Firewall management

[dann1]

As part of the deployment, it'd be nice to have the firewall on the hosts automatically set up to allow all of the connections required by opennebula. This list does not include the prometheus+grafana+am+exporters observability stack (should be changed upstream to reflect these).

• Consider the different flows we have, like kvm to kvm live migration or prometheus scrapping the nodes, or udp monitor push, etc..
• Consider also that as part of the configuration stated in the inventory, the ports might not be necessarily the default ones. So maybe the running processed configuration and the port is bound to, should be the source of truth.

Over time this has become more and more important since we are increasingly distributing exporters.

[sk4zuzu]

Hi @dann1

Do I undestand correctly this excercise is not to achieve actual reliable "management", it's more like just "opening some ports" from the list? 🤔

You see, one-deploy is not a proper place to introduce such feature really, as we cannot claim this simple project will secure all possible user environments. I think what we can do is to detect if solutions like ufw or firewalld are in use and then try to open ports using them on a best effort basis. Tinkering with raw iptables/nftables configs is out of the question here IMO. Would that be OK/enough? 😇

[dann1]

Yes indeed, maybe the title is not accurate enough, the goals is exactly open ports as an operational requirement, rather than securing the environment.

[sk4zuzu]

Also #67 this has been reported quite long ago already. You may get impression though Install and start firewalld is something that we would do in one-deploy, but I'd rather "detect then use" than force anything (like we do with NTP already). 👍😇

[dann1]

We have this PR to have a go-to place for open port and upstream connections. I guess it kinda solves that, it includes even one-deploy installation requirements.

[sk4zuzu]

This is great thank you. I'm guessing we'd do minimal setup just to allow cluster components to communicate as I don't think we can take resposibility for exposing any of the ports to the outside world, that's should be conscious user decision IMO. 🤔