All -
I’ve posted an iptables module here:
https://github.com/brainpage/ansible-library
The module has undergone a certain amount of tests; however, I wanted to solicit any input (API, design) from the community before we modify our playbooks to use this and properly verify the module. We will post a number of examples in a few days.
The module by reading the output of iptables-save, parsing (and saving to /etc/sysconfig/iptables) and then reloading with iptables multi.
The commented description of how to use the module below. Appreciate thoughts!
Thanks -
JP
This is an opinionated iptables module. Opinionated because as long as you
stay within its “opinions” it is idempotent.
It is designed primarily for specific task lists/playbooks to add or remove rules.
You can’t do complex chains and ordering. You CAN make sure ports are open or
closed based on what is running on the server.
I've always liked the idea of managing iptables from a single template, and then using the save/load functionality, that way you're not stuck with knowing what things happened on a system outside of config management, and things can be 100%
declarative.
Using the new "assemble" module to build iptables configs (available in the core starting with 0.5) from files may also be reasonable.
The problem I was having with one big template - which I suppose is more stylistic then technical - is I wanted to put the iptable rules configuration inline with the software/package setup. i.e. we have a tasks/install_erlang.yml and I want the iptables config for erlang to be in that file. The motivation for this was we have two clusters with different play books but 50% shared task files. I found myself going through the iptables template of one and copying to the other as well as adding new setup tasks into our “shared” tasks repository but then adding the correct iptables rules in each template - rather breaking DRY… and just annoying :).
I would argue the technique above is fundamentally the same as using the “assemble” module: its not generating an iptables but rather just checking whether rules are or are not in a certain place in the config.