summaryrefslogtreecommitdiffstats
path: root/roles/os_firewall/tasks
diff options
context:
space:
mode:
authorThomas Wiest <twiest@users.noreply.github.com>2015-03-06 10:00:31 -0500
committerThomas Wiest <twiest@users.noreply.github.com>2015-03-06 10:00:31 -0500
commit3aed7219448ab99377643c71d05f2a26b6e11c99 (patch)
treeb8f16225ad95f5692fca3d4c61c9f5f6235c732b /roles/os_firewall/tasks
parentfbf0302567cfd019a762d9c37f8c10b65b269768 (diff)
parentb7008f070afe2629c9ebcbbdf0af3fa1f6ed9d34 (diff)
downloadopenshift-3aed7219448ab99377643c71d05f2a26b6e11c99.tar.gz
openshift-3aed7219448ab99377643c71d05f2a26b6e11c99.tar.bz2
openshift-3aed7219448ab99377643c71d05f2a26b6e11c99.tar.xz
openshift-3aed7219448ab99377643c71d05f2a26b6e11c99.zip
Merge pull request #94 from detiber/iptables
Add iptables firewall support to openshift-common
Diffstat (limited to 'roles/os_firewall/tasks')
-rw-r--r--roles/os_firewall/tasks/firewall/firewalld.yml68
-rw-r--r--roles/os_firewall/tasks/firewall/iptables.yml53
-rw-r--r--roles/os_firewall/tasks/main.yml6
3 files changed, 127 insertions, 0 deletions
diff --git a/roles/os_firewall/tasks/firewall/firewalld.yml b/roles/os_firewall/tasks/firewall/firewalld.yml
new file mode 100644
index 000000000..f6d5fe2eb
--- /dev/null
+++ b/roles/os_firewall/tasks/firewall/firewalld.yml
@@ -0,0 +1,68 @@
+---
+- name: Install firewalld packages
+ yum:
+ name: firewalld
+ state: present
+
+- name: Start and enable firewalld service
+ service:
+ name: firewalld
+ state: started
+ enabled: yes
+ register: result
+
+- name: need to pause here, otherwise the firewalld service starting can sometimes cause ssh to fail
+ pause: seconds=10
+ when: result | changed
+
+- name: Ensure iptables services are not enabled
+ service:
+ name: "{{ item }}"
+ state: stopped
+ enabled: no
+ with_items:
+ - iptables
+ - ip6tables
+
+- name: Mask iptables services
+ command: systemctl mask "{{ item }}"
+ register: result
+ failed_when: result.rc != 0
+ changed_when: False
+ with_items:
+ - iptables
+ - ip6tables
+
+# TODO: Ansible 1.9 will eliminate the need for separate firewalld tasks for
+# enabling rules and making them permanent with the immediate flag
+- name: Add firewalld allow rules
+ firewalld:
+ port: "{{ item.port }}"
+ permanent: false
+ state: enabled
+ with_items: allow
+ when: allow is defined
+
+- name: Persist firewalld allow rules
+ firewalld:
+ port: "{{ item.port }}"
+ permanent: true
+ state: enabled
+ with_items: allow
+ when: allow is defined
+
+- name: Remove firewalld allow rules
+ firewalld:
+ port: "{{ item.port }}"
+ permanent: false
+ state: disabled
+ with_items: deny
+ when: deny is defined
+
+- name: Persist removal of firewalld allow rules
+ firewalld:
+ port: "{{ item.port }}"
+ permanent: true
+ state: disabled
+ with_items: deny
+ when: deny is defined
diff --git a/roles/os_firewall/tasks/firewall/iptables.yml b/roles/os_firewall/tasks/firewall/iptables.yml
new file mode 100644
index 000000000..4f051c2bd
--- /dev/null
+++ b/roles/os_firewall/tasks/firewall/iptables.yml
@@ -0,0 +1,53 @@
+---
+- name: Install iptables packages
+ yum:
+ name: "{{ item }}"
+ state: present
+ with_items:
+ - iptables
+ - iptables-services
+
+- name: Start and enable iptables services
+ service:
+ name: "{{ os_firewall_svc }}"
+ state: started
+ enabled: yes
+ with_items:
+ - iptables
+ - ip6tables
+ register: result
+
+- name: need to pause here, otherwise the iptables service starting can sometimes cause ssh to fail
+ pause: seconds=10
+ when: result | changed
+
+- name: Ensure firewalld service is not enabled
+ service:
+ name: firewalld
+ state: stopped
+ enabled: no
+
+- name: Mask firewalld service
+ command: systemctl mask firewalld
+ register: result
+ failed_when: result.rc != 0
+ changed_when: False
+ ignore_errors: yes
+
+- name: Add iptables allow rules
+ os_firewall_manage_iptables:
+ name: "{{ item.service }}"
+ action: add
+ protocol: "{{ item.port.split('/')[1] }}"
+ port: "{{ item.port.split('/')[0] }}"
+ with_items: allow
+ when: allow is defined
+
+- name: Remove iptables rules
+ os_firewall_manage_iptables:
+ name: "{{ item.service }}"
+ action: remove
+ protocol: "{{ item.port.split('/')[1] }}"
+ port: "{{ item.port.split('/')[0] }}"
+ with_items: deny
+ when: deny is defined
diff --git a/roles/os_firewall/tasks/main.yml b/roles/os_firewall/tasks/main.yml
new file mode 100644
index 000000000..ad89ef97c
--- /dev/null
+++ b/roles/os_firewall/tasks/main.yml
@@ -0,0 +1,6 @@
+---
+- include: firewall/firewalld.yml
+ when: os_firewall_use_firewalld
+
+- include: firewall/iptables.yml
+ when: not os_firewall_use_firewalld