summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorScott Dodson <sdodson@redhat.com>2016-05-09 11:20:00 -0400
committerScott Dodson <sdodson@redhat.com>2016-05-11 10:57:49 -0400
commit90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a (patch)
treecf5861aec37fae436d895a0271c50aa50c9b3417
parent45e5e99b1d8d155a9680f1ac00ac5fb8cfab8bec (diff)
downloadopenshift-90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a.tar.gz
openshift-90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a.tar.bz2
openshift-90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a.tar.xz
openshift-90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a.zip
Fix firewall rules
-rw-r--r--roles/openshift_master/defaults/main.yml36
-rw-r--r--roles/openshift_master/meta/main.yml27
2 files changed, 27 insertions, 36 deletions
diff --git a/roles/openshift_master/defaults/main.yml b/roles/openshift_master/defaults/main.yml
index 16df984f9..dbd62c80f 100644
--- a/roles/openshift_master/defaults/main.yml
+++ b/roles/openshift_master/defaults/main.yml
@@ -1,40 +1,4 @@
---
openshift_node_ips: []
-
# TODO: update setting these values based on the facts
-os_firewall_allow:
-- service: etcd embedded
- port: 4001/tcp
-- service: api server https
- port: "{{ openshift.master.api_port }}/tcp"
-- service: api controllers https
- port: "{{ openshift.master.controllers_port }}/tcp"
-- service: skydns tcp
- port: "{{ openshift.master.dns_port }}/tcp"
-- service: skydns udp
- port: "{{ openshift.master.dns_port }}/udp"
-# On HA masters version_gte facts are not properly set so open port 53
-# whenever we're not certain of the need
-- service: legacy skydns tcp
- port: "53/tcp"
- when: "{{ 'version' not in openshift.common or openshift.common.version == None }}"
-- service: legacy skydns udp
- port: "53/udp"
- when: "{{ 'version' not in openshift.common or openshift.common.version == None }}"
-- service: Fluentd td-agent tcp
- port: 24224/tcp
-- service: Fluentd td-agent udp
- port: 24224/udp
-- service: pcsd
- port: 2224/tcp
-- service: Corosync UDP
- port: 5404/udp
-- service: Corosync UDP
- port: 5405/udp
-os_firewall_deny:
-- service: api server http
- port: 8080/tcp
-- service: former etcd peer port
- port: 7001/tcp
-
openshift_version: "{{ openshift_pkg_version | default(openshift_image_tag | default(openshift.docker.openshift_image_tag | default(''))) }}"
diff --git a/roles/openshift_master/meta/main.yml b/roles/openshift_master/meta/main.yml
index e882e0b8b..02fab6e82 100644
--- a/roles/openshift_master/meta/main.yml
+++ b/roles/openshift_master/meta/main.yml
@@ -18,3 +18,30 @@ dependencies:
- role: openshift_builddefaults
- role: openshift_master_facts
- role: openshift_hosted_facts
+- role: os_firewall
+ os_firewall_allow:
+ - service: etcd embedded
+ port: 4001/tcp
+ - service: api server https
+ port: "{{ openshift.master.api_port }}/tcp"
+ - service: api controllers https
+ port: "{{ openshift.master.controllers_port }}/tcp"
+ - service: skydns tcp
+ port: "{{ openshift.master.dns_port }}/tcp"
+ - service: skydns udp
+ port: "{{ openshift.master.dns_port }}/udp"
+ - service: Fluentd td-agent tcp
+ port: 24224/tcp
+ - service: Fluentd td-agent udp
+ port: 24224/udp
+ - service: pcsd
+ port: 2224/tcp
+ - service: Corosync UDP
+ port: 5404/udp
+ - service: Corosync UDP
+ port: 5405/udp
+ os_firewall_deny:
+ - service: api server http
+ port: 8080/tcp
+ - service: former etcd peer port
+ port: 7001/tcp