summaryrefslogtreecommitdiffstats
path: root/roles/nuage_master/tasks
diff options
context:
space:
mode:
authorKenny Woodson <kwoodson@redhat.com>2017-07-19 08:51:14 -0400
committerKenny Woodson <kwoodson@redhat.com>2017-08-08 10:46:12 -0400
commit4f9b26e8af5890b7960291497020586426e7f1fc (patch)
treeba2dd554f739485a9c2e8654e6af626b54e7a520 /roles/nuage_master/tasks
parent0569c5069dabeea9e2fe94cd097cb6f2b1540867 (diff)
downloadopenshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.gz
openshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.bz2
openshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.xz
openshift-4f9b26e8af5890b7960291497020586426e7f1fc.zip
First attempt at refactor of os_firewall
Diffstat (limited to 'roles/nuage_master/tasks')
-rw-r--r--roles/nuage_master/tasks/firewall.yml40
-rw-r--r--roles/nuage_master/tasks/main.yaml4
2 files changed, 44 insertions, 0 deletions
diff --git a/roles/nuage_master/tasks/firewall.yml b/roles/nuage_master/tasks/firewall.yml
new file mode 100644
index 000000000..b47699966
--- /dev/null
+++ b/roles/nuage_master/tasks/firewall.yml
@@ -0,0 +1,40 @@
+---
+- when: os_firewall_enabled | bool and not os_firewall_use_firewalld | bool
+ block:
+ - name: Add iptables allow rules
+ os_firewall_manage_iptables:
+ name: "{{ item.service }}"
+ action: add
+ protocol: "{{ item.port.split('/')[1] }}"
+ port: "{{ item.port.split('/')[0] }}"
+ when: item.cond
+ with_items: "{{ r_nuage_master_os_firewall_allow }}"
+
+ - name: Remove iptables rules
+ os_firewall_manage_iptables:
+ name: "{{ item.service }}"
+ action: remove
+ protocol: "{{ item.port.split('/')[1] }}"
+ port: "{{ item.port.split('/')[0] }}"
+ when: item.cond
+ with_items: "{{ r_nuage_master_os_firewall_deny }}"
+
+- when: os_firewall_enabled | bool and os_firewall_use_firewalld | bool
+ block:
+ - name: Add firewalld allow rules
+ firewalld:
+ port: "{{ item.port }}"
+ permanent: true
+ immediate: true
+ state: enabled
+ when: item.cond
+ with_items: "{{ r_nuage_master_os_firewall_allow }}"
+
+ - name: Remove firewalld allow rules
+ firewalld:
+ port: "{{ item.port }}"
+ permanent: true
+ immediate: true
+ state: disabled
+ when: item.cond
+ with_items: "{{ r_nuage_master_os_firewall_deny }}"
diff --git a/roles/nuage_master/tasks/main.yaml b/roles/nuage_master/tasks/main.yaml
index 4f8adb63e..cb7f75398 100644
--- a/roles/nuage_master/tasks/main.yaml
+++ b/roles/nuage_master/tasks/main.yaml
@@ -1,4 +1,8 @@
---
+- name: setup firewall
+ include: firewall.yml
+ static: yes
+
- name: Create directory /usr/share/nuage-openshift-monitor
become: yes
file: path=/usr/share/nuage-openshift-monitor state=directory