summaryrefslogtreecommitdiffstats
path: root/roles/etcd/tasks
diff options
context:
space:
mode:
authorKenny Woodson <kwoodson@redhat.com>2017-07-19 08:51:14 -0400
committerKenny Woodson <kwoodson@redhat.com>2017-08-08 10:46:12 -0400
commit4f9b26e8af5890b7960291497020586426e7f1fc (patch)
treeba2dd554f739485a9c2e8654e6af626b54e7a520 /roles/etcd/tasks
parent0569c5069dabeea9e2fe94cd097cb6f2b1540867 (diff)
downloadopenshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.gz
openshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.bz2
openshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.xz
openshift-4f9b26e8af5890b7960291497020586426e7f1fc.zip
First attempt at refactor of os_firewall
Diffstat (limited to 'roles/etcd/tasks')
-rw-r--r--roles/etcd/tasks/firewall.yml40
-rw-r--r--roles/etcd/tasks/main.yml4
2 files changed, 44 insertions, 0 deletions
diff --git a/roles/etcd/tasks/firewall.yml b/roles/etcd/tasks/firewall.yml
new file mode 100644
index 000000000..6088b26ff
--- /dev/null
+++ b/roles/etcd/tasks/firewall.yml
@@ -0,0 +1,40 @@
+---
+- when: os_firewall_enabled | bool and not os_firewall_use_firewalld | bool
+ block:
+ - name: Add iptables allow rules
+ os_firewall_manage_iptables:
+ name: "{{ item.service }}"
+ action: add
+ protocol: "{{ item.port.split('/')[1] }}"
+ port: "{{ item.port.split('/')[0] }}"
+ when: item.cond
+ with_items: "{{ r_etcd_os_firewall_allow }}"
+
+ - name: Remove iptables rules
+ os_firewall_manage_iptables:
+ name: "{{ item.service }}"
+ action: remove
+ protocol: "{{ item.port.split('/')[1] }}"
+ port: "{{ item.port.split('/')[0] }}"
+ when: item.cond
+ with_items: "{{ r_etcd_os_firewall_deny }}"
+
+- when: os_firewall_enabled | bool and os_firewall_use_firewalld | bool
+ block:
+ - name: Add firewalld allow rules
+ firewalld:
+ port: "{{ item.port }}"
+ permanent: true
+ immediate: true
+ state: enabled
+ when: item.cond
+ with_items: "{{ r_etcd_os_firewall_allow }}"
+
+ - name: Remove firewalld allow rules
+ firewalld:
+ port: "{{ item.port }}"
+ permanent: true
+ immediate: true
+ state: disabled
+ when: item.cond
+ with_items: "{{ r_etcd_os_firewall_deny }}"
diff --git a/roles/etcd/tasks/main.yml b/roles/etcd/tasks/main.yml
index 8c2f392ee..78e543ef1 100644
--- a/roles/etcd/tasks/main.yml
+++ b/roles/etcd/tasks/main.yml
@@ -6,6 +6,10 @@
etcd_hostname: "{{ etcd_hostname }}"
etcd_ip: "{{ etcd_ip }}"
+- name: setup firewall
+ include: firewall.yml
+ static: yes
+
- name: Install etcd
package: name=etcd{{ '-' + etcd_version if etcd_version is defined else '' }} state=present
when: not etcd_is_containerized | bool