Provisioner should be setup to NAT for the workers

[mmlb]

I'm not sure why we didn't do this from the beginning and I can't really think of a good reason to make the default setup not have internet access via the provisioner. If we enable routing and NAT'ing we'd be able to drop the local registry and the need to sync/re-tag images from the setup, and the workflows will be able to use the internet access to fetch from.

[mrmrcoleman]

Agree. I use this:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth1 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -j ACCEPT

Taken from this: https://kinvolk.io/blog/2020/10/provisioning-flatcar-container-linux-with-tinkerbell/

[gianarb]

We assumed it was made in this way with reasons, glad there are no good reasons for those extra steps.

[gianarb]

Anyway, great news. @Cbkhare can you have a look?

• Enable NAT for Terraform and Vagrant (you can check this running a workflow that uses https://hub.docker.com/_/hello-world directly from the Docker Hub.
• Update documentation removing what is not needed anymore

I think we are not ready to remove the registry yet. I want to speak about it during a contributor meeting. But this issue can be closed as soon as the NAT is in place 👍

[Cbkhare]

nat changes added via tinkerbell/tink#410

[gianarb]

@Cbkhare this has to be ported to this repository. The setup.sh scripts are independent

[Cbkhare]

@gianarb yes, I have discussed with @mmlb . I will raise a PR for this repo as well.

[Cbkhare]

PR for sandbox repo. #33

[Cbkhare]

PR for documentation tinkerbell/tinkerbell-docs#55

[Cbkhare]

All Pr merged.

[gianarb]

Thanks @Cbkhare ! well done!