The common role has the ability to put the managed machine into a maintenance mode in which case incoming connections are allowed only from a specific list of user-provided hosts. The list of allowed hosts is controlled via the maintenance_allowed_hosts parameter.

While a very useful feature during upgrades, the implementation is tied in to resolvable names, and in case the user passes-in a list of IP addresses, the resulting firewall will not get correctly set-up for the IPv6. The use of resolvable names can also lead to ferm failing to start because it cannot resolve the names until the network is fully up and it can connect to the DNS servers.

To simplify the implementation, and make it more unambiguous, only IPv4 and IPv6 addresses should be allowed.

The following should be done:

• Update the common role.
  • Rename the parameter to maintenance_allowed_sources.
  • Allow only IPv4/IPv6 address to be passed into the parameter.
  • Non-IPv4 or IPv6 addresses should result in an error.
• Update the role reference documentation.
• Update usage instructions
• Update release notes.