sjat
d1941c987e
Adds a nftables drop-in (10-libvirt-boma.nft) to base's drop-in dir that allows traffic on iifname "virbr-boma" in the inet filter input chain. Fixes DHCP/DNS being dropped by base's default-deny INPUT policy for VMs on the libvirt integration bridge. Mirrors docker_host's drop-in pattern. Molecule scenario updated to exercise only the firewall tasks (package install unavailable in the no-internet Docker container) via include_role tasks_from; verify asserts the drop-in renders the virbr-boma accept rule. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
18 lines
670 B
YAML
18 lines
670 B
YAML
---
|
|
# Package-install and cache-dir tasks are skipped (converge runs `firewall` tag only;
|
|
# KVM/libvirt packages cannot be fetched in the Docker container). This scenario
|
|
# verifies the nftables drop-in renders correctly.
|
|
- name: Verify
|
|
hosts: all
|
|
become: true
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Read the libvirt bridge nftables drop-in
|
|
ansible.builtin.slurp:
|
|
src: /etc/nftables.d/10-libvirt-boma.nft
|
|
register: _dropin
|
|
- name: Assert drop-in contains virbr-boma accept rule
|
|
ansible.builtin.assert:
|
|
that:
|
|
- "'virbr-boma' in (_dropin.content | b64decode)"
|
|
- "'accept' in (_dropin.content | b64decode)"
|