On Mon, Mar 27, 2017 at 2:38 PM, Yaniv Dary <ydary@redhat.com> wrote:
Hi, I like option number 3 the most from reading the comments. We are not a configuration management system, so custom rules should not be a main consideration. VDSM should probably enable the firewalld rules it needs to work and engine should not care about firewall at all. A user wanting to add more rules then this should probably use the ones planned in: https://github.com/cockpit-project/system-api-roles
I, too, like the idea of shedding off the attempt to configure custom iptables rules. Moving to firewalld makes it much easier to manage such customization out of oVirt. (Anybody who's ever edited iptables chains by hand would know what I mean) Please note that what you describe is Leon's alternative (2.). Where Vdsm, as oVirt host agent, has complete responsibility on configuring the services needed by oVirt. There is no Engine/Vdsm interaction in alternative (2.). Option (3.) requires Engine to provide a list of services to the host.