Fix cloudmon-deploy-zuul-debian job

cloudmon/ansible/project/roles/apimon_executor/tasks/main.yml

@@ -36,7 +36,7 @@
   retries: 5
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -59,7 +59,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"

cloudmon/ansible/project/roles/apimon_scheduler/tasks/main.yml

@@ -38,7 +38,7 @@
   retries: 5
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -61,7 +61,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -93,6 +93,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - include_tasks: firewall.yml
+  when: cloudmon_manage_firewall | default(true) | bool
 
 - name: Create scheduler group
   become: yes

cloudmon/ansible/project/roles/carbonapi/tasks/main.yaml

@@ -36,7 +36,7 @@
   retries: 5
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -59,7 +59,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"

cloudmon/ansible/project/roles/carbonapi/vars/Debian.yaml

@@ -6,7 +6,7 @@
 remove_packages: []
 
 packages:
-  - netcat
+  - netcat-openbsd
   - policycoreutils-python-utils
   - python3-selinux
 

cloudmon/ansible/project/roles/epmon/tasks/main.yml

@@ -37,7 +37,7 @@
   retries: 5
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -60,7 +60,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"

cloudmon/ansible/project/roles/etcd/tasks/main.yaml

@@ -36,7 +36,7 @@
   retries: 5
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -59,7 +59,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -96,6 +96,7 @@
   loop: "{{ play_hosts }}"
 
 - ansible.builtin.include_tasks: firewall.yml
+  when: cloudmon_manage_firewall | default(true) | bool
 
 - name: Ensure directories exist
   become: true

cloudmon/ansible/project/roles/firewalld/tasks/main.yaml

@@ -1,64 +1,7 @@
-- name: Include OS-specific variables
-  include_vars: "{{ lookup('first_found', params) }}"
-  vars:
-    params:
-      files: "{{ distro_lookup_path }}"
-      paths:
-        - 'vars'
-
-- name: Install firewalld
-  ansible.builtin.package:
-    name: "{{ item }}"
-    state: "present"
-  loop:
-    - "{{ packages }}"
-  when: "ansible_facts.pkg_mgr != 'atomic_container'"
-
-- name: Enable services
-  ansible.posix.firewalld:
-    permanent: "yes"
-    service: "{{ item }}"
-    state: "enabled"
-  loop: "{{ firewalld_services_enable }}"
-  notify:
-    - Reload firewalld
-
-- name: Disable services
-  ansible.posix.firewalld:
-    permanent: "yes"
-    service: "{{ item }}"
-    state: "disabled"
-  loop: "{{ firewalld_services_disable }}"
-  notify:
-    - Reload firewalld
-
-- name: Enable ports
-  ansible.posix.firewalld:
-    permanent: "yes"
-    port: "{{ item }}"
-    state: "enabled"
-  loop: "{{ firewalld_ports_enable }}"
-  notify:
-    - Reload firewalld
-
-- name: Disable ports
-  ansible.posix.firewalld:
-    permanent: "yes"
-    port: "{{ item }}"
-    state: "disabled"
-  loop: "{{ firewalld_ports_disable }}"
-  notify:
-    - Reload firewalld
-
-- name: Disable iptables
-  ansible.builtin.service:
-    name: "iptables"
-    state: "stopped"
-    enabled: "false"
-  ignore_errors: "true"
-
-- name: Enable firewalld
-  ansible.builtin.service:
-    name: "firewalld"
-    state: "started"
-    enabled: "true"
+---
+# Host firewall management is meaningless in a container (no service manager,
+# no host firewall), so allow targets to opt out. Defaults to true, so
+# existing VM-based deployments are unaffected.
+- name: Manage host firewall
+  ansible.builtin.include_tasks: manage.yaml
+  when: cloudmon_manage_firewall | default(true) | bool

cloudmon/ansible/project/roles/firewalld/tasks/manage.yaml

@@ -0,0 +1,64 @@
+- name: Include OS-specific variables
+  include_vars: "{{ lookup('first_found', params) }}"
+  vars:
+    params:
+      files: "{{ distro_lookup_path }}"
+      paths:
+        - 'vars'
+
+- name: Install firewalld
+  ansible.builtin.package:
+    name: "{{ item }}"
+    state: "present"
+  loop:
+    - "{{ packages }}"
+  when: "ansible_facts.pkg_mgr != 'atomic_container'"
+
+- name: Enable services
+  ansible.posix.firewalld:
+    permanent: "yes"
+    service: "{{ item }}"
+    state: "enabled"
+  loop: "{{ firewalld_services_enable }}"
+  notify:
+    - Reload firewalld
+
+- name: Disable services
+  ansible.posix.firewalld:
+    permanent: "yes"
+    service: "{{ item }}"
+    state: "disabled"
+  loop: "{{ firewalld_services_disable }}"
+  notify:
+    - Reload firewalld
+
+- name: Enable ports
+  ansible.posix.firewalld:
+    permanent: "yes"
+    port: "{{ item }}"
+    state: "enabled"
+  loop: "{{ firewalld_ports_enable }}"
+  notify:
+    - Reload firewalld
+
+- name: Disable ports
+  ansible.posix.firewalld:
+    permanent: "yes"
+    port: "{{ item }}"
+    state: "disabled"
+  loop: "{{ firewalld_ports_disable }}"
+  notify:
+    - Reload firewalld
+
+- name: Disable iptables
+  ansible.builtin.service:
+    name: "iptables"
+    state: "stopped"
+    enabled: "false"
+  ignore_errors: "true"
+
+- name: Enable firewalld
+  ansible.builtin.service:
+    name: "firewalld"
+    state: "started"
+    enabled: "true"

cloudmon/ansible/project/roles/globalmon/tasks/main.yml

@@ -42,7 +42,7 @@
   retries: 5
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -65,7 +65,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"

cloudmon/ansible/project/roles/grafana/tasks/main.yml

@@ -36,7 +36,7 @@
   retries: 5
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -59,7 +59,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -91,6 +91,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - include_tasks: firewall.yml
+  when: cloudmon_manage_firewall | default(true) | bool
 
 - name: Create Grafana group
   ansible.builtin.group:

cloudmon/ansible/project/roles/graphite/tasks/main.yaml

@@ -36,7 +36,7 @@
   retries: 5
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -59,7 +59,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -91,6 +91,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - include_tasks: firewall.yml
+  when: cloudmon_manage_firewall | default(true) | bool
 
 - name: Create graphite sync group
   become: yes

cloudmon/ansible/project/roles/graphite/vars/Debian.yaml

@@ -6,6 +6,6 @@
 remove_packages: []
 
 packages:
-  - netcat
+  - netcat-openbsd
 
 container_command: docker

cloudmon/ansible/project/roles/postgresql/tasks/main.yaml

@@ -36,7 +36,7 @@
   retries: 5
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -59,7 +59,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -91,6 +91,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - include_tasks: firewall.yml
+  when: cloudmon_manage_firewall | default(true) | bool
 
 - name: Write Postgres Systemd unit file
   become: true

cloudmon/ansible/project/roles/postgresql_ha/tasks/main.yaml

@@ -36,7 +36,7 @@
   retries: 5
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -59,7 +59,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -102,6 +102,7 @@
   when: "item != inventory_hostname"
 
 - ansible.builtin.include_tasks: firewall.yml
+  when: cloudmon_manage_firewall | default(true) | bool
 
 - name: Create postgres group
   become: yes

cloudmon/ansible/project/roles/statsd/tasks/main.yaml

@@ -36,7 +36,7 @@
   when: "ansible_facts.pkg_mgr != 'atomic_container'"
 
 - name: Clean up stale sockets after package changes
-  ansible.builtin.block:
+  block:
     - name: Stop Docker service and socket
       ansible.builtin.systemd:
         name: "{{ item }}"
@@ -59,7 +59,7 @@
     - ansible_facts.distribution_major_version == '22'
 
 - name: Clear systemd rate-limits and prepare containerd
-  ansible.builtin.block:
+  block:
     - name: Reset systemd failed state for Docker units
       ansible.builtin.systemd:
         name: "{{ item }}"