diff options
author | Scott Dodson <sdodson@redhat.com> | 2017-08-15 09:53:49 -0400 |
---|---|---|
committer | GitHub <noreply@github.com> | 2017-08-15 09:53:49 -0400 |
commit | 2dd904feeec57bcb46281a7066b26c140fadfef8 (patch) | |
tree | 0c033d0dc7e4eb071fc729efc55c490c9afd470d /roles | |
parent | 0a439f29d56f152f60d360546e83a5130656c7a6 (diff) | |
parent | 6ff354437718584783589c3403cefe9d1b75ee52 (diff) | |
download | openshift-2dd904feeec57bcb46281a7066b26c140fadfef8.tar.gz openshift-2dd904feeec57bcb46281a7066b26c140fadfef8.tar.bz2 openshift-2dd904feeec57bcb46281a7066b26c140fadfef8.tar.xz openshift-2dd904feeec57bcb46281a7066b26c140fadfef8.zip |
Merge pull request #5072 from kwoodson/glusterfs_fw
Glusterfs firewall updates.
Diffstat (limited to 'roles')
-rw-r--r-- | roles/openshift_storage_glusterfs/defaults/main.yml | 12 | ||||
-rw-r--r-- | roles/openshift_storage_glusterfs/meta/main.yml | 1 | ||||
-rw-r--r-- | roles/openshift_storage_glusterfs/tasks/firewall.yml | 40 |
3 files changed, 53 insertions, 0 deletions
diff --git a/roles/openshift_storage_glusterfs/defaults/main.yml b/roles/openshift_storage_glusterfs/defaults/main.yml index ff2c18812..a5887465e 100644 --- a/roles/openshift_storage_glusterfs/defaults/main.yml +++ b/roles/openshift_storage_glusterfs/defaults/main.yml @@ -52,3 +52,15 @@ openshift_storage_glusterfs_registry_heketi_ssh_port: "{{ openshift_storage_glus openshift_storage_glusterfs_registry_heketi_ssh_user: "{{ openshift_storage_glusterfs_heketi_ssh_user }}" openshift_storage_glusterfs_registry_heketi_ssh_sudo: "{{ openshift_storage_glusterfs_heketi_ssh_sudo }}" openshift_storage_glusterfs_registry_heketi_ssh_keyfile: "{{ openshift_storage_glusterfs_heketi_ssh_keyfile | default(omit) }}" +r_openshift_master_firewall_enabled: True +r_openshift_master_use_firewalld: False +r_openshift_storage_glusterfs_os_firewall_deny: [] +r_openshift_storage_glusterfs_os_firewall_allow: +- service: glusterfs_sshd + port: "2222/tcp" +- service: glusterfs_daemon + port: "24007/tcp" +- service: glusterfs_management + port: "24008/tcp" +- service: glusterfs_bricks + port: "49152-49251/tcp" diff --git a/roles/openshift_storage_glusterfs/meta/main.yml b/roles/openshift_storage_glusterfs/meta/main.yml index dc89c9d0c..0cdd33880 100644 --- a/roles/openshift_storage_glusterfs/meta/main.yml +++ b/roles/openshift_storage_glusterfs/meta/main.yml @@ -12,3 +12,4 @@ galaxy_info: dependencies: - role: openshift_hosted_facts - role: lib_openshift +- role: lib_os_firewall diff --git a/roles/openshift_storage_glusterfs/tasks/firewall.yml b/roles/openshift_storage_glusterfs/tasks/firewall.yml new file mode 100644 index 000000000..09dcf1ef9 --- /dev/null +++ b/roles/openshift_storage_glusterfs/tasks/firewall.yml @@ -0,0 +1,40 @@ +--- +- when: r_openshift_storage_glusterfs_firewall_enabled | bool and not r_openshift_storage_glusterfs_use_firewalld | bool + block: + - name: Add iptables allow rules + os_firewall_manage_iptables: + name: "{{ item.service }}" + action: add + protocol: "{{ item.port.split('/')[1] }}" + port: "{{ item.port.split('/')[0] }}" + when: item.cond | default(True) + with_items: "{{ r_openshift_storage_glusterfs_os_firewall_allow }}" + + - name: Remove iptables rules + os_firewall_manage_iptables: + name: "{{ item.service }}" + action: remove + protocol: "{{ item.port.split('/')[1] }}" + port: "{{ item.port.split('/')[0] }}" + when: item.cond | default(True) + with_items: "{{ r_openshift_storage_glusterfs_os_firewall_deny }}" + +- when: r_openshift_storage_glusterfs_firewall_enabled | bool and r_openshift_storage_glusterfs_use_firewalld | bool + block: + - name: Add firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: true + immediate: true + state: enabled + when: item.cond | default(True) + with_items: "{{ r_openshift_storage_glusterfs_os_firewall_allow }}" + + - name: Remove firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: true + immediate: true + state: disabled + when: item.cond | default(True) + with_items: "{{ r_openshift_storage_glusterfs_os_firewall_deny }}" |