bundles: use a common metadata key for firewall restrictions, use repo.libs.tools.resolve_identifier()

bundles/icinga2/metadata.py

@@ -96,3 +96,28 @@ def add_users_from_json(metadata):
             'icinga_users': users,
         },
     }
+
+
+@metadata_reactor.provides(
+    'iptables/bundle_rules/icinga2',
+)
+def iptables(metadata):
+    identifiers = metadata.get('icinga2/restrict-to', set())
+    rules = set()
+
+    if identifiers:
+        for identifier in sorted(identifiers):
+            resolved = repo.libs.tools.resolve_identifier(repo, identifier)
+
+            for address in resolved['ipv4']:
+                rules.add(f'iptables -A INPUT -p tcp -s {address} --dport 5665 -j ACCEPT')
+    else:
+        rules.add('iptables -A INPUT -p tcp --dport 5665 -j ACCEPT')
+
+    return {
+        'iptables': {
+            'bundle_rules': {
+                'icinga2': list(sorted(rules)),
+            },
+        },
+    }