Switch to _guard_var templates for firewall rules on Ubuntu 24.04 #12902
Conversation
This change modifies the firewall package/service rules to use the templates `..._guard_var` introduced in ComplianceAsCode#11818 to selectively install the firewall that is chosen by the var_network_filtering_service It also fixes the platform applicability on Ubuntu 24.04 since it both required firewalld and required that conflicting services be disabled when installing packages. This interfered with the logic introduced in the new templates and could result in a package/service not be installed/enabled. For example, if the user selected 'nftables' as their firewall using the new template and variable, the rule package_nftables_installed would still be marked as not applicable because the ufw service is enabled by default on some installations. The proposed solution removes the applicability check and installs the package depending only on the choice of var_network_filtering_service, irrespective of the status of the ufw service.
Removing nftables is not a hard requirement for CIS. If removed, apt will also remove the ubuntu-standard package, which is recommended to not be removed from the system.
|
Hi @mpurg. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Code Climate has analyzed commit f6c6de5 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 61.9% (0.0% change). View more on Code Climate. |
mpurg
changed the title
Description:
Rationale: