Description of problem: When deploying the mgmt-gateway service with cephadm and not specifying a port explicitly (neither via --port nor via the service spec), the gateway listens on the default HTTPS port (443) as expected, but cephadm does not open this port in firewalld. As a result, the dashboard is only accessible locally on the gateway node while firewalld is running. Remote access works only if firewalld is stopped or manually configured (e.g. firewall-cmd --add-service=https). Version-Release number of selected component (if applicable): All releases are affected How reproducible: Always, when mgmt-gateway is deployed without an explicit port and firewalld is active and not pre-configured for HTTPS. Steps to Reproduce: 1. Deploy a cephadm-managed cluster and enable firewalld on the host where mgmt-gateway will run (no https service / port 443 opened yet). 2. Deploy the mgmt-gateway service without specifying a port: no --port argument and no port field in the MgmtGatewaySpec. 3. From the gateway node, run curl -k https://<mgmt-gateway-ip> (this request must succeed) 4. From a different node or a remote machine, run the same curl -k https://<mgmt-gateway-ip> and observe that this request fails while firewalld is running. 5. Stop firewalld or manually run firewall-cmd --add-service=https and retry from the remote host (request now succeeds.) Actual results: 1. mgmt-gateway listens on HTTPS and is reachable locally on the gateway node. 2. 443 port is not open in the firewalld service Expected results: cephadm must open the 443 HTTPS when mgmt-gateway is deployed using defaults (without an explicit port) in a node where firewalld service is active. Additional info: