Support masquerading on the libvirt firewall zone.

[bogdando]

Defaults to False. May be useful in hybrid setups, where a full
routing solution is not needed, and outbound only traffic is sufficient

JIRA: OSPRH-18909

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[evallesp]

Could you clean up the MR so we can remove do-not-merge/contains-merge-commits tag and proceed with the review.
Thanks!

[bogdando]

Could you clean up the MR so we can remove do-not-merge/contains-merge-commits tag and proceed with the review. Thanks!

done

[evallesp]

LGTM

[hjensas]

I don't think this will solve the problem, masquerading only works for connection initiated behind the interface that masqurades traffic. In this case the BMC needs to connect from the outside to the OCP nodes, so the OCP nodes must be bridged onto the physical network and have IP addresses from the physical network with no masquerading.

[bogdando]

PTAL

[bogdando]

I don't think this will solve the problem, masquerading only works for connection initiated behind the interface that masqurades traffic. In this case the BMC needs to connect from the outside to the OCP nodes, so the OCP nodes must be bridged onto the physical network and have IP addresses from the physical network with no masquerading.

@hjensas but this made the curl command working on ocp master nodes, where it wasn't previously working.
@abays am i right?

PS. in the setup we were debugging, "OCP nodes must be bridged onto the physical network and have IP addresses from the physical network" that was exactly the case. Contoller-0 VM did work just fine w/o masquarading. But OCP masters, while having the same bridging config, were not behaving the same way, until we've added that libvirt zone masquerading

[bogdando]

I don't think this will solve the problem, masquerading only works for connection initiated behind the interface that masqurades traffic. In this case the BMC needs to connect from the outside to the OCP nodes, so the OCP nodes must be bridged onto the physical network and have IP addresses from the physical network with no masquerading.

@hjensas but this made the curl command working on ocp master nodes, where it wasn't previously working. @abays am i right?

PS. in the setup we were debugging, "OCP nodes must be bridged onto the physical network and have IP addresses from the physical network" that was exactly the case. Contoller-0 VM did work just fine w/o masquarading. But OCP masters, while having the same bridging config, were not behaving the same way, until we've added that libvirt zone masquerading

I have adjusted the commit msg, thanks!

[danpawlik]

no need to set default because it is in defaults/main.yml

[danpawlik]

no need to set default because it is in defaults/main.yml

[bogdando]

with a full routing solution, there is no longer need in this a half-measure