Firewall Management

[mskarbek]

What is the desired firewall management method for FCOS at the moment? Atomic Host is using firewalld, Container Linux plain iptables. AFAIK Fedora 29 will switch over from iptables to nftables and set nftables as a default backend in firewalld. FCOS, with a strong desire to not ship Python, plans to stay with iptables, switch to plain nftables?

[dustymabe]

ok discussed in the meeting today we discussed this item. We discovered we have quite a bit of investigation to do before we can really make a decision on this. Some obsverations/open questions from the meeting:

• if we don't have python then we can't have firewalld (unless that team is itching for a rewrite)
• do we have to choose between using nftables or iptables or can we support both?
• can iptables userspace interact transparently with nftables?
• we prefer for users to set up firewall rules using ignition and then higher level applications (docker/podman/kube) can configure the firewall themselves. Preferably not user interacting with the firewall directly.

we'll need to have someone (or small group of people) look into these items and report back to the group with a recommendation.

[cgwalters]

if we don't have python then we can't have firewalld (unless that team is itching for a rewrite)

I'm not sure I agree with this. I still think the "platform python" approach could work. Or, if we wanted to make it a whole lot harder for external people to use it, we could randomize the location of the binary, e.g. /usr/libexec/platform-python-$(uuidgen).

(Walking over every python binary and rewrite the shebangs)

[dustymabe]

I'm not sure I agree with this. I still think the "platform python" approach could work.

i'm going to refrain from commenting on that subject. While it definitely has implications I think it warrants it's own card as to not derail the firewall discussion. Would you like to open a separate issue?

[dustymabe]

Would you like to open a separate issue?

He opened one here: #32

[cgwalters]

While it's not quite the same thing, note that systemd is working on bpf firewalling which is service-oriented rather than system oriented.

[dustymabe]

blocked by discussion in #32

[oliwer]

The latest versions of iptables use the nf_tables backend. So we can safely ship both. https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools

As for firewalld, I don't think many people would be happy to see that thing in FCOS (bloated, stateful, complex, xml...). Cloud deployments usually don't need complex firewall configuration. It is handled elsewhere. BPF firewalling in systemd looks much more appealing.

[dustymabe]

no longer blocked on #32 since that has been decided. removing blocked label