Use of ufw circumvents standard juju firewall control mechanism

The memcached charm implements its own firewall outside of the standard juju expose mechanism. It offers no controls over which protocols, ports, or hosts are allowed, or even whether or not the firewall should be enabled at all.

This means that subordinate charms such as nrpe-external-master cannot expose any services without explicit knowledge of the memcached charm's firewall. It also violates the principle of least astonishment - users would normally expect to be able to control access to charmed services through juju expose and/or the cloud platform's usual controls (in this case, nova secgroups).

If there are security concerns regarding memcached's exposure on the local segment which warrant additional firewalling, the charm's firewall should limit access to memcached only, and should not make assumptions about other services on the unit.