[photon-3] iptables rules get over written

[kkeshavamurthy]

What steps did you take and what happened:
[A clear and concise description on how to REPRODUCE the bug.]

• Configure custom iptables rules in custom_role. Ex

-P INPUT DROP
-A INPUT -p tcp -m multiport --dports 30000:32767 -j ACCEPT

• Sysprep alters the rules by replacing INPUT DROP with INPUT ACCEPT which defeats the purpose of configuring the strict rule.

• I suggest we move these 2 tasks out of sysprep and into setup role maybe? That way custom roles can over ride them if needed.

What did you expect to happen:
User configured iptables rules should not be tampered by image-builder.

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]

Environment:

Project (Image Builder for Cluster API, kube-deploy/imagebuilder, konfigadm):

Additional info for Image Builder for Cluster API related issues:

• OS (e.g. from /etc/os-release, or cmd /c ver):
• Packer Version:
• Packer Provider:
• Ansible Version:
• Cluster-api version (if using):
• Kubernetes version: (use kubectl version):

/kind bug
[One or more /area label. See https://github.com/kubernetes-sigs/cluster-api/labels?q=area for the list of labels]

CC: @codenrhoden

[codenrhoden]

@kkeshavamurthy Yeah, I see what you are saying. I think relocating those two tasks into setup/tasks/photon.yml is a good solution.