Dzahn has uploaded a new change for review.
https://gerrit.wikimedia.org/r/253056
Change subject: base::firewall: remove exec for nf_conntrack
......................................................................
base::firewall: remove exec for nf_conntrack
@Muehlenhoff said on I3f7ed7a722007c021:
"This entire code section can be removed
(maybe after doublechecking with a salt run that all
running systems now have
/sys/module/nf_conntrack/parameters/hashsize=32768)
This was only needed temporarily to cope with running systems,
every system that reboots gets the new value set via modprobe.d"
Change-Id: I02bf19b196a72179e134fb4f2face83e0651ebb3
---
M modules/base/manifests/firewall.pp
1 file changed, 0 insertions(+), 7 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/56/253056/1
diff --git a/modules/base/manifests/firewall.pp
b/modules/base/manifests/firewall.pp
index 680b3ba..125a563 100644
--- a/modules/base/manifests/firewall.pp
+++ b/modules/base/manifests/firewall.pp
@@ -24,13 +24,6 @@
},
}
- # The sysctl value net.netfilter.nf_conntrack_buckets is read-only. It is
configured
- # via a modprobe parameter, bump it manually for running systems
- exec { 'bump nf_conntrack hash table size':
- command => '/bin/echo 32768 >
/sys/module/nf_conntrack/parameters/hashsize',
- onlyif => "/bin/grep --invert-match --quiet '^32768$'
/sys/module/nf_conntrack/parameters/hashsize",
- }
-
ferm::conf { 'main':
ensure => $ensure,
prio => '00',
--
To view, visit https://gerrit.wikimedia.org/r/253056
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I02bf19b196a72179e134fb4f2face83e0651ebb3
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Dzahn <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
