diff options
| author | Jason DeTiberus <jdetiber@redhat.com> | 2015-03-03 13:06:49 -0500 |
|---|---|---|
| committer | Jason DeTiberus <jdetiber@redhat.com> | 2015-03-05 17:37:19 -0500 |
| commit | 7c90cacef0f5cf61fb8ac3adb905507dd4247d84 (patch) | |
| tree | 708aacc9b414cc8392927ecd1ab515a0faaa7f49 /roles/openshift_common/vars | |
| parent | 151f10b010651a49dfb4b46ca74e966be36b1279 (diff) | |
| download | openshift-7c90cacef0f5cf61fb8ac3adb905507dd4247d84.tar.gz openshift-7c90cacef0f5cf61fb8ac3adb905507dd4247d84.tar.bz2 openshift-7c90cacef0f5cf61fb8ac3adb905507dd4247d84.tar.xz openshift-7c90cacef0f5cf61fb8ac3adb905507dd4247d84.zip | |
refactor firewall management into new role
- Add os_firewall role
- Remove firewall settings from base_os, add wait task to os_firewall
- Added a iptables firewall module for maintaining the following (in a mostly
naive manner):
- ensure the OPENSHIFT_ALLOW chain is defined
- ensure that there is a jump rule in the INPUT chain for OPENSHIFT_ALLOW
- adds or removes entries from the OPENSHIFT_ALLOW chain
- issues '/usr/libexec/iptables/iptables.init save' when rules are changed
- Limitations of iptables firewall module
- only allows setting of ports/protocols to open
- no testing on ipv6 support
- made os_firewall a dependency of openshift_common
- Hardcoded openshift_common to use iptables (through the vars directory)
until upstream support is in place for firewalld
Diffstat (limited to 'roles/openshift_common/vars')
| -rw-r--r-- | roles/openshift_common/vars/main.yml | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/roles/openshift_common/vars/main.yml b/roles/openshift_common/vars/main.yml index c93898665..0855c0cc5 100644 --- a/roles/openshift_common/vars/main.yml +++ b/roles/openshift_common/vars/main.yml @@ -1,2 +1,6 @@ --- openshift_master_credentials_dir: /var/lib/openshift/openshift.local.certificates/admin/ + +# TODO: Upstream kubernetes only supports iptables currently, if this changes, +# then these variable should be moved to defaults +openshift_use_firewalld: False |