diff options
| author | Clayton Coleman <ccoleman@redhat.com> | 2016-12-26 17:00:59 -0500 |
|---|---|---|
| committer | Andrew Butcher <abutcher@redhat.com> | 2017-01-10 16:22:57 -0500 |
| commit | d9fe14e9b53590d7949cbdd53cedb89bbc0ee037 (patch) | |
| tree | 303145a1f1588bd0231c8b2f3c684c9e6657fb73 | |
| parent | 15054dfdbe77dddbca393c3559c4858d9a2c5087 (diff) | |
| download | openshift-d9fe14e9b53590d7949cbdd53cedb89bbc0ee037.tar.gz openshift-d9fe14e9b53590d7949cbdd53cedb89bbc0ee037.tar.bz2 openshift-d9fe14e9b53590d7949cbdd53cedb89bbc0ee037.tar.xz openshift-d9fe14e9b53590d7949cbdd53cedb89bbc0ee037.zip | |
Support openshift_node_port_range for configuring service NodePorts
Sets the appropriate config field if openshift_node_port_range is set
and also configures filewalls on each node. firewalld already supports
port ranges like "30000-32000", while iptables needs that value
converted to the correct "30000:32000" form for use with `--dport`.
If not set, no node ports are opened.
| -rw-r--r-- | roles/openshift_master/templates/master.yaml.v1.j2 | 2 | ||||
| -rw-r--r-- | roles/openshift_node/meta/main.yml | 11 | ||||
| -rwxr-xr-x | roles/os_firewall/library/os_firewall_manage_iptables.py | 12 |
3 files changed, 21 insertions, 4 deletions
diff --git a/roles/openshift_master/templates/master.yaml.v1.j2 b/roles/openshift_master/templates/master.yaml.v1.j2 index 81546c829..fcb8125e9 100644 --- a/roles/openshift_master/templates/master.yaml.v1.j2 +++ b/roles/openshift_master/templates/master.yaml.v1.j2 @@ -123,7 +123,7 @@ kubernetesMasterConfig: keyFile: master.proxy-client.key schedulerArguments: {{ openshift_master_scheduler_args | default(None) | to_padded_yaml( level=3 ) }} schedulerConfigFile: {{ openshift_master_scheduler_conf }} - servicesNodePortRange: "" + servicesNodePortRange: "{{ openshift_node_port_range | default("") }}" servicesSubnet: {{ openshift.common.portal_net }} staticNodeNames: {{ openshift_node_ips | default([], true) }} {% endif %} diff --git a/roles/openshift_node/meta/main.yml b/roles/openshift_node/meta/main.yml index 56dee2958..91f118191 100644 --- a/roles/openshift_node/meta/main.yml +++ b/roles/openshift_node/meta/main.yml @@ -31,6 +31,15 @@ dependencies: port: 10255/tcp - service: Openshift kubelet ReadOnlyPort udp port: 10255/udp +- role: os_firewall + os_firewall_allow: - service: OpenShift OVS sdn port: 4789/udp - when: openshift.node.use_openshift_sdn | bool + when: openshift.common.use_openshift_sdn | bool +- role: os_firewall + os_firewall_allow: + - service: Kubernetes service NodePort TCP + port: "{{ openshift_node_port_range | default('') }}/tcp" + - service: Kubernetes service NodePort UDP + port: "{{ openshift_node_port_range | default('') }}/udp" + when: openshift_node_port_range is defined diff --git a/roles/os_firewall/library/os_firewall_manage_iptables.py b/roles/os_firewall/library/os_firewall_manage_iptables.py index b60e52dfe..8ba650994 100755 --- a/roles/os_firewall/library/os_firewall_manage_iptables.py +++ b/roles/os_firewall/library/os_firewall_manage_iptables.py @@ -127,9 +127,17 @@ class IpTablesManager(object): # pylint: disable=too-many-instance-attributes check_cmd = self.cmd + ['-C'] + rule return True if subprocess.call(check_cmd) == 0 else False + @staticmethod + def port_as_argument(port): + if isinstance(port, int): + return str(port) + if isinstance(port, basestring): # noqa: F405 + return port.replace('-', ":") + return port + def gen_rule(self, port, proto): return [self.chain, '-p', proto, '-m', 'state', '--state', 'NEW', - '-m', proto, '--dport', str(port), '-j', 'ACCEPT'] + '-m', proto, '--dport', IpTablesManager.port_as_argument(port), '-j', 'ACCEPT'] def create_jump(self): if self.check_mode: @@ -231,7 +239,7 @@ def main(): create_jump_rule=dict(required=False, type='bool', default=True), jump_rule_chain=dict(required=False, default='INPUT'), protocol=dict(required=False, choices=['tcp', 'udp']), - port=dict(required=False, type='int'), + port=dict(required=False, type='str'), ip_version=dict(required=False, default='ipv4', choices=['ipv4', 'ipv6']), ), |