firewalld currently uses complete-reload this causes outages when updating the firewalld configuration

[csschwe]

firewalld::reload should default to use --reload to prevent killing of active connections on live servers.

https://github.com/crayfishx/puppet-firewalld/blob/master/manifests/init.pp#L85

    exec { 'firewalld::reload':
      path        =>'/usr/bin:/bin',
      command     => 'firewall-cmd --reload',
      refreshonly => true,
    }

There should probably be a firewalld::complete-reload that can be called if necessary.

    exec { 'firewalld::complete-reload':
      path        =>'/usr/bin:/bin',
      command     => 'firewall-cmd --complete-reload',
      require        => Exec['firewalld::reload'],
      refreshonly => true,
    }

   --reload
       Reload firewall rules and keep state information. Current permanent
       configuration will become new runtime configuration, i.e. all
       runtime only changes done until reload are lost with reload if they
       have not been also in permanent configuration.

   --complete-reload
       Reload firewall completely, even netfilter kernel modules. This
       will most likely terminate active connections, because state
       information is lost. This option should only be used in case of
       severe firewall problems. For example if there are state
       information problems that no connection can be established with
       correct firewall rules.

[crayfishx]

Merged and will be released in 3.0.0