summaryrefslogtreecommitdiffstats
path: root/roles/base_os/tasks
diff options
context:
space:
mode:
authorJason DeTiberus <jdetiber@redhat.com>2015-03-03 13:06:49 -0500
committerJason DeTiberus <jdetiber@redhat.com>2015-03-05 17:37:19 -0500
commit7c90cacef0f5cf61fb8ac3adb905507dd4247d84 (patch)
tree708aacc9b414cc8392927ecd1ab515a0faaa7f49 /roles/base_os/tasks
parent151f10b010651a49dfb4b46ca74e966be36b1279 (diff)
downloadopenshift-7c90cacef0f5cf61fb8ac3adb905507dd4247d84.tar.gz
openshift-7c90cacef0f5cf61fb8ac3adb905507dd4247d84.tar.bz2
openshift-7c90cacef0f5cf61fb8ac3adb905507dd4247d84.tar.xz
openshift-7c90cacef0f5cf61fb8ac3adb905507dd4247d84.zip
refactor firewall management into new role
- Add os_firewall role - Remove firewall settings from base_os, add wait task to os_firewall - Added a iptables firewall module for maintaining the following (in a mostly naive manner): - ensure the OPENSHIFT_ALLOW chain is defined - ensure that there is a jump rule in the INPUT chain for OPENSHIFT_ALLOW - adds or removes entries from the OPENSHIFT_ALLOW chain - issues '/usr/libexec/iptables/iptables.init save' when rules are changed - Limitations of iptables firewall module - only allows setting of ports/protocols to open - no testing on ipv6 support - made os_firewall a dependency of openshift_common - Hardcoded openshift_common to use iptables (through the vars directory) until upstream support is in place for firewalld
Diffstat (limited to 'roles/base_os/tasks')
-rw-r--r--roles/base_os/tasks/main.yaml16
1 files changed, 0 insertions, 16 deletions
diff --git a/roles/base_os/tasks/main.yaml b/roles/base_os/tasks/main.yaml
index 51fe1e5b6..aad611f70 100644
--- a/roles/base_os/tasks/main.yaml
+++ b/roles/base_os/tasks/main.yaml
@@ -15,19 +15,3 @@
yum:
pkg: bash-completion
state: installed
-
-- name: Install firewalld
- yum:
- pkg: firewalld
- state: installed
-
-- name: start and enable firewalld service
- service:
- name: firewalld
- state: started
- enabled: yes
- register: result
-
-- name: need to pause here, otherwise the firewalld service starting can sometimes cause ssh to fail
- pause: seconds=10
- when: result | changed