summaryrefslogtreecommitdiffstats
path: root/roles/os_firewall
Commit message (Collapse)AuthorAgeFilesLines
* Additional os_firewall role refactoringRussell Teague2017-08-154-29/+29
| | | | | | | | | * Remove openshift_facts dependency * Move firewall initialization from std_include.yml to openshift_cluster/config.yml Installing firewall packages is only necessary during OpenShift installation.
* Merge pull request #5051 from DenverJ/fix-iptables-reloadScott Dodson2017-08-151-0/+3
|\ | | | | Start iptables on each master in serial
| * Start iptables on each master in serialDenver Janke2017-08-101-0/+3
| | | | | | Fix task hanging when running from a master
* | Updated README to reflect refactor. Moved firewall initialize into separate ↵Kenny Woodson2017-08-102-25/+14
| | | | | | | | file.
* | First attempt at refactor of os_firewallKenny Woodson2017-08-083-315/+0
|/
* Default to iptables on masterScott Dodson2017-05-102-2/+2
| | | | | | We did this in 3.5 but never on master and we never came back to add migration support. So we'll revert this on master and if/when we add migration support we'll switch the default.
* Remove vim configuration from Python filesRodolfo Carvalho2017-05-091-1/+0
| | | | | | | In a project where contributors are free to use whatever editor they want and we have linting tools that verify the proper formatting of Python files, it should not be required to have a vim-specific line in Python files.
* Don't double quote when conditionsScott Dodson2017-05-012-2/+2
|
* Restart polkitd to workaround a bug in polkitdScott Dodson2017-04-031-0/+6
|
* Wait for firewalld polkit policy to be definedScott Dodson2017-03-301-0/+10
| | | | Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1436964
* Add 10 second wait after disabling firewalldScott Dodson2017-01-252-0/+10
|
* Remove is_containerized check for firewalld installsRussell Teague2017-01-241-2/+3
|
* [os_firewall] Fix default iptables args.Andrew Butcher2017-01-241-2/+2
|
* [os_firewall] Add -w flag to wait for iptables xtables lock.Andrew Butcher2017-01-231-1/+3
|
* Support openshift_node_port_range for configuring service NodePortsClayton Coleman2017-01-101-2/+10
| | | | | | | | | Sets the appropriate config field if openshift_node_port_range is set and also configures filewalls on each node. firewalld already supports port ranges like "30000-32000", while iptables needs that value converted to the correct "30000:32000" form for use with `--dport`. If not set, no node ports are opened.
* Enable firewalld by defaultRussell Teague2016-12-143-7/+14
|
* update tests and flake8/pylint fixesJason DeTiberus2016-11-291-24/+24
|
* Updating docs for Ansible 2.2 requirementsRussell Teague2016-11-282-2/+2
|
* Systemd `systemctl show` workaroundRussell Teague2016-11-232-2/+2
| | | | | | | | | | | `systemctl show` would exit with RC=1 for non-existent services in v231. This caused the Ansible systemd module to exit with a failure of running the `systemctl show` command instead of exiting stating the service was not found. This change catches both failures on either older or newer versions of systemd. The change in systemd exit status could be resolved in systemd v232. https://github.com/systemd/systemd/commit/3dced37b7c2c9a5c733817569d2bbbaa397adaf7
* Merge pull request #2838 from mscherer/port_py3Jason DeTiberus2016-11-221-1/+2
|\ | | | | Make os_firewall_manage_iptables run on python3
| * Make os_firewall_manage_iptables run on python3Michael Scherer2016-11-221-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It fail with that traceback: Traceback (most recent call last): File \"/tmp/ansible_ib5gpbsp/ansible_module_os_firewall_manage_iptables.py\", line 273, in <module> main() File \"/tmp/ansible_ib5gpbsp/ansible_module_os_firewall_manage_iptables.py\", line 257, in main iptables_manager.add_rule(port, protocol) File \"/tmp/ansible_ib5gpbsp/ansible_module_os_firewall_manage_iptables.py\", line 87, in add_rule self.verify_chain() File \"/tmp/ansible_ib5gpbsp/ansible_module_os_firewall_manage_iptables.py\", line 82, in verify_chain self.create_jump() File \"/tmp/ansible_ib5gpbsp/ansible_module_os_firewall_manage_iptables.py\", line 142, in create_jump input_rules = [s.split() for s in output.split('\\n')]
* | Merge pull request #2817 from mtnbikenc/os_firewall-refactorJason DeTiberus2016-11-224-105/+26
|\ \ | |/ |/| Refactor os_firewall role
| * Refactor os_firewall roleRussell Teague2016-11-214-105/+26
| | | | | | | | | | | | * Remove unneeded tasks duplicated by new module functionality * Ansible systemd module has 'masked' and 'daemon_reload' options * Ansible firewalld module has 'immediate' option
* | Refactor to use Ansible package moduleRussell Teague2016-11-172-2/+2
|/ | | | | The Ansible package module will call the correct package manager for the underlying OS.
* Added dependency of os_firewall to docker roleRussell Teague2016-11-142-1/+2
| | | | | | | | | | | The docker role requires iptables-services to be installed. Added dependency on so_firewall role to ensure the iptables service is installed first. Currently this will only work with iptables and not with firewalld. * Added allow_duplicates to os_firewall role meta * Removed unused task from docker/tasks * Corrected os_firewall Defaults in README
* Fix typosRodolfo Carvalho2016-10-191-2/+2
|
* Suppress more warnings.Andrew Butcher2016-09-281-0/+4
|
* Check if last rule is DROP when inserting iptables rules.Andrew Butcher2016-06-271-5/+5
|
* Check and unmask iptables/firewalld.Andrew Butcher2016-05-022-0/+30
|
* Default os_firewall_use_firewalld to false in os_firewall and remove overrides.Andrew Butcher2016-05-021-1/+5
|
* Cleanup various deprecation warnings.Andrew Butcher2016-04-293-12/+8
|
* Move common common facts to openshift_factsJason DeTiberus2016-03-151-1/+2
| | | | | | | - Prevents roles that need common facts from needing to require openshift_common, which pulls in the openshift binary. - Add dependency on openshift_facts to os_firewall, since it uses openshift.common facts
* Fix enabling iptables for latest rhel versionsJason DeTiberus2016-02-081-16/+16
|
* Merge pull request #1118 from detiber/os_firewall_disableBrenton Leanhardt2016-01-192-2/+3
|\ | | | | Add ability to disable os_firewall
| * Add ability to disable os_firewallJason DeTiberus2016-01-052-2/+3
| |
* | Install iptables, iptables-services when not is_aotmicScott Dodson2015-12-221-1/+1
| |
* | Skip yum/dnf ops when is_containerizedScott Dodson2015-12-151-0/+1
| |
* | Containerization work by @sdodsonScott Dodson2015-12-151-1/+1
| |
* | Initial containerization work from @ibottyTobias Florek2015-12-151-0/+1
|/ | | | copied from https://github.com/eparis/kubernetes-ansible/blob/17f98edd7ff53e649b43e26822b8fbc0be42b233/roles/common/tasks/main.yml
* Remove yum / dnf duplicationScott Dodson2015-12-092-25/+2
|
* Fedora changes:Adam Miller2015-12-022-0/+19
| | | | | | | | | | | | | - ansible bootstrap playbook for Fedora 23+ - add conditionals to handle yum vs dnf - add Fedora OpenShift COPR - update BYO host README for repo configs and fedora bootstrap Fix typo in etcd README, remove unnecessary parens in openshift_node main.yml rebase on master, update package cache refresh handler for yum vs dnf Fix typo in etcd README, remove unnecessary parens in openshift_node main.yml
* pylintJason DeTiberus2015-04-211-38/+44
|
* fixes to better deal with gce image defaultsJason DeTiberus2015-04-213-8/+3
| | | | | | | - remove exception if INPUT rules are not found, gce centos-7 image is stripped of default rules - ignore_errors for systemctl mask operation, fails with permission denied on gce centos-7 image.
* Configuration updates for latest builds and major refactorJason DeTiberus2015-04-141-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Configuration updates for latest builds - Switch to using create-node-config - Switch sdn services to use etcd over SSL - This re-uses the client certificate deployed on each node - Additional node registration changes - Do not assume that metadata service is available in openshift_facts module - Call systemctl daemon-reload after installing openshift-master, openshift-sdn-master, openshift-node, openshift-sdn-node - Fix bug overriding openshift_hostname and openshift_public_hostname in byo playbooks - Start moving generated configs to /etc/openshift - Some custom module cleanup - Add known issue with ansible-1.9 to README_OSE.md - Update to genericize the kubernetes_register_node module - Default to use kubectl for commands - Allow for overriding kubectl_cmd - In openshift_register_node role, override kubectl_cmd to openshift_kube - Set default openshift_registry_url for enterprise when deployment_type is enterprise - Fix openshift_register_node for client config change - Ensure that master certs directory is created - Add roles and filter_plugin symlinks to playbooks/common/openshift-master and node - Allow non-root user with sudo nopasswd access - Updates for README_OSE.md - Update byo inventory for adding additional comments - Updates for node cert/config sync to work with non-root user using sudo - Move node config/certs to /etc/openshift/node - Don't use path for mktemp. addresses: https://github.com/openshift/openshift-ansible/issues/154 Create common playbooks - create common/openshift-master/config.yml - create common/openshift-node/config.yml - update playbooks to use new common playbooks - update launch playbooks to call update playbooks - fix openshift_registry and openshift_node_ip usage Set default deployment type to origin - openshift_repo updates for enabling origin deployments - also separate repo and gpgkey file structure - remove kubernetes repo since it isn't currently needed - full deployment type support for bin/cluster - honor OS_DEPLOYMENT_TYPE env variable - add --deployment-type option, which will override OS_DEPLOYMENT_TYPE if set - if neither OS_DEPLOYMENT_TYPE or --deployment-type is set, defaults to origin installs Additional changes: - Add separate config action to bin/cluster that runs ansible config but does not update packages - Some more duplication reduction in cluster playbooks. - Rename task files in playbooks dirs to have tasks in their name for clarity. - update aws/gce scripts to use a directory for inventory (otherwise when there are no hosts returned from dynamic inventory there is an error) libvirt refactor and update - add libvirt dynamic inventory - updates to use dynamic inventory for libvirt
* openshift_facts role/module refactor default settingsJason DeTiberus2015-04-034-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Add openshift_facts role and module - Created new role openshift_facts that contains an openshift_facts module - Refactor openshift_* roles to use openshift_facts instead of relying on defaults - Refactor playbooks to use openshift_facts - Cleanup inventory group_vars - Update defaults - update openshift_master role firewall defaults - remove etcd peer port, since we will not be supporting clustered embedded etcd - remove 8444 since console now runs on the api port by default - add 8444 and 7001 to disabled services to ensure removal if updating - Add new role os_env_extras_node that is a subset of the docker role - previously, we were starting/enabling docker which was causing issues with some installations - Does not install or start docker, since the openshift-node role will handle that for us - Only adds root to the dockerroot group - Update playbooks to use ops_env_extras_node role instead of docker role - os_firewall bug fixes - ignore ip6tables for now, since we are not configuring any ipv6 rules - if installing package do a daemon-reload before starting/enabling service - Add aws support to bin/cluster - Add list action to bin/cluster - Add update action to bin/cluster - cleanup some stray debug statements - some variable renaming for clarity
* * Remove DOCKER chain work aroundJhon Honce2015-03-241-8/+0
|
* Revert "Jwhonce wip/cluster"Jhon Honce2015-03-241-0/+8
|
* remove os_firewall creation of DOCKER chainJason DeTiberus2015-03-241-8/+0
|
* Add verify_chain action to os_firewall_manage_iptables moduleJason DeTiberus2015-03-242-35/+47
| | | | | | - Add verify_chain action to os_firewall_manage_iptables module - Update os_firewall module to use os_firewall_manage_iptables for creating the DOCKER chain.
* * Add DOCKER chain to iptablesJhon Honce2015-03-241-0/+14
|
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-06 10:25:11 +0000