Bug 9266 Remove all security group related configs

From Carbon and beyond, only supported sg mode is stateful.
Hence all of the related configs can be removed.

Change-Id: Id11ce69233c1a0d6982f53cf6a1c0f47bda2e679
Signed-Off-By: Janki Chhatbar <jchhatba@redhat.com>

diff --git a/CHANGELOG b/CHANGELOG
index a9a7b0ba972f0194e324669776cf0a67718950a7..9abfc56c8074b8443e060ae77291946f28eaf8a7 100644 (file)
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -46,3 +46,5 @@
 - Add log size/rotate config params
 2017-08-14 Release 4.2.0
 - Add param to config SNAT mechanism
+2017-10-11 Release 5.0.0
+- Only support stateful security mode. Remove all related configs
\ No newline at end of file

diff --git a/README.markdown b/README.markdown
index 03b88ee4fde302af5eaf41bb2b5a2ff2fcc4326e..bf9f434c43dd276850713ec00e326312f0526aa5 100644 (file)
--- a/README.markdown
+++ b/README.markdown
@@ -343,14 +343,6 @@ Valid options: Index of a member of the array `ha_node_ips`: `0`.
 
 This parameter is now deprecated and is no longer used.
 
-##### `security_group_mode`
-
-Specifies the mode to use for security groups.
-
-Default: `stateful`
-
-Valid options: `transparent`, `learn`, `stateless`
-
 ##### `snat_mechanism`
 
 Specifies the mechanism to be used for SNAT.

diff --git a/manifests/config.pp b/manifests/config.pp
index 373b8ad688edc9ee1d20eb270ca96c40d762e938..4d6d4a02fd3b2b4646bde83e414874fde7abc132 100644 (file)
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -125,19 +125,7 @@ class opendaylight::config {
   }
 
   if ('odl-netvirt-openstack' in $opendaylight::features or 'odl-netvirt-sfc' in $opendaylight::features) {
-    # Configure ACL security group
-    # Requires at least CentOS 7.3 for RHEL/CentOS systems
-    if $opendaylight::security_group_mode == 'stateful' {
-      if defined('$opendaylight::stateful_unsupported') and $opendaylight::stateful_unsupported {
-          warning("Stateful is unsupported in ${::operatingsystemrelease} setting to 'learn'")
-          $sg_mode = 'learn'
-      } else {
-        $sg_mode = 'stateful'
-      }
-    } else {
-      $sg_mode = $opendaylight::security_group_mode
-    }
-
+    # Configure SNAT
     $odl_datastore = [
       '/opt/opendaylight/etc/opendaylight',
       '/opt/opendaylight/etc/opendaylight/datastore',
@@ -151,16 +139,7 @@ class opendaylight::config {
       owner  => 'odl',
       group  => 'odl',
     }
-    -> file { 'netvirt-aclservice-config.xml':
-      ensure  => file,
-      path    => '/opt/opendaylight/etc/opendaylight/datastore/initial/config/netvirt-aclservice-config.xml',
-      owner   => 'odl',
-      group   => 'odl',
-      content => template('opendaylight/netvirt-aclservice-config.xml.erb'),
-    }
-
-    # Configure SNAT
-    file { 'netvirt-natservice-config.xml':
+    -> file { 'netvirt-natservice-config.xml':
       ensure  => file,
       path    => '/opt/opendaylight/etc/opendaylight/datastore/initial/config/netvirt-natservice-config.xml',
       owner   => 'odl',

diff --git a/manifests/init.pp b/manifests/init.pp
index 99bee07e5e884f8cce5d4de133966438c01bdb51..1547e1a08a7a8e6bb4a82361c5d551d6d0a848a9 100644 (file)
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -28,8 +28,6 @@
 # [*ha_db_modules*]
 #   Hash of modules and Yang namespaces to create database shards.  Defaults to
 #   { 'default' => false }.  "default" module does not need a namespace.
-# [*security_group_mode*]
-#   Sets the mode to use for security groups (stateful, learn, stateless, transparent)
 # [*vpp_routing_node*]
 #   Sets routing node for VPP deployments. Defaults to ''.
 # [*java_opts*]
@@ -62,7 +60,6 @@ class opendaylight (
   $ha_node_ips         = $::opendaylight::params::ha_node_ips,
   $ha_node_index       = $::opendaylight::params::ha_node_index,
   $ha_db_modules       = $::opendaylight::params::ha_db_modules,
-  $security_group_mode = $::opendaylight::params::security_group_mode,
   $vpp_routing_node    = $::opendaylight::params::vpp_routing_node,
   $java_opts           = $::opendaylight::params::java_opts,
   $manage_repositories = $::opendaylight::params::manage_repositories,
@@ -90,12 +87,7 @@ class opendaylight (
       if $::operatingsystemmajrelease != '7' {
         # RHEL/CentOS versions < 7 not supported as they lack systemd
         fail("Unsupported OS: ${::operatingsystem} ${::operatingsystemmajrelease}")
-      } elsif defined('$::operatingsystemrelease') {
-          if (versioncmp($::operatingsystemrelease, '7.3') < 0) {
-            # Versions < 7.3 do not support stateful security groups
-            $stateful_unsupported = true
-          }
-        }
+      }
     }
     fedora: {
       # Fedora distros < 24 are EOL as of 2016-12-20

diff --git a/manifests/params.pp b/manifests/params.pp
index 5790a842c2eae31196903aa5d181776886ca5724..84805522b0dced005d528291b57d2d4ea5d384aa 100644 (file)
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -19,7 +19,6 @@ class opendaylight::params {
   $ha_node_ips = []
   $ha_node_index = 0
   $ha_db_modules = { 'default' => false }
-  $security_group_mode = 'stateful'
   $vpp_routing_node = ''
   $java_opts = '-Djava.net.preferIPv4Stack=true'
   $manage_repositories = true

diff --git a/metadata.json b/metadata.json
index 9dfea462d3987bdd173917f5321e875f7a21b4ca..713b3ef3f602ac5fdc4d11b655b8acf9f6908639 100644 (file)
--- a/metadata.json
+++ b/metadata.json
@@ -1,6 +1,6 @@
 {
     "name": "opendaylight-opendaylight",
-    "version": "4.2.0",
+    "version": "5.0.0",
     "author": "Daniel Farrell",
     "summary": "Puppet module that installs and configures the OpenDaylight SDN controller",
     "license": "BSD-2-Clause",

diff --git a/spec/classes/opendaylight_spec.rb b/spec/classes/opendaylight_spec.rb
index e591fbb8a0f6de31e05db1b8b2ed03704d61f6cd..0b6f2fe5c100a9a74d2bd600d0066d72b696c420 100644 (file)
--- a/spec/classes/opendaylight_spec.rb
+++ b/spec/classes/opendaylight_spec.rb
@@ -731,82 +731,6 @@ describe 'opendaylight' do
         deb_install_tests(deb_repo: deb_repo)
       end
     end
-
-  end
-
-  # Security Group Tests
-  describe 'security group tests' do
-    # Non-OS-type tests assume CentOS 7
-    #   See issue #43 for reasoning:
-    #   https://github.com/dfarrell07/puppet-opendaylight/issues/43#issue-57343159
-    osfamily = 'RedHat'
-    operatingsystem = 'CentOS'
-    operatingsystemmajrelease = '7'
-    context 'using supported stateful' do
-      let(:facts) {{
-        :osfamily => osfamily,
-        :operatingsystem => operatingsystem,
-        :operatingsystemmajrelease => operatingsystemmajrelease,
-        :operatingsystemrelease => '7.3',
-      }}
-
-      let(:params) {{
-        :security_group_mode => 'stateful',
-        :extra_features      => ['odl-netvirt-openstack'],
-      }}
-
-      # Run shared tests applicable to all supported OSs
-      # Note that this function is defined in spec_helper
-      generic_tests
-
-      # Run test that specialize in checking security groups
-      # Note that this function is defined in spec_helper
-      enable_sg_tests('stateful', '7.3')
-    end
-
-    context 'using unsupported stateful' do
-      let(:facts) {{
-        :osfamily => osfamily,
-        :operatingsystem => operatingsystem,
-        :operatingsystemmajrelease => operatingsystemmajrelease,
-        :operatingsystemrelease => '7.2.1511',
-      }}
-
-      let(:params) {{
-        :security_group_mode => 'stateful',
-        :extra_features      => ['odl-netvirt-openstack'],
-      }}
-
-      # Run shared tests applicable to all supported OSs
-      # Note that this function is defined in spec_helper
-      generic_tests
-
-      # Run test that specialize in checking security groups
-      # Note that this function is defined in spec_helper
-      enable_sg_tests('stateful', '7.2.1511')
-    end
-
-    context 'using transparent with unsupported stateful' do
-      let(:facts) {{
-        :osfamily => osfamily,
-        :operatingsystem => operatingsystem,
-        :operatingsystemmajrelease => operatingsystemmajrelease,
-        :operatingsystemrelease => '7.2.1511',
-      }}
-
-      let(:params) {{
-        :security_group_mode => 'transparent',
-        :extra_features      => ['odl-netvirt-openstack'],
-      }}
-
-      # Run shared tests applicable to all supported OSs
-      # Note that this function is defined in spec_helper
-      generic_tests
-
-      # Run test that specialize in checking security groups
-      # Note that this function is defined in spec_helper
-      enable_sg_tests('transparent', '7.2.1511')
-    end
   end
 
   # SNAT Mechanism tests

diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index a348d17a53b6b59c7e0bef1064aa31cf75adfaff..b241eb74e6843034425d50b4180712578d713c8f 100644 (file)
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -307,42 +307,6 @@ def unsupported_os_tests(options = {})
   it { expect { should contain_file('org.apache.karaf.features.cfg') }.to raise_error(Puppet::Error, /#{expected_msg}/) }
 end
 
-# Shared tests that specialize in testing security group mode
-def enable_sg_tests(sg_mode='stateful', os_release)
-  # Extract params
-  # NB: This default value should be the same as one in opendaylight::params
-  # TODO: Remove this possible source of bugs^^
-
-  it { should contain_file('/opt/opendaylight/etc/opendaylight') }
-  it { should contain_file('/opt/opendaylight/etc/opendaylight/datastore')}
-  it { should contain_file('/opt/opendaylight/etc/opendaylight/datastore/initial')}
-  it { should contain_file('/opt/opendaylight/etc/opendaylight/datastore/initial/config')}
-
-  if os_release != '7.3' and sg_mode == 'stateful'
-    # Confirm sg_mode becomes learn
-    it {
-      should contain_file('netvirt-aclservice-config.xml').with(
-        'ensure'      => 'file',
-        'path'        => '/opt/opendaylight/etc/opendaylight/datastore/initial/config/netvirt-aclservice-config.xml',
-        'owner'   => 'odl',
-        'group'   => 'odl',
-        'content'     => /learn/
-      )
-    }
-  else
-    # Confirm other sg_mode is passed correctly
-    it {
-      should contain_file('netvirt-aclservice-config.xml').with(
-        'ensure'      => 'file',
-        'path'        => '/opt/opendaylight/etc/opendaylight/datastore/initial/config/netvirt-aclservice-config.xml',
-        'owner'   => 'odl',
-        'group'   => 'odl',
-        'content'     => /#{sg_mode}/
-      )
-    }
-  end
-end
-
 # Shared tests that specialize in testing SNAT mechanism
 def snat_mechanism_tests(snat_mechanism='controller')
   it { should contain_file('/opt/opendaylight/etc/opendaylight') }

diff --git a/templates/netvirt-aclservice-config.xml.erb b/templates/netvirt-aclservice-config.xml.erb
deleted file mode 100644 (file)
index 25aaa0e..0000000
--- a/templates/netvirt-aclservice-config.xml.erb
+++ /dev/null
@@ -1,3 +0,0 @@
-<aclservice-config xmlns="urn:opendaylight:netvirt:aclservice-config">
-  <security-group-mode><%= scope.lookupvar('opendaylight::config::sg_mode') %></security-group-mode>
-</aclservice-config>