diff options
author | Scott Dodson <sdodson@redhat.com> | 2017-08-11 12:03:58 -0400 |
---|---|---|
committer | GitHub <noreply@github.com> | 2017-08-11 12:03:58 -0400 |
commit | 3409e6db205b6b24914e16c62972de50071f4051 (patch) | |
tree | dbfacaf9d6640241ee5dd7a2446d330a4e12283e /roles/openshift_loadbalancer/tasks | |
parent | 57d7984bc7d7f64184c0defd3cc305cb3ef2708f (diff) | |
parent | 7d50ffe98dfa17e3fb72627699c794843ed5295d (diff) | |
download | openshift-3409e6db205b6b24914e16c62972de50071f4051.tar.gz openshift-3409e6db205b6b24914e16c62972de50071f4051.tar.bz2 openshift-3409e6db205b6b24914e16c62972de50071f4051.tar.xz openshift-3409e6db205b6b24914e16c62972de50071f4051.zip |
Merge pull request #4797 from kwoodson/os_firewall_refactor
Refactor the firewall workflow.
Diffstat (limited to 'roles/openshift_loadbalancer/tasks')
-rw-r--r-- | roles/openshift_loadbalancer/tasks/firewall.yml | 40 | ||||
-rw-r--r-- | roles/openshift_loadbalancer/tasks/main.yml | 4 |
2 files changed, 44 insertions, 0 deletions
diff --git a/roles/openshift_loadbalancer/tasks/firewall.yml b/roles/openshift_loadbalancer/tasks/firewall.yml new file mode 100644 index 000000000..7d6e8ff36 --- /dev/null +++ b/roles/openshift_loadbalancer/tasks/firewall.yml @@ -0,0 +1,40 @@ +--- +- when: r_openshift_loadbalancer_firewall_enabled | bool and not r_openshift_loadbalancer_use_firewalld | bool + block: + - name: Add iptables allow rules + os_firewall_manage_iptables: + name: "{{ item.service }}" + action: add + protocol: "{{ item.port.split('/')[1] }}" + port: "{{ item.port.split('/')[0] }}" + when: item.cond | default(True) + with_items: "{{ r_openshift_loadbalancer_os_firewall_allow }}" + + - name: Remove iptables rules + os_firewall_manage_iptables: + name: "{{ item.service }}" + action: remove + protocol: "{{ item.port.split('/')[1] }}" + port: "{{ item.port.split('/')[0] }}" + when: item.cond | default(True) + with_items: "{{ r_openshift_loadbalancer_os_firewall_deny }}" + +- when: r_openshift_loadbalancer_firewall_enabled | bool and r_openshift_loadbalancer_use_firewalld | bool + block: + - name: Add firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: true + immediate: true + state: enabled + when: item.cond | default(True) + with_items: "{{ r_openshift_loadbalancer_os_firewall_allow }}" + + - name: Remove firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: true + immediate: true + state: disabled + when: item.cond | default(True) + with_items: "{{ r_openshift_loadbalancer_os_firewall_deny }}" diff --git a/roles/openshift_loadbalancer/tasks/main.yml b/roles/openshift_loadbalancer/tasks/main.yml index 68bb4ace8..69b061fc5 100644 --- a/roles/openshift_loadbalancer/tasks/main.yml +++ b/roles/openshift_loadbalancer/tasks/main.yml @@ -1,4 +1,8 @@ --- +- name: setup firewall + include: firewall.yml + static: yes + - name: Install haproxy package: name=haproxy state=present when: not openshift.common.is_containerized | bool |