From 4f9b26e8af5890b7960291497020586426e7f1fc Mon Sep 17 00:00:00 2001 From: Kenny Woodson Date: Wed, 19 Jul 2017 08:51:14 -0400 Subject: First attempt at refactor of os_firewall --- roles/nuage_master/defaults/main.yml | 8 +++++++ roles/nuage_master/meta/main.yml | 5 +---- roles/nuage_master/tasks/firewall.yml | 40 +++++++++++++++++++++++++++++++++++ roles/nuage_master/tasks/main.yaml | 4 ++++ 4 files changed, 53 insertions(+), 4 deletions(-) create mode 100644 roles/nuage_master/defaults/main.yml create mode 100644 roles/nuage_master/tasks/firewall.yml (limited to 'roles/nuage_master') diff --git a/roles/nuage_master/defaults/main.yml b/roles/nuage_master/defaults/main.yml new file mode 100644 index 000000000..7b5015a02 --- /dev/null +++ b/roles/nuage_master/defaults/main.yml @@ -0,0 +1,8 @@ +--- +nuage_mon_rest_server_port: '9443' + +r_nuage_master_os_firewall_deny: [] +r_nuage_master_os_firewall_allow: +- service: openshift-monitor + port: "{{ nuage_mon_rest_server_port }}/tcp" + cond: true diff --git a/roles/nuage_master/meta/main.yml b/roles/nuage_master/meta/main.yml index e3ed9ac71..3da340c85 100644 --- a/roles/nuage_master/meta/main.yml +++ b/roles/nuage_master/meta/main.yml @@ -16,8 +16,5 @@ dependencies: - role: nuage_ca - role: nuage_common - role: openshift_etcd_client_certificates -- role: os_firewall - role: lib_openshift - os_firewall_allow: - - service: openshift-monitor - port: "{{ nuage_mon_rest_server_port }}/tcp" +- role: lib_os_firewall diff --git a/roles/nuage_master/tasks/firewall.yml b/roles/nuage_master/tasks/firewall.yml new file mode 100644 index 000000000..b47699966 --- /dev/null +++ b/roles/nuage_master/tasks/firewall.yml @@ -0,0 +1,40 @@ +--- +- when: os_firewall_enabled | bool and not os_firewall_use_firewalld | bool + block: + - name: Add iptables allow rules + os_firewall_manage_iptables: + name: "{{ item.service }}" + action: add + protocol: "{{ item.port.split('/')[1] }}" + port: "{{ item.port.split('/')[0] }}" + when: item.cond + with_items: "{{ r_nuage_master_os_firewall_allow }}" + + - name: Remove iptables rules + os_firewall_manage_iptables: + name: "{{ item.service }}" + action: remove + protocol: "{{ item.port.split('/')[1] }}" + port: "{{ item.port.split('/')[0] }}" + when: item.cond + with_items: "{{ r_nuage_master_os_firewall_deny }}" + +- when: os_firewall_enabled | bool and os_firewall_use_firewalld | bool + block: + - name: Add firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: true + immediate: true + state: enabled + when: item.cond + with_items: "{{ r_nuage_master_os_firewall_allow }}" + + - name: Remove firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: true + immediate: true + state: disabled + when: item.cond + with_items: "{{ r_nuage_master_os_firewall_deny }}" diff --git a/roles/nuage_master/tasks/main.yaml b/roles/nuage_master/tasks/main.yaml index 4f8adb63e..cb7f75398 100644 --- a/roles/nuage_master/tasks/main.yaml +++ b/roles/nuage_master/tasks/main.yaml @@ -1,4 +1,8 @@ --- +- name: setup firewall + include: firewall.yml + static: yes + - name: Create directory /usr/share/nuage-openshift-monitor become: yes file: path=/usr/share/nuage-openshift-monitor state=directory -- cgit v1.2.3 From ba96f5eaf876f6b7568ac73794a08cbe759dceee Mon Sep 17 00:00:00 2001 From: Kenny Woodson Date: Wed, 9 Aug 2017 10:45:55 -0400 Subject: Adding a default condition and removing unneeded defaults. --- roles/nuage_master/defaults/main.yml | 1 - roles/nuage_master/tasks/firewall.yml | 8 ++++---- 2 files changed, 4 insertions(+), 5 deletions(-) (limited to 'roles/nuage_master') diff --git a/roles/nuage_master/defaults/main.yml b/roles/nuage_master/defaults/main.yml index 7b5015a02..2aed521da 100644 --- a/roles/nuage_master/defaults/main.yml +++ b/roles/nuage_master/defaults/main.yml @@ -5,4 +5,3 @@ r_nuage_master_os_firewall_deny: [] r_nuage_master_os_firewall_allow: - service: openshift-monitor port: "{{ nuage_mon_rest_server_port }}/tcp" - cond: true diff --git a/roles/nuage_master/tasks/firewall.yml b/roles/nuage_master/tasks/firewall.yml index b47699966..b4da2ac83 100644 --- a/roles/nuage_master/tasks/firewall.yml +++ b/roles/nuage_master/tasks/firewall.yml @@ -7,7 +7,7 @@ action: add protocol: "{{ item.port.split('/')[1] }}" port: "{{ item.port.split('/')[0] }}" - when: item.cond + when: item.cond | default(True) with_items: "{{ r_nuage_master_os_firewall_allow }}" - name: Remove iptables rules @@ -16,7 +16,7 @@ action: remove protocol: "{{ item.port.split('/')[1] }}" port: "{{ item.port.split('/')[0] }}" - when: item.cond + when: item.cond | default(True) with_items: "{{ r_nuage_master_os_firewall_deny }}" - when: os_firewall_enabled | bool and os_firewall_use_firewalld | bool @@ -27,7 +27,7 @@ permanent: true immediate: true state: enabled - when: item.cond + when: item.cond | default(True) with_items: "{{ r_nuage_master_os_firewall_allow }}" - name: Remove firewalld allow rules @@ -36,5 +36,5 @@ permanent: true immediate: true state: disabled - when: item.cond + when: item.cond | default(True) with_items: "{{ r_nuage_master_os_firewall_deny }}" -- cgit v1.2.3 From 7d50ffe98dfa17e3fb72627699c794843ed5295d Mon Sep 17 00:00:00 2001 From: Kenny Woodson Date: Thu, 10 Aug 2017 21:13:54 -0400 Subject: Updated README to reflect refactor. Moved firewall initialize into separate file. --- roles/nuage_master/defaults/main.yml | 3 +++ roles/nuage_master/tasks/firewall.yml | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) (limited to 'roles/nuage_master') diff --git a/roles/nuage_master/defaults/main.yml b/roles/nuage_master/defaults/main.yml index 2aed521da..ffab25775 100644 --- a/roles/nuage_master/defaults/main.yml +++ b/roles/nuage_master/defaults/main.yml @@ -1,4 +1,7 @@ --- +r_nuage_master_firewall_enabled: True +r_nuage_master_use_firewalld: False + nuage_mon_rest_server_port: '9443' r_nuage_master_os_firewall_deny: [] diff --git a/roles/nuage_master/tasks/firewall.yml b/roles/nuage_master/tasks/firewall.yml index b4da2ac83..0057dc9ab 100644 --- a/roles/nuage_master/tasks/firewall.yml +++ b/roles/nuage_master/tasks/firewall.yml @@ -1,5 +1,5 @@ --- -- when: os_firewall_enabled | bool and not os_firewall_use_firewalld | bool +- when: r_nuage_master_firewall_enabled | bool and not r_nuage_master_use_firewalld | bool block: - name: Add iptables allow rules os_firewall_manage_iptables: @@ -19,7 +19,7 @@ when: item.cond | default(True) with_items: "{{ r_nuage_master_os_firewall_deny }}" -- when: os_firewall_enabled | bool and os_firewall_use_firewalld | bool +- when: r_nuage_master_firewall_enabled | bool and r_nuage_master_use_firewalld | bool block: - name: Add firewalld allow rules firewalld: -- cgit v1.2.3