5f67b1f0c8
Add v1.0.2 of ncsa/puppet-profile_firewall Update puppetlabs/firewall from 2.5.0 to 3.0.0 Add data/role/puppet-master.yaml to set profile_firewall::ignores heira data so that docker firewall rules are not removed from puppet masters Include profile_firewall in base.pp
14 lines
479 B
YAML
14 lines
479 B
YAML
---
|
|
profile_firewall::ignores:
|
|
DOCKER:filter:IPv4: "*"
|
|
DOCKER-ISOLATION-STAGE-1:filter:IPv4: "*"
|
|
DOCKER-ISOLATION-STAGE-2:filter:IPv4: "*"
|
|
DOCKER-USER:filter:IPv4: "*"
|
|
FORWARD:filter:IPv4: ["docker", "DOCKER", "-o"]
|
|
DOCKER:nat:IPv4: "*"
|
|
PREROUTING:nat:IPv4: "-m addrtype --dst-type LOCAL -j DOCKER"
|
|
POSTROUTING:nat:IPv4: ["172.17", "172.18", "172.19"]
|
|
OUTPUT:nat:IPv4: "-d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER"
|
|
|
|
profile_firewall::purge_all: false
|