I would like to second this. Part of why we use puppet is to ensure the configuration of services like the firewall are exactly the way we want them. I don't see how I can ensure that there aren't any other zones that someone created allowing remote access to something that we don't want to allow remote access to.

@trevor-vaughan

In particular, any zone listed as part of a DefaultZone in the /etc/firewalld/*.conf files should be preserved.

It was my understanding that you could only have one default zone?

@crayfishx You can have one default zone but there's nothing preventing people from using the command line to do whatever it is to that zone. Additionally, the presence of a default zone means nothing if someone has used other utilities to hook different zones to the interface or do something else.

If I need an authoritative configuration across the entire host, I should be able to enact it via the management module.