I am trying to use a puppet master 3.1.1 to manage iptables on various servers. My local puppet agent is 2.7.19, the server OS is CentOS 5.4.
/etc/puppet/modules/mycompany/manifests/config/iptables.pp
class base::iptables (
{
{
$identity_environment = $::identity_environment
}
if ($identity_environment == "production")
{
$start_iptables = "true"
$run_iptables = "running"
}
elsif ($identity_environment == "development")
{
$start_iptables = "false"
$run_iptables = "stopped"
}
if ($run_iptables != "stopped")
{
file { "/etc/sysconfig/iptables":
ensure => file,
owner => root,
group => root,
mode => 644,
source => "puppet://path_to_my_conf",
require => File["/etc/resolv.conf"],
}
service { "iptables":
subscribe => File["/etc/sysconfig/iptables"],
enable => "$start_iptables",
ensure => "$run_iptables",
status => "[[ `iptables -L -n | egrep -v '(Chain|target)' | grep '^[A-Za-z]' | wc -l` != 0 ]]",
}
}
else
{
service { "iptables":
enable =>"$start_iptables",
ensure =>"$run_iptables",
}
}
}
When I run puppet on a development server:
puppet agent --verbose --no-daemonize --onetime --debug | grep iptable
the following occurs:
debug: Puppet::Type::Service::ProviderRedhat: Executing '/sbin/chkconfig iptables' debug: Serviceiptables: Executing '/sbin/service iptables stop' debug: Puppet::Type::Service::ProviderRedhat: Executing '/sbin/chkconfig iptables' notice: /Stage[main]/Base::Iptables/Service[iptables]/ensure: ensure changed 'running' to 'stopped' debug: /Stage[main]/Base::Iptables/Service[iptables]: The container Class[Base::Iptables] will propagate my refresh event debug: Serviceip6tables: Executing '/sbin/service ip6tables status' debug: Puppet::Type::Service::ProviderRedhat: Executing '/sbin/chkconfig ip6tables' debug: Class[Base::Iptables]: The container Stage[main] will propagate my refresh event
Checking manually with service iptables status
shows that the service is indeed running, is puppet stopping the service then somehow starting it due to that 'refresh'?
I attempted to alter my manifest according to this similar question but to no avail,
service { "iptables":
ensure => "stopped",
hasstatus => "true",
status => "true"
}
results in the same thing - puppet checking, then stopping iptables, but yet the service is turned back on.
I do not know if this could be related to this documented race condition bug that has been fixed in a newer puppet version, I do not have the option of updating or implementing a proper method such as puppetlab's firewall module at this time.
UPDATE [20140724]
After some great feedback here I did some debugging/logging from the /etc/init.d/iptables script. Come to find out When puppet was running, no calls to start the service were being made, however the OS still reported iptables as running even if puppet stopped it.
My inclination was to look at the iptables module itself. Sure enough if I removed the iptables module and then ran puppet again, the module would be re-loaded.
UPDATE [20140729]
My solution is listed below as an answer. I will open a new question for continuing to troubleshoot CentOS 6 with this.