cephadm-preflight: add cephadm_preflight_manage_firewall skip option

[kishore-kumar-dev]

Problem

cephadm-preflight.yml unconditionally enables and starts firewalld
during host preparation. In deployments where host-level firewalls are
intentionally disabled, running preflight during an upgrade can disrupt
inter-node Ceph connectivity.

Solution

Gate the firewalld task behind cephadm_preflight_manage_firewall
(default true) so administrators can skip host firewall management:

ansible-playbook -i <inventory> cephadm-preflight.yml \
  --extra-vars "cephadm_preflight_manage_firewall=false"

Implementation details:

• Uses ceph_defaults_preflight_manage_firewall internally (repo convention)
• Accepts cephadm_preflight_manage_firewall via backward-compatibility alias
• Default true preserves existing preflight behavior unless explicitly skipped
• Documented in README.md

Related issues

Fixes: https://tracker.ceph.com/issues/76709

Note on #371

PR #371 proposes a similar change with configure_firewalld defaulting to
false (opt-in). This PR defaults to true (opt-out) to avoid changing
behavior for deployments that rely on preflight enabling firewalld. Happy to
align on the default with maintainers during review.

Test plan

• Stock preflight on nodes with firewalld disabled: task runs, firewalld enabled
• cephadm_preflight_manage_firewall=false: task skipped, firewalld unchanged
• cephadm_preflight_manage_firewall=true: firewalld enabled (default path)
• Jenkins cephadm-ansible PR Pipeline (needs maintainer ok to test)

[ceph-jenkins]

Thank you for your contribution. Since you, the author, are not a member of the Ceph GitHub Org yet, our CI will not automatically run. Any member of the Ceph Org may comment "ok - to - test" (without the dashes) to allow the Jenkins jobs to run.

[ceph-jenkins]

Thank you for your contribution. Since you, the author, are not a member of the Ceph GitHub Org yet, our CI will not automatically run. Any member of the Ceph Org may comment "ok - to - test" (without the dashes) to allow the Jenkins jobs to run.

[ceph-jenkins]

Thank you for your contribution. Since you, the author, are not a member of the Ceph GitHub Org yet, our CI will not automatically run. Any member of the Ceph Org may comment "ok - to - test" (without the dashes) to allow the Jenkins jobs to run.

[ceph-jenkins]

Thank you for your contribution. Since you, the author, are not a member of the Ceph GitHub Org yet, our CI will not automatically run. Any member of the Ceph Org may comment "ok - to - test" (without the dashes) to allow the Jenkins jobs to run.

[ceph-jenkins]

Thank you for your contribution. Since you, the author, are not a member of the Ceph GitHub Org yet, our CI will not automatically run. Any member of the Ceph Org may comment "ok - to - test" (without the dashes) to allow the Jenkins jobs to run.

[kishore-kumar-dev]

Hi @pdvian @asm0deuz — could you please review when you have a moment?

This addresses tracker #76709. I reproduced the issue in a lab environment
with firewalld intentionally disabled: stock preflight enables firewalld and
can block Ceph inter-node traffic until rules are applied.

Compared to #371, this PR keeps default behavior unchanged (firewalld still
managed unless cephadm_preflight_manage_firewall=false is passed). Open to
maintainer guidance on the preferred default.

Thanks!

[kishore-kumar-dev]

Reopening: PR was closed inadvertently after a force-push during commit cleanup. Branch restored with changes intact.