Salt: Firewalld prune functionality is broken.

[hunkeelin]

Description of Issue/Question

The firewalld state is not implemented properly. Even if we select prune_services=False, it will still prune ports # and richrules. Please implement prune instead of just prune_services. The introduction of pruning_services cause a lot of hazards for many admins few month ago.

Setup

(Please provide relevant configs and/or SLS files (Be sure to remove sensitive info).)

Steps to Reproduce Issue

(Include debug logs if possible and relevant.)

Versions Report

(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)

[gtmanfred]

Thanks for the feature request, this would be good to have.

Daniel

[connordelacruz]

I'm working on a pull request to hopefully address this issue (as well as #41075 and #41717). I've added parameters similar to prune_services for each of the items that were getting pruned by default (prune_ports, prune_rich_rules, etc). I've also set the default value of the prune_* parameters (including prune_services) to False, since the current behavior is kind of confusing.

I've made most of the changes to the code, I'm just working on updating the docblock for firewalld.present since it currently doesn't explain any of the parameters or expected behavior. I'll try to have it finished by tomorrow night

[nhavens]

@gtmanfred I would argue that the problem with pruning in firewalld.present is a design flaw rather than a feature request. What business does a function named present have removing anything? Wouldn't it be better to refactor firewalld.present so that it strictly adds to firewalld configuration and add a corresponding function firewalld.absent that strictly removes firewalld configuration? This would make the firewalld state operate similarly to other states like pkg, with its installed and removed functions.

[gtmanfred]

It is tagged as a bug.

I retagged it as a bug a month after it was originally tagged as a feature request