PAM standalone online installation

The PAM installation script disables SELinux and Firewalld by default. If you want to keep SELinux enabled, append the -s preserve-selinux-config switch to the PAM install command. This may require additional configuration to adapt SELinux policy to the installation.

If you want to keep Firewalld enabled:

1. Make sure Firewalld is installed on your system.

2. To prevent the installation from disabling Firewalld, provide a patch file to the PAM install command using -s installer-spec-file=patch.yaml, where patch.yaml is the name of your patch file. For reference, here's an example patch file that enables Firewalld during installation, starts the service if it isn't running, and adds rules to open relevant ports:

   apiVersion: cluster.kurl.sh/v1beta1
   kind: Installer
   metadata:
     name: patch
   spec:
     firewalldConfig:
       firewalld: enabled
       command: ["/bin/bash", "-c"]
       args: ["echo 'net.ipv4.ip_forward = 1' | tee -a /etc/sysctl.conf && sysctl -p"]
       firewalldCmds:
         - ["--permanent", "--zone=trusted", "--add-interface=flannel.1"]
         - ["--zone=external", "--add-masquerade"]
         # SSH port
         - ["--permanent", "--zone=public", "--add-port=22/tcp"]
         # HTTPS port
         - ["--permanent", "--zone=public", "--add-port=443/tcp"]
         # Kubernetes etcd port
         - ["--permanent", "--zone=public", "--add-port=2379-2830/tcp"]
         # Kubernetes API port
         - ["--permanent", "--zone=public", "--add-port=6443/tcp"]
         # Flannel Net port
         - ["--permanent", "--zone=public", "--add-port=8472/udp"]
         # CD4PE Webhook callback port (uncomment line below if needed)
         # - ["--permanent", "--zone=public", "--add-port=8000/tcp"]
         # KOTS UI port
         - ["--permanent", "--zone=public", "--add-port=8800/tcp"]
         # CD4PE Local registry port (offline only, uncomment line below if needed)
         # - ["--permanent", "--zone=public", "--add-port=9001/tcp"]
         # Kubernetes component ports (kubelet, kube-scheduler, kube-controller)
         - ["--permanent", "--zone=public", "--add-port=10250-10252/tcp"]
         # Reload firewall rules
         - ["--reload"]
       bypassFirewalldWarning: true
       disableFirewalld: false
       hardFailOnFirewalld: false
       preserveConfig: false

If you use the puppetlabs/firewall module to manage your cluster's firewall rules with Puppet, be advised that purging unknown rules from changes breaks Kubernetes communication. To avoid this, apply the puppetlabs/pam_firewall module before installing Puppet Application Manager.