summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
authorJason DeTiberus <detiber@gmail.com>2016-06-01 14:38:27 -0400
committerJason DeTiberus <detiber@gmail.com>2016-06-01 14:38:27 -0400
commitc4c6685855a9dc6b4c698465b799c72d6a4f13bd (patch)
tree96372201e3dab7e2dd91612bbdec72fcbe84e4e9 /roles
parent54186e0e5022a827e6ffdeaffabcb5403bebe6e6 (diff)
parent4b347b84711fdf0906fa3a270f51c38c23fe247e (diff)
downloadopenshift-c4c6685855a9dc6b4c698465b799c72d6a4f13bd.tar.gz
openshift-c4c6685855a9dc6b4c698465b799c72d6a4f13bd.tar.bz2
openshift-c4c6685855a9dc6b4c698465b799c72d6a4f13bd.tar.xz
openshift-c4c6685855a9dc6b4c698465b799c72d6a4f13bd.zip
Merge pull request #1968 from abutcher/os-firewall-eval
[v2] Move os_firewall_allow from defaults to role dependencies.
Diffstat (limited to 'roles')
-rw-r--r--roles/cockpit/defaults/main.yml4
-rw-r--r--roles/cockpit/meta/main.yml5
-rw-r--r--roles/etcd/defaults/main.yaml6
-rw-r--r--roles/etcd/meta/main.yml9
-rw-r--r--roles/openshift_loadbalancer/defaults/main.yml10
-rw-r--r--roles/openshift_loadbalancer/meta/main.yml5
-rw-r--r--roles/openshift_node/defaults/main.yml14
-rw-r--r--roles/openshift_node/meta/main.yml15
-rw-r--r--roles/openshift_storage_nfs/defaults/main.yml3
-rw-r--r--roles/openshift_storage_nfs/meta/main.yml3
10 files changed, 35 insertions, 39 deletions
diff --git a/roles/cockpit/defaults/main.yml b/roles/cockpit/defaults/main.yml
deleted file mode 100644
index 9cf665841..000000000
--- a/roles/cockpit/defaults/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-os_firewall_allow:
-- service: cockpit-ws
- port: 9090/tcp
diff --git a/roles/cockpit/meta/main.yml b/roles/cockpit/meta/main.yml
index 1e3948b19..43047902d 100644
--- a/roles/cockpit/meta/main.yml
+++ b/roles/cockpit/meta/main.yml
@@ -12,4 +12,7 @@ galaxy_info:
categories:
- cloud
dependencies:
- - { role: os_firewall }
+- role: os_firewall
+ os_firewall_allow:
+ - service: cockpit-ws
+ port: 9090/tcp
diff --git a/roles/etcd/defaults/main.yaml b/roles/etcd/defaults/main.yaml
index 1cb055816..2ec62c37c 100644
--- a/roles/etcd/defaults/main.yaml
+++ b/roles/etcd/defaults/main.yaml
@@ -14,9 +14,3 @@ etcd_advertise_client_urls: "{{ etcd_url_scheme }}://{{ etcd_ip }}:{{ etcd_clien
etcd_listen_client_urls: "{{ etcd_url_scheme }}://{{ etcd_ip }}:{{ etcd_client_port }}"
etcd_data_dir: /var/lib/etcd/
-
-os_firewall_allow:
-- service: etcd
- port: "{{etcd_client_port}}/tcp"
-- service: etcd peering
- port: "{{ etcd_peer_port }}/tcp"
diff --git a/roles/etcd/meta/main.yml b/roles/etcd/meta/main.yml
index a71b36237..7156a9fff 100644
--- a/roles/etcd/meta/main.yml
+++ b/roles/etcd/meta/main.yml
@@ -16,5 +16,10 @@ galaxy_info:
- cloud
- system
dependencies:
-- { role: os_firewall }
-- { role: etcd_common }
+- role: os_firewall
+ os_firewall_allow:
+ - service: etcd
+ port: "{{etcd_client_port}}/tcp"
+ - service: etcd peering
+ port: "{{ etcd_peer_port }}/tcp"
+- role: etcd_common
diff --git a/roles/openshift_loadbalancer/defaults/main.yml b/roles/openshift_loadbalancer/defaults/main.yml
index a1524cfe1..5c480f7c2 100644
--- a/roles/openshift_loadbalancer/defaults/main.yml
+++ b/roles/openshift_loadbalancer/defaults/main.yml
@@ -1,10 +1,10 @@
---
-haproxy_frontend_port: 80
+haproxy_frontend_port: 8443
haproxy_frontends:
- name: main
binds:
- - "*:80"
+ - "*:8443"
default_backend: default
haproxy_backends:
@@ -14,9 +14,3 @@ haproxy_backends:
- name: web01
address: 127.0.0.1:9000
opts: check
-
-os_firewall_allow:
-- service: haproxy stats
- port: "9000/tcp"
-- service: haproxy balance
- port: "{{ haproxy_frontend_port }}/tcp"
diff --git a/roles/openshift_loadbalancer/meta/main.yml b/roles/openshift_loadbalancer/meta/main.yml
index fe336acf7..96a737d2f 100644
--- a/roles/openshift_loadbalancer/meta/main.yml
+++ b/roles/openshift_loadbalancer/meta/main.yml
@@ -12,4 +12,9 @@ galaxy_info:
dependencies:
- role: openshift_facts
- role: os_firewall
+ os_firewall_allow:
+ - service: haproxy stats
+ port: "9000/tcp"
+ - service: haproxy balance
+ port: "{{ haproxy_frontend_port }}/tcp"
- role: openshift_repos
diff --git a/roles/openshift_node/defaults/main.yml b/roles/openshift_node/defaults/main.yml
index 91aed7aa3..efff5d6cd 100644
--- a/roles/openshift_node/defaults/main.yml
+++ b/roles/openshift_node/defaults/main.yml
@@ -1,16 +1,2 @@
---
-os_firewall_allow:
-- service: Kubernetes kubelet
- port: 10250/tcp
-- service: http
- port: 80/tcp
-- service: https
- port: 443/tcp
-- service: Openshift kubelet ReadOnlyPort
- port: 10255/tcp
-- service: Openshift kubelet ReadOnlyPort udp
- port: 10255/udp
-- service: OpenShift OVS sdn
- port: 4789/udp
- when: openshift.node.use_openshift_sdn | bool
openshift_version: "{{ openshift_pkg_version | default(openshift_image_tag | default(openshift.docker.openshift_image_tag | default(''))) }}"
diff --git a/roles/openshift_node/meta/main.yml b/roles/openshift_node/meta/main.yml
index 31547b846..97ab8241b 100644
--- a/roles/openshift_node/meta/main.yml
+++ b/roles/openshift_node/meta/main.yml
@@ -19,4 +19,17 @@ dependencies:
- role: openshift_node_dnsmasq
when: openshift.common.use_dnsmasq
- role: os_firewall
-
+ os_firewall_allow:
+ - service: Kubernetes kubelet
+ port: 10250/tcp
+ - service: http
+ port: 80/tcp
+ - service: https
+ port: 443/tcp
+ - service: Openshift kubelet ReadOnlyPort
+ port: 10255/tcp
+ - service: Openshift kubelet ReadOnlyPort udp
+ port: 10255/udp
+ - service: OpenShift OVS sdn
+ port: 4789/udp
+ when: openshift.node.use_openshift_sdn | bool
diff --git a/roles/openshift_storage_nfs/defaults/main.yml b/roles/openshift_storage_nfs/defaults/main.yml
index df0bb9fd4..7f3c054e7 100644
--- a/roles/openshift_storage_nfs/defaults/main.yml
+++ b/roles/openshift_storage_nfs/defaults/main.yml
@@ -16,6 +16,3 @@ openshift:
options: "*(rw,root_squash)"
volume:
name: "metrics"
-os_firewall_allow:
-- service: nfs
- port: "2049/tcp"
diff --git a/roles/openshift_storage_nfs/meta/main.yml b/roles/openshift_storage_nfs/meta/main.yml
index d675e0750..865865d9c 100644
--- a/roles/openshift_storage_nfs/meta/main.yml
+++ b/roles/openshift_storage_nfs/meta/main.yml
@@ -11,5 +11,8 @@ galaxy_info:
- 7
dependencies:
- role: os_firewall
+ os_firewall_allow:
+ - service: nfs
+ port: "2049/tcp"
- role: openshift_hosted_facts
- role: openshift_repos