refactor firewall management into new role

- Add os_firewall role
- Remove firewall settings from base_os, add wait task to os_firewall
- Added a iptables firewall module for maintaining the following (in a mostly
  naive manner):
  - ensure the OPENSHIFT_ALLOW chain is defined
  - ensure that there is a jump rule in the INPUT chain for OPENSHIFT_ALLOW
  - adds or removes entries from the OPENSHIFT_ALLOW chain
  - issues '/usr/libexec/iptables/iptables.init save' when rules are changed
- Limitations of iptables firewall module
  - only allows setting of ports/protocols to open
  - no testing on ipv6 support
- made os_firewall a dependency of openshift_common
- Hardcoded openshift_common to use iptables (through the vars directory)
  until upstream support is in place for firewalld

4 files changed, 15 insertions, 43 deletions

diff --git a/roles/openshift_common/meta/main.yml b/roles/openshift_common/meta/main.yml
index 128da25b4..7dc4603d0 100644
--- a/roles/openshift_common/meta/main.yml
+++ b/roles/openshift_common/meta/main.yml
@@ -1,3 +1,4 @@
+---
 galaxy_info:
   author: Jason DeTiberus
   description: OpenShift Common
@@ -10,4 +11,5 @@ galaxy_info:
     - 7
   categories:
   - cloud
-dependencies: []
+dependencies:
+- { role: os_firewall }
diff --git a/roles/openshift_common/tasks/firewall.yml b/roles/openshift_common/tasks/firewall.yml
deleted file mode 100644
index 514466769..000000000
--- a/roles/openshift_common/tasks/firewall.yml
+++ /dev/null
@@ -1,34 +0,0 @@
----
-# TODO: Ansible 1.9 will eliminate the need for separate firewalld tasks for
-# enabling rules and making them permanent with the immediate flag
-- name: "Add firewalld allow rules"
-  firewalld:
-    port: "{{ item.port }}"
-    permanent: false
-    state: enabled
-  with_items: allow
-  when: allow is defined
-
-- name: "Persist firewalld allow rules"
-  firewalld:
-    port: "{{ item.port }}"
-    permanent: true
-    state: enabled
-  with_items: allow
-  when: allow is defined
-
-- name: "Remove firewalld allow rules"
-  firewalld:
-    port: "{{ item.port }}"
-    permanent: false
-    state: disabled
-  with_items: deny
-  when: deny is defined
-
-- name: "Persist removal of firewalld allow rules"
-  firewalld:
-    port: "{{ item.port }}"
-    permanent: true
-    state: disabled
-  with_items: deny
-  when: deny is defined
diff --git a/roles/openshift_common/tasks/main.yml b/roles/openshift_common/tasks/main.yml
index b94fca690..723bdd9fa 100644
--- a/roles/openshift_common/tasks/main.yml
+++ b/roles/openshift_common/tasks/main.yml
@@ -7,6 +7,14 @@
 - name: Configure local facts file
   file: path=/etc/ansible/facts.d/ state=directory mode=0750
 
+- name: Add KUBECONFIG to .bash_profile for user root
+  lineinfile:
+    dest: /root/.bash_profile
+    regexp: "KUBECONFIG="
+    line: "export KUBECONFIG=/var/lib/openshift/openshift.local.certificates/admin/.kubeconfig"
+    state: present
+    insertafter: EOF
+
 - name: Set common OpenShift facts
   include: set_facts.yml
   facts:
@@ -19,11 +27,3 @@
   - section: common
     option: debug_level
     value: "{{ openshift_debug_level }}"
-
-- name: Add KUBECONFIG to .bash_profile for user root
-  lineinfile:
-    dest: /root/.bash_profile
-    regexp: "KUBECONFIG="
-    line: "export KUBECONFIG=/var/lib/openshift/openshift.local.certificates/admin/.kubeconfig"
-    state: present
-    insertafter: EOF
diff --git a/roles/openshift_common/vars/main.yml b/roles/openshift_common/vars/main.yml
index c93898665..0855c0cc5 100644
--- a/roles/openshift_common/vars/main.yml
+++ b/roles/openshift_common/vars/main.yml
@@ -1,2 +1,6 @@
 ---
 openshift_master_credentials_dir: /var/lib/openshift/openshift.local.certificates/admin/
+
+# TODO: Upstream kubernetes only supports iptables currently, if this changes,
+# then these variable should be moved to defaults
+openshift_use_firewalld: False