diff options
| author | Kenny Woodson <kwoodson@redhat.com> | 2017-07-19 08:51:14 -0400 |
|---|---|---|
| committer | Kenny Woodson <kwoodson@redhat.com> | 2017-08-08 10:46:12 -0400 |
| commit | 4f9b26e8af5890b7960291497020586426e7f1fc (patch) | |
| tree | ba2dd554f739485a9c2e8654e6af626b54e7a520 /roles/nuage_master | |
| parent | 0569c5069dabeea9e2fe94cd097cb6f2b1540867 (diff) | |
| download | openshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.gz openshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.bz2 openshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.xz openshift-4f9b26e8af5890b7960291497020586426e7f1fc.zip | |
First attempt at refactor of os_firewall
Diffstat (limited to 'roles/nuage_master')
| -rw-r--r-- | roles/nuage_master/defaults/main.yml | 8 | ||||
| -rw-r--r-- | roles/nuage_master/meta/main.yml | 5 | ||||
| -rw-r--r-- | roles/nuage_master/tasks/firewall.yml | 40 | ||||
| -rw-r--r-- | roles/nuage_master/tasks/main.yaml | 4 |
4 files changed, 53 insertions, 4 deletions
diff --git a/roles/nuage_master/defaults/main.yml b/roles/nuage_master/defaults/main.yml new file mode 100644 index 000000000..7b5015a02 --- /dev/null +++ b/roles/nuage_master/defaults/main.yml @@ -0,0 +1,8 @@ +--- +nuage_mon_rest_server_port: '9443' + +r_nuage_master_os_firewall_deny: [] +r_nuage_master_os_firewall_allow: +- service: openshift-monitor + port: "{{ nuage_mon_rest_server_port }}/tcp" + cond: true diff --git a/roles/nuage_master/meta/main.yml b/roles/nuage_master/meta/main.yml index e3ed9ac71..3da340c85 100644 --- a/roles/nuage_master/meta/main.yml +++ b/roles/nuage_master/meta/main.yml @@ -16,8 +16,5 @@ dependencies: - role: nuage_ca - role: nuage_common - role: openshift_etcd_client_certificates -- role: os_firewall - role: lib_openshift - os_firewall_allow: - - service: openshift-monitor - port: "{{ nuage_mon_rest_server_port }}/tcp" +- role: lib_os_firewall diff --git a/roles/nuage_master/tasks/firewall.yml b/roles/nuage_master/tasks/firewall.yml new file mode 100644 index 000000000..b47699966 --- /dev/null +++ b/roles/nuage_master/tasks/firewall.yml @@ -0,0 +1,40 @@ +--- +- when: os_firewall_enabled | bool and not os_firewall_use_firewalld | bool + block: + - name: Add iptables allow rules + os_firewall_manage_iptables: + name: "{{ item.service }}" + action: add + protocol: "{{ item.port.split('/')[1] }}" + port: "{{ item.port.split('/')[0] }}" + when: item.cond + with_items: "{{ r_nuage_master_os_firewall_allow }}" + + - name: Remove iptables rules + os_firewall_manage_iptables: + name: "{{ item.service }}" + action: remove + protocol: "{{ item.port.split('/')[1] }}" + port: "{{ item.port.split('/')[0] }}" + when: item.cond + with_items: "{{ r_nuage_master_os_firewall_deny }}" + +- when: os_firewall_enabled | bool and os_firewall_use_firewalld | bool + block: + - name: Add firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: true + immediate: true + state: enabled + when: item.cond + with_items: "{{ r_nuage_master_os_firewall_allow }}" + + - name: Remove firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: true + immediate: true + state: disabled + when: item.cond + with_items: "{{ r_nuage_master_os_firewall_deny }}" diff --git a/roles/nuage_master/tasks/main.yaml b/roles/nuage_master/tasks/main.yaml index 4f8adb63e..cb7f75398 100644 --- a/roles/nuage_master/tasks/main.yaml +++ b/roles/nuage_master/tasks/main.yaml @@ -1,4 +1,8 @@ --- +- name: setup firewall + include: firewall.yml + static: yes + - name: Create directory /usr/share/nuage-openshift-monitor become: yes file: path=/usr/share/nuage-openshift-monitor state=directory |