2 files changed, 77 insertions, 31 deletions
diff --git a/roles/openshift_hosted/tasks/router/firewall.yml b/roles/openshift_hosted/tasks/router/firewall.yml
new file mode 100644
index 000000000..ff90f3372
--- /dev/null
+++ b/roles/openshift_hosted/tasks/router/firewall.yml
@@ -0,0 +1,40 @@
+---
+- when: r_openshift_hosted_router_firewall_enabled | bool and not r_openshift_hosted_router_use_firewalld | bool
+  block:
+  - name: Add iptables allow rules
+    os_firewall_manage_iptables:
+      name: "{{ item.service }}"
+      action: add
+      protocol: "{{ item.port.split('/')[1] }}"
+      port: "{{ item.port.split('/')[0] }}"
+    when: item.cond | default(True)
+    with_items: "{{ r_openshift_hosted_router_os_firewall_allow }}"
+
+  - name: Remove iptables rules
+    os_firewall_manage_iptables:
+      name: "{{ item.service }}"
+      action: remove
+      protocol: "{{ item.port.split('/')[1] }}"
+      port: "{{ item.port.split('/')[0] }}"
+    when: item.cond | default(True)
+    with_items: "{{ r_openshift_hosted_router_os_firewall_deny }}"
+
+- when: r_openshift_hosted_router_firewall_enabled | bool and r_openshift_hosted_router_use_firewalld | bool
+  block:
+  - name: Add firewalld allow rules
+    firewalld:
+      port: "{{ item.port }}"
+      permanent: true
+      immediate: true
+      state: enabled
+    when: item.cond | default(True)
+    with_items: "{{ r_openshift_hosted_router_os_firewall_allow }}"
+
+  - name: Remove firewalld allow rules
+    firewalld:
+      port: "{{ item.port }}"
+      permanent: true
+      immediate: true
+      state: disabled
+    when: item.cond | default(True)
+    with_items: "{{ r_openshift_hosted_router_os_firewall_deny }}"
diff --git a/roles/openshift_hosted/tasks/router/router.yml b/roles/openshift_hosted/tasks/router/router.yml
index dd485a64a..e57ed733e 100644
--- a/roles/openshift_hosted/tasks/router/router.yml
+++ b/roles/openshift_hosted/tasks/router/router.yml
@@ -1,4 +1,8 @@
 ---
+- name: setup firewall
+  include: firewall.yml
+  static: yes
+
 - name: Retrieve list of openshift nodes matching router selector
   oc_obj:
     state: list
@@ -90,36 +94,38 @@
     stats_port: "{{ item.stats_port }}"
   with_items: "{{ openshift_hosted_routers }}"
 
-- name: Ensure OpenShift router correctly rolls out (best-effort today)
-  command: |
-    {{ openshift.common.client_binary }} rollout status deploymentconfig {{ item.name }} \
-                      --namespace {{ item.namespace | default('default') }} \
-                      --config {{ openshift.common.config_base }}/master/admin.kubeconfig
-  async: 600
-  poll: 15
-  with_items: "{{ openshift_hosted_routers }}"
-  failed_when: false
+- when: openshift_hosted_router_wait
+  block:
+  - name: Ensure OpenShift router correctly rolls out (best-effort today)
+    command: |
+      {{ openshift.common.client_binary }} rollout status deploymentconfig {{ item.name }} \
+                        --namespace {{ item.namespace | default('default') }} \
+                        --config {{ openshift.common.config_base }}/master/admin.kubeconfig
+    async: 600
+    poll: 15
+    with_items: "{{ openshift_hosted_routers }}"
+    failed_when: false
 
-- name: Determine the latest version of the OpenShift router deployment
-  command: |
-    {{ openshift.common.client_binary }} get deploymentconfig {{ item.name }} \
-           --namespace {{ item.namespace }} \
-           --config {{ openshift.common.config_base }}/master/admin.kubeconfig \
-           -o jsonpath='{ .status.latestVersion }'
-  register: openshift_hosted_routers_latest_version
-  with_items: "{{ openshift_hosted_routers }}"
+  - name: Determine the latest version of the OpenShift router deployment
+    command: |
+      {{ openshift.common.client_binary }} get deploymentconfig {{ item.name }} \
+             --namespace {{ item.namespace }} \
+             --config {{ openshift.common.config_base }}/master/admin.kubeconfig \
+             -o jsonpath='{ .status.latestVersion }'
+    register: openshift_hosted_routers_latest_version
+    with_items: "{{ openshift_hosted_routers }}"
 
-- name: Poll for OpenShift router deployment success
-  command: |
-    {{ openshift.common.client_binary }} get replicationcontroller {{ item.0.name }}-{{ item.1.stdout }} \
-           --namespace {{ item.0.namespace }} \
-           --config {{ openshift.common.config_base }}/master/admin.kubeconfig \
-           -o jsonpath='{ .metadata.annotations.openshift\.io/deployment\.phase }'
-  register: openshift_hosted_router_rc_phase
-  until: "'Running' not in openshift_hosted_router_rc_phase.stdout"
-  delay: 15
-  retries: 40
-  failed_when: "'Failed' in openshift_hosted_router_rc_phase.stdout"
-  with_together:
-  - "{{ openshift_hosted_routers }}"
-  - "{{ openshift_hosted_routers_latest_version.results }}"
+  - name: Poll for OpenShift router deployment success
+    command: |
+      {{ openshift.common.client_binary }} get replicationcontroller {{ item.0.name }}-{{ item.1.stdout }} \
+             --namespace {{ item.0.namespace }} \
+             --config {{ openshift.common.config_base }}/master/admin.kubeconfig \
+             -o jsonpath='{ .metadata.annotations.openshift\.io/deployment\.phase }'
+    register: openshift_hosted_router_rc_phase
+    until: "'Running' not in openshift_hosted_router_rc_phase.stdout"
+    delay: 15
+    retries: 40
+    failed_when: "'Failed' in openshift_hosted_router_rc_phase.stdout"
+    with_together:
+    - "{{ openshift_hosted_routers }}"
+    - "{{ openshift_hosted_routers_latest_version.results }}"