deploy composable firewall rules for HAproxy

Deploy composable iptables rules for HAproxy.
Note: we can't use Hiera here because we have some logic in
puppet-tripelo that select the services that we actually deploy.
Using this code in the Define will easily create IPtables rules that we
actually need. Some other services will be able to create IPtables rules
in Hiera (in THT), but not HAproxy now.

Change-Id: If03b18992c68461e97789c0318078a0b243c84fe

diff --git a/manifests/haproxy/endpoint.pp b/manifests/haproxy/endpoint.pp
index 94bfcff..ac6cb6c 100644 (file)
--- a/manifests/haproxy/endpoint.pp
+++ b/manifests/haproxy/endpoint.pp
@@ -117,4 +117,16 @@ define tripleo::haproxy::endpoint (
     server_names      => $server_names,
     options           => $member_options,
   }
+  if hiera('manage_firewall', true) {
+    include ::tripleo::firewall
+    $firewall_rules = {
+      "100 ${name}_haproxy"     => {
+        'dport' => $service_port,
+      },
+      "100 ${name}_haproxy_ssl" => {
+        'dport' => $public_ssl_port,
+      },
+    }
+    create_resources('tripleo::firewall::rule', $firewall_rules)
+  }
 }