2014-06-12 2:14 GMT+02:00 Adam Williamson <awilliam@redhat.com>:
"Should kickstart firewall options conflict with the settings that would
otherwise result from a deployed server role, the kickstart options must
take precedence."

that seems to make sense to me

Yes, assuming you are talking about an explicit kickstart “role deploy” command and kickstart “firewall” command.  Within %post and post-install actions, simply the last edit should win, whether it is a manual command or a role deploy.
 
Note that this is *not currently the case*. anaconda does not have any
remote auth configuration support of which I'm aware at present.
https://fedoraproject.org/wiki/Anaconda/Kickstart#realm ?  (Possibly in combination with https://fedoraproject.org/wiki/Anaconda/Kickstart#auth_or_authconfig , I’m not sure.)
   Mirek