diff options
author | Thomas Wiest <twiest@users.noreply.github.com> | 2015-03-06 10:00:31 -0500 |
---|---|---|
committer | Thomas Wiest <twiest@users.noreply.github.com> | 2015-03-06 10:00:31 -0500 |
commit | 3aed7219448ab99377643c71d05f2a26b6e11c99 (patch) | |
tree | b8f16225ad95f5692fca3d4c61c9f5f6235c732b /roles/os_firewall/tasks/firewall/firewalld.yml | |
parent | fbf0302567cfd019a762d9c37f8c10b65b269768 (diff) | |
parent | b7008f070afe2629c9ebcbbdf0af3fa1f6ed9d34 (diff) | |
download | openshift-3aed7219448ab99377643c71d05f2a26b6e11c99.tar.gz openshift-3aed7219448ab99377643c71d05f2a26b6e11c99.tar.bz2 openshift-3aed7219448ab99377643c71d05f2a26b6e11c99.tar.xz openshift-3aed7219448ab99377643c71d05f2a26b6e11c99.zip |
Merge pull request #94 from detiber/iptables
Add iptables firewall support to openshift-common
Diffstat (limited to 'roles/os_firewall/tasks/firewall/firewalld.yml')
-rw-r--r-- | roles/os_firewall/tasks/firewall/firewalld.yml | 68 |
1 files changed, 68 insertions, 0 deletions
diff --git a/roles/os_firewall/tasks/firewall/firewalld.yml b/roles/os_firewall/tasks/firewall/firewalld.yml new file mode 100644 index 000000000..f6d5fe2eb --- /dev/null +++ b/roles/os_firewall/tasks/firewall/firewalld.yml @@ -0,0 +1,68 @@ +--- +- name: Install firewalld packages + yum: + name: firewalld + state: present + +- name: Start and enable firewalld service + service: + name: firewalld + state: started + enabled: yes + register: result + +- name: need to pause here, otherwise the firewalld service starting can sometimes cause ssh to fail + pause: seconds=10 + when: result | changed + +- name: Ensure iptables services are not enabled + service: + name: "{{ item }}" + state: stopped + enabled: no + with_items: + - iptables + - ip6tables + +- name: Mask iptables services + command: systemctl mask "{{ item }}" + register: result + failed_when: result.rc != 0 + changed_when: False + with_items: + - iptables + - ip6tables + +# TODO: Ansible 1.9 will eliminate the need for separate firewalld tasks for +# enabling rules and making them permanent with the immediate flag +- name: Add firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: false + state: enabled + with_items: allow + when: allow is defined + +- name: Persist firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: true + state: enabled + with_items: allow + when: allow is defined + +- name: Remove firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: false + state: disabled + with_items: deny + when: deny is defined + +- name: Persist removal of firewalld allow rules + firewalld: + port: "{{ item.port }}" + permanent: true + state: disabled + with_items: deny + when: deny is defined |