puppetlabs/puppetlabs-firewall — pull request #333 by aaronknister (2014-03-04 19:12:34+00:00)
Title: cache retrieved firewall rules

I have ~6000 firewall rules on some of my hosts that are managed externally to puppet. The current implementation means that for every firewall chain resource that exists (there are at least 14 when you factor in prerouting, postrouting, nat ipv4 and ipv6, input and output, etc.) puppet must re-parse 6000 firewall rules. The patch uses a class variable to cache the rules inside of the firewallchain type class. This cut my puppet runs from 10 minutes down to just over 2 minutes.

Even with this patch, all existing firewall rules are retrieved twice: once for the firewall type's prefetching and once for the firewallchain type's purposes. Perhaps the ideal mechanism is to cache the instances within the firewall type. I don't know which approach is more "puppet-y".