I have noticed a very strange problem on CentOS 7 nodes where they are
collecting and/or applying their exported resources. I have a class called
"brazos::firewall" that's used internally to export a firewall rule that is
then collected by "brazos::gw" to allow specific systems through the
gateway server's NAT. Below are the actual classes. I've found that on
CentOS 6 systems, the resource is correctly exported (NOT applied by
exporting host) and collected by the gw server. On CentOS 7 systems the
resource is exported, and also applied by the exporting host when it's not
supposed to be.
All systems are running Puppet 3.6.2. I have tested this issue using the
Pupppetlabs yum repo version of Puppet as well as the EPEL7 version, both
show this issue.
How can this behavior be debugged?
I have looked in /var/lib/puppet/state/classes.txt on the nodes incorrectly
applying their exported resource and the "brazos::gw" class is not listed.
I have no idea WHY the Firewall resource is being applied when it should
be exported.
I am using Hiera to assign classes and set parameters and Foreman to set
the environment and provide various top-scope variables. The only thing
applied to EL7 systems that's different than EL6 systems in my Hiera
configuration is the path to EPEL repos, paths to a few commands (like
mco), and the Puppet version. No separate classes are applied that differ
from EL6 systems.
Thanks
- Trey
brazos::firewall:
class brazos::firewall (
$allow_forward = false,
) inherits brazos::params {
validate_bool($allow_forward)
if $allow_forward {
@@firewall { "050 allow forward ${::fqdn}":
ensure => 'present',
chain => 'FORWARD',
action => 'accept',
proto => 'all',
source => $::fqdn,
destination => '0.0.0.0/0',
tag => 'allow_forward',
}
}
}
brazos::gw:
class brazos::gw (
$private_interface = 'UNSET',
$private_subnet = '192.168.200.0/22',
$ib_interface = 'ib0',
$ib_subnet = '192.168.208.0/22',
$public_interface = 'UNSET',
) inherits brazos::params {
<snip>
Firewall <<| tag == 'allow_forward' |>>
<snip>
}
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/15ce31eb-07bd-4076-bc75-4f51f577162f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
