: undef. You could try 'action: ~'. I'll approve the backport the changes since it adds the jump parameter and adds logic to handle the action. In the mean time you could try using 'action: ~' instead of 'action: undef' reference: https://tickets.puppetlabs.com/browse/PUP-3992 When this change is available, the configuration would be:
'410 allow marking':
port: 10051
proto: tcp
source: 10.0.0.8
jump: dscp,
extras: {
table: mangle,
set_dscp: 12
}
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2825 |