added nftables for cisoas

cisoas-sto4-prod-1.sunet.se/overlay/etc/hiera/data/local.yaml

@@ -0,0 +1,11 @@
+sunet::nftables::allow::rules:
+  allow_access_to_cisoassistant:
+    from: 'any'
+    port: 8443
+    to: 'any'
+    proto: 'tcp'
+  allow_access_to_cisoassistant_api:
+    from: 'any'
+    port: 9443
+    to: 'any'
+    proto: 'tcp'

global/overlay/etc/puppet/cosmos-rules.yaml

@@ -142,3 +142,6 @@ nifrontend-sto1-prod-1.sunet.se:
            - 'sthb-lb-1.sunet.se'
            - 'tug-lb-1.sunet.se'
           port: '443'
+
+cisoas-sto4-prod-1.sunet.se:
+  net::nftables:

global/overlay/etc/puppet/modules/net/manifests/nftables.pp

@@ -0,0 +1,8 @@
+$nftables_rules = lookup('sunet::nftables::allow::rules', Hash, 'deep', {})
+
+# Create resources for each rule
+$nftables_rules.each |$name, $params| {
+  sunet::nftables::allow { $name:
+    * => $params,
+  }
+}