Remove requirement for iptables-services on EL9 generation systems

[sbrowne-godaddy]

Use Case

With the conversion of iptables based commands to use nftables under the hood, the package iptables-services is no longer being built and distributed along side their nft equivalents (i.e. iptables-nft-services). As such, when the iptables family of packages is updated, there is a delay in the matching iptables-services packages from EPEL being distributed.

As iptables-nft-services actually provides everything that this module requires, it should be safe to remove the reliance upon this EPEL package.

Describe the Solution You Would Like

Remove the reliance upon EPEL for the iptables-services package for EL9 (and related FC) OS selections

Describe Alternatives You've Considered

As the reliance upon iptables-services is now reliant upon the 3rd group of EPEL making keeping packages up-to-date a mess, and the existing iptables-nft-services provides all the necessary source material, I felt no other alternative is worth further consideration.

Additional Context

A simple test on EL9 instances with this diff does everything we need from the module.

diff --git a/manifests/params.pp b/manifests/params.pp
index 5fbe898..b62e9fe 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -32,7 +32,7 @@ class firewall::params {
           if versioncmp($facts['os']['release']['full'], '9') >= 0 {
             $service_name = ['nftables','iptables']
             $service_name_v6 = 'ip6tables'
-            $package_name = ['iptables-services', 'nftables', 'iptables-nft-services']
+            $package_name = ['nftables', 'iptables-nft-services']
             $iptables_name = 'iptables-nft'
             $sysconfig_manage = false
             $firewalld_manage = true

[HT43-bqxFqB]

Upvote!

[qralston]

I second this.

I think the confusion here is that the iptables-services package that EPEL provides is actually part of the iptables-legacy-* set of packages. It has nothing to do with the iptables-nft-* packages that RHEL officially provides. And its presence will break updates even if the Puppet firewall module wasn’t the one to pull it onto the system; see:

• Bug 2343682 - EPEL package iptables-services prevents iptables-libs update

I argue here that the iptables-services package should either be renamed to iptables-legacy-services, or removed entirely:

• Bug 2349297 - iptables-services package should be renamed or removed entirely

On RHEL9 and RHEL9-family systems, one can simply override firewall::package_name. E.g., in Hiera:

firewall::package_name: [nftables, iptables-nft-services]

But it would be better to update the defaults in the firewall module itself, as @sbrowne-godaddy’s patch does.

[jormaster3k]

Ran in to this on RHEL10 as well, the solution by @qralston to override package_name worked perfectly! Thanks!