summaryrefslogtreecommitdiffstats
path: root/roles/openshift_loadbalancer/tasks
diff options
context:
space:
mode:
authorKenny Woodson <kwoodson@redhat.com>2017-07-19 08:51:14 -0400
committerKenny Woodson <kwoodson@redhat.com>2017-08-08 10:46:12 -0400
commit4f9b26e8af5890b7960291497020586426e7f1fc (patch)
treeba2dd554f739485a9c2e8654e6af626b54e7a520 /roles/openshift_loadbalancer/tasks
parent0569c5069dabeea9e2fe94cd097cb6f2b1540867 (diff)
downloadopenshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.gz
openshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.bz2
openshift-4f9b26e8af5890b7960291497020586426e7f1fc.tar.xz
openshift-4f9b26e8af5890b7960291497020586426e7f1fc.zip
First attempt at refactor of os_firewall
Diffstat (limited to 'roles/openshift_loadbalancer/tasks')
-rw-r--r--roles/openshift_loadbalancer/tasks/firewall.yml40
-rw-r--r--roles/openshift_loadbalancer/tasks/main.yml4
2 files changed, 44 insertions, 0 deletions
diff --git a/roles/openshift_loadbalancer/tasks/firewall.yml b/roles/openshift_loadbalancer/tasks/firewall.yml
new file mode 100644
index 000000000..c8628f6f8
--- /dev/null
+++ b/roles/openshift_loadbalancer/tasks/firewall.yml
@@ -0,0 +1,40 @@
+---
+- when: os_firewall_enabled | bool and not os_firewall_use_firewalld | bool
+ block:
+ - name: Add iptables allow rules
+ os_firewall_manage_iptables:
+ name: "{{ item.service }}"
+ action: add
+ protocol: "{{ item.port.split('/')[1] }}"
+ port: "{{ item.port.split('/')[0] }}"
+ when: item.cond
+ with_items: "{{ r_openshift_loadbalancer_os_firewall_allow }}"
+
+ - name: Remove iptables rules
+ os_firewall_manage_iptables:
+ name: "{{ item.service }}"
+ action: remove
+ protocol: "{{ item.port.split('/')[1] }}"
+ port: "{{ item.port.split('/')[0] }}"
+ when: item.cond
+ with_items: "{{ r_openshift_loadbalancer_os_firewall_deny }}"
+
+- when: os_firewall_enabled | bool and os_firewall_use_firewalld | bool
+ block:
+ - name: Add firewalld allow rules
+ firewalld:
+ port: "{{ item.port }}"
+ permanent: true
+ immediate: true
+ state: enabled
+ when: item.cond
+ with_items: "{{ r_openshift_loadbalancer_os_firewall_allow }}"
+
+ - name: Remove firewalld allow rules
+ firewalld:
+ port: "{{ item.port }}"
+ permanent: true
+ immediate: true
+ state: disabled
+ when: item.cond
+ with_items: "{{ r_openshift_loadbalancer_os_firewall_deny }}"
diff --git a/roles/openshift_loadbalancer/tasks/main.yml b/roles/openshift_loadbalancer/tasks/main.yml
index 68bb4ace8..69b061fc5 100644
--- a/roles/openshift_loadbalancer/tasks/main.yml
+++ b/roles/openshift_loadbalancer/tasks/main.yml
@@ -1,4 +1,8 @@
---
+- name: setup firewall
+ include: firewall.yml
+ static: yes
+
- name: Install haproxy
package: name=haproxy state=present
when: not openshift.common.is_containerized | bool