Skip to content

Commit b24e527

Browse files
damacusdamacus
committed
feat!: migrate firewall to custom resources
1 parent 08c64e5 commit b24e527

77 files changed

Lines changed: 1408 additions & 1414 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 30 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,9 @@ jobs:
99
lint-unit:
1010
uses: sous-chefs/.github/.github/workflows/lint-unit.yml@6.0.0
1111
permissions:
12-
actions: write
1312
checks: write
1413
pull-requests: write
1514
statuses: write
16-
issues: write
1715

1816
integration:
1917
needs: lint-unit
@@ -35,22 +33,22 @@ jobs:
3533
os: centos-stream-9
3634
- suite: default
3735
os: centos-stream-10
38-
- suite: default
39-
os: debian-11
4036
- suite: default
4137
os: debian-12
4238
- suite: default
43-
os: fedora-latest
39+
os: debian-13
4440
- suite: default
45-
os: opensuse-leap-15
41+
os: fedora-latest
4642
- suite: default
47-
os: oracle-8
43+
os: oraclelinux-8
4844
- suite: default
49-
os: oracle-9
45+
os: oraclelinux-9
5046
- suite: default
5147
os: rockylinux-8
5248
- suite: default
5349
os: rockylinux-9
50+
- suite: default
51+
os: rockylinux-10
5452
- suite: default
5553
os: ubuntu-2204
5654
- suite: default
@@ -69,24 +67,22 @@ jobs:
6967
os: centos-stream-9
7068
- suite: firewalld-simple
7169
os: centos-stream-10
72-
- suite: firewalld-simple
73-
os: debian-11
7470
- suite: firewalld-simple
7571
os: debian-12
7672
- suite: firewalld-simple
77-
os: fedora-latest
73+
os: debian-13
7874
- suite: firewalld-simple
79-
os: opensuse-leap-15
75+
os: fedora-latest
8076
- suite: firewalld-simple
81-
os: oracle-8
77+
os: oraclelinux-8
8278
- suite: firewalld-simple
83-
os: oracle-9
79+
os: oraclelinux-9
8480
- suite: firewalld-simple
8581
os: rockylinux-8
8682
- suite: firewalld-simple
8783
os: rockylinux-9
8884
- suite: firewalld-simple
89-
os: ubuntu-2004
85+
os: rockylinux-10
9086
- suite: firewalld-simple
9187
os: ubuntu-2204
9288
- suite: firewalld-simple
@@ -99,16 +95,16 @@ jobs:
9995
os: almalinux-9
10096
- suite: ufw
10197
os: centos-stream-9
102-
- suite: ufw
103-
os: debian-11
10498
- suite: ufw
10599
os: debian-12
100+
- suite: ufw
101+
os: debian-13
106102
# - suite: ufw # Fails on GitHub Actions with: Module ip6_tables not found in directory /lib/modules/6.8.0-1017-azure
107103
# os: fedora-latest
108104
- suite: ufw
109-
os: oracle-8
105+
os: oraclelinux-8
110106
- suite: ufw
111-
os: oracle-9
107+
os: oraclelinux-9
112108
- suite: ufw
113109
os: rockylinux-8
114110
- suite: ufw
@@ -131,14 +127,14 @@ jobs:
131127
os: centos-stream-9
132128
- suite: iptables
133129
os: centos-stream-10
134-
- suite: iptables
135-
os: debian-11
136130
- suite: iptables
137131
os: debian-12
132+
- suite: iptables
133+
os: debian-13
138134
# - suite: iptables # Fails on GitHub Actions with: ip6tables.service failed
139135
# os: fedora-latest
140136
- suite: iptables
141-
os: oracle-8
137+
os: oraclelinux-8
142138
- suite: iptables
143139
os: rockylinux-8
144140
- suite: iptables
@@ -149,14 +145,14 @@ jobs:
149145
os: ubuntu-2404
150146

151147
# NFTables suite
152-
- suite: nftables
153-
os: debian-11
154148
- suite: nftables
155149
os: debian-12
156150
- suite: nftables
157-
os: oracle-8
151+
os: debian-13
152+
- suite: nftables
153+
os: oraclelinux-8
158154
- suite: nftables
159-
os: oracle-9
155+
os: oraclelinux-9
160156

161157
# Firewalld advanced suite
162158
- suite: firewalld-advanced
@@ -171,37 +167,32 @@ jobs:
171167
os: centos-stream-9
172168
- suite: firewalld-advanced
173169
os: centos-stream-10
174-
- suite: firewalld-advanced
175-
os: debian-11
176170
- suite: firewalld-advanced
177171
os: debian-12
178172
- suite: firewalld-advanced
179-
os: fedora-latest
173+
os: debian-13
180174
- suite: firewalld-advanced
181-
os: opensuse-leap-15
175+
os: fedora-latest
182176
- suite: firewalld-advanced
183-
os: oracle-8
177+
os: oraclelinux-8
184178
- suite: firewalld-advanced
185-
os: oracle-9
179+
os: oraclelinux-9
186180
- suite: firewalld-advanced
187181
os: rockylinux-8
188182
- suite: firewalld-advanced
189183
os: rockylinux-9
184+
- suite: firewalld-advanced
185+
os: rockylinux-10
190186
- suite: firewalld-advanced
191187
os: ubuntu-2204
192188
- suite: firewalld-advanced
193189
os: ubuntu-2404
194190

195-
# TODO: Windows suite
196-
# - suite: windows
197-
# os: windows-2016
198-
# - suite: windows
199-
# os: windows-2019
200191
steps:
201192
- name: Checkout code
202193
uses: actions/checkout@v6
203-
- name: Install Chef
204-
uses: actionshub/chef-install@6.0.0
194+
- name: Install Cinc Workstation
195+
uses: sous-chefs/.github/.github/actions/install-workstation@6.0.0
205196
- name: Dokken
206197
uses: actionshub/test-kitchen@3.0.0
207198
env:

‎.github/workflows/conventional-commits.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,5 @@ name: conventional-commits
1212
jobs:
1313
conventional-commits:
1414
uses: sous-chefs/.github/.github/workflows/conventional-commits.yml@6.0.0
15+
permissions:
16+
pull-requests: read

‎.github/workflows/prevent-file-change.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,7 @@ name: prevent-file-change
1212
jobs:
1313
prevent-file-change:
1414
uses: sous-chefs/.github/.github/workflows/prevent-file-change.yml@6.0.0
15+
permissions:
16+
pull-requests: write
1517
secrets:
1618
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ permissions:
1010
contents: write
1111
issues: write
1212
pull-requests: write
13-
packages: write
1413
attestations: write
14+
artifact-metadata: write
1515
id-token: write
1616

1717
jobs:
@@ -21,3 +21,5 @@ jobs:
2121
token: ${{ secrets.PORTER_GITHUB_TOKEN }}
2222
supermarket_user: ${{ secrets.CHEF_SUPERMARKET_USER }}
2323
supermarket_key: ${{ secrets.CHEF_SUPERMARKET_KEY }}
24+
slack_bot_token: ${{ secrets.SLACK_BOT_TOKEN }}
25+
slack_channel_id: ${{ secrets.SLACK_CHANNEL_ID }}

‎Berksfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ metadata
44

55
group :integration do
66
cookbook 'apt'
7-
cookbook 'firewall-test', path: 'test/fixtures/cookbooks/firewall-test'
8-
cookbook 'nftables-test', path: 'test/fixtures/cookbooks/nftables-test'
9-
cookbook 'firewalld-test', path: 'test/fixtures/cookbooks/firewalld-test'
7+
cookbook 'test', path: 'test/cookbooks/test'
8+
cookbook 'nftables_test', path: 'test/cookbooks/nftables_test'
9+
cookbook 'firewalld_test', path: 'test/cookbooks/firewalld_test'
1010
end

‎CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -430,7 +430,7 @@ Minor bugfix release.
430430
## v1.1.2 (2015-05-19)
431431

432432
* 60 - Always add /32 or /128 to ipv4 or ipv6 addresses, respectively
433-
- Make comment quoting optional; iptables on Ubuntu strips quotes on strings without any spaces
433+
* Make comment quoting optional; iptables on Ubuntu strips quotes on strings without any spaces
434434

435435
## v1.1.1 (2015-05-11)
436436

‎LIMITATIONS.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Limitations
2+
3+
## Platform Support
4+
5+
This cookbook manages firewall frontends that ship with operating system package
6+
repositories. It does not add external package repositories.
7+
8+
### Linux
9+
10+
* Debian 12 and 13: `ufw`, `iptables`, `nftables`, and `firewalld` packages are available from Debian repositories. Debian recommends nftables as the default packet filtering framework.
11+
* Ubuntu 22.04 and 24.04: `ufw`, `iptables`, `nftables`, and `firewalld` packages are available from Ubuntu repositories.
12+
* RHEL-compatible platforms 8, 9, and 10: firewalld is the default supported frontend. iptables compatibility packages remain available, but Red Hat documents iptables-nft and ipset as deprecated in RHEL 9 and recommends nftables for direct ruleset management.
13+
* Amazon Linux 2023: firewalld and iptables compatibility packages are available from the base repositories. UFW is not included in the base repositories.
14+
* Fedora: firewalld is the default firewall frontend and uses nftables as its backend.
15+
16+
### Windows
17+
18+
Windows support uses the built-in Windows Firewall through `netsh advfirewall`.
19+
The current support target is Windows Server 2022 or newer.
20+
21+
## Package Availability
22+
23+
| Platform family | Primary backend | Notes |
24+
| ---------------------------- | ----------------- | ----------------------------------------------------------------------------------------------------- |
25+
| Debian/Ubuntu | UFW | The `solution` property can select `:iptables` or `:firewalld` for explicit test and migration cases. |
26+
| RHEL/Fedora/Amazon/SUSE-like | firewalld | UFW requires additional repositories and is not part of all supported platform base repositories. |
27+
| Windows | Windows Firewall | Uses the built-in `MpsSvc` service and `netsh advfirewall`. |
28+
29+
## Known Issues
30+
31+
* This cookbook does not configure external package repositories such as EPEL.
32+
* UFW on RHEL-family systems depends on repository availability outside this cookbook.
33+
* Linux container integration tests require privileged Dokken containers with systemd.
34+
* Windows integration tests require a Windows runner and are not part of the Linux Dokken matrix.

0 commit comments

Comments
 (0)