summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndrew Butcher <abutcher@redhat.com>2016-05-02 14:57:15 -0400
committerAndrew Butcher <abutcher@redhat.com>2016-05-02 14:58:00 -0400
commit404cf230da83f91a5dd9df1f289da2c6c1b7fee7 (patch)
treed7a7b30df1f40534f583e1c119f971b3765e6a2e
parent507a69ed1d1bb3f19ed49d21685840fbd95d1465 (diff)
downloadopenshift-404cf230da83f91a5dd9df1f289da2c6c1b7fee7.tar.gz
openshift-404cf230da83f91a5dd9df1f289da2c6c1b7fee7.tar.bz2
openshift-404cf230da83f91a5dd9df1f289da2c6c1b7fee7.tar.xz
openshift-404cf230da83f91a5dd9df1f289da2c6c1b7fee7.zip
Check and unmask iptables/firewalld.
-rw-r--r--roles/os_firewall/tasks/firewall/firewalld.yml12
-rw-r--r--roles/os_firewall/tasks/firewall/iptables.yml18
2 files changed, 30 insertions, 0 deletions
diff --git a/roles/os_firewall/tasks/firewall/firewalld.yml b/roles/os_firewall/tasks/firewall/firewalld.yml
index 241fa8823..5ddca1fc0 100644
--- a/roles/os_firewall/tasks/firewall/firewalld.yml
+++ b/roles/os_firewall/tasks/firewall/firewalld.yml
@@ -24,6 +24,18 @@
command: systemctl daemon-reload
when: install_result | changed
+- name: Determine if firewalld service masked
+ command: >
+ systemctl is-enabled firewalld
+ register: os_firewall_firewalld_masked_output
+ changed_when: false
+ failed_when: false
+
+- name: Unmask firewalld service
+ command: >
+ systemctl unmask firewalld
+ when: os_firewall_firewalld_masked_output.stdout == "masked"
+
- name: Start and enable firewalld service
service:
name: firewalld
diff --git a/roles/os_firewall/tasks/firewall/iptables.yml b/roles/os_firewall/tasks/firewall/iptables.yml
index 070fe6a3a..774916798 100644
--- a/roles/os_firewall/tasks/firewall/iptables.yml
+++ b/roles/os_firewall/tasks/firewall/iptables.yml
@@ -32,6 +32,24 @@
command: systemctl daemon-reload
when: install_result | changed
+- name: Determine if iptables service masked
+ command: >
+ systemctl is-enabled {{ item }}
+ with_items:
+ - iptables
+ - ip6tables
+ register: os_firewall_iptables_masked_output
+ changed_when: false
+ failed_when: false
+
+- name: Unmask iptables service
+ command: >
+ systemctl unmask {{ item }}
+ with_items:
+ - iptables
+ - ip6tables
+ when: "'masked' in os_firewall_iptables_masked_output.results | map(attribute='stdout')"
+
- name: Start and enable iptables service
service:
name: iptables