summaryrefslogtreecommitdiff
path: root/roles/os_firewall/tasks
AgeCommit message (Collapse)Author
2018-01-18Allow for firewalld on atomic hostScott Dodson
Right now this is only available on fedora so guard it with openshift_enable_unsupported_configurations
2017-12-14Deprecate using Ansible tests as filtersRussell Teague
2017-11-30retry package operationsLuke Meyer
When a package install/update fails due to network blips or other spotty availability, retry it. If the failure is a real failure (e.g. package is really not there) it still fails after 3 tries (Ansible default).
2017-11-22Include Deprecation - openshift-loadbalancerRussell Teague
2017-09-13Only attempt to start iptables on hosts in the current batchScott Dodson
If os_firewall role is called from within a play that uses serial then it was attempting to start iptables on hosts that may not have had iptables installed on them yet. So limit the hosts to the current batch. According to the ansible docs on plays where serial is unused this is the same as ansible_play_hosts. See http://docs.ansible.com/ansible/latest/playbooks_variables.html Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1490739
2017-08-15Additional os_firewall role refactoringRussell Teague
* Remove openshift_facts dependency * Move firewall initialization from std_include.yml to openshift_cluster/config.yml Installing firewall packages is only necessary during OpenShift installation.
2017-08-15Merge pull request #5051 from DenverJ/fix-iptables-reloadScott Dodson
Start iptables on each master in serial
2017-08-10Start iptables on each master in serialDenver Janke
Fix task hanging when running from a master
2017-08-08First attempt at refactor of os_firewallKenny Woodson
2017-05-01Don't double quote when conditionsScott Dodson
2017-04-03Restart polkitd to workaround a bug in polkitdScott Dodson
2017-03-30Wait for firewalld polkit policy to be definedScott Dodson
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1436964
2017-01-25Add 10 second wait after disabling firewalldScott Dodson
2017-01-24Remove is_containerized check for firewalld installsRussell Teague
2016-12-14Enable firewalld by defaultRussell Teague
2016-11-23Systemd `systemctl show` workaroundRussell Teague
`systemctl show` would exit with RC=1 for non-existent services in v231. This caused the Ansible systemd module to exit with a failure of running the `systemctl show` command instead of exiting stating the service was not found. This change catches both failures on either older or newer versions of systemd. The change in systemd exit status could be resolved in systemd v232. https://github.com/systemd/systemd/commit/3dced37b7c2c9a5c733817569d2bbbaa397adaf7
2016-11-22Merge pull request #2817 from mtnbikenc/os_firewall-refactorJason DeTiberus
Refactor os_firewall role
2016-11-21Refactor os_firewall roleRussell Teague
* Remove unneeded tasks duplicated by new module functionality * Ansible systemd module has 'masked' and 'daemon_reload' options * Ansible firewalld module has 'immediate' option
2016-11-17Refactor to use Ansible package moduleRussell Teague
The Ansible package module will call the correct package manager for the underlying OS.
2016-09-28Suppress more warnings.Andrew Butcher
2016-05-02Check and unmask iptables/firewalld.Andrew Butcher
2016-04-29Cleanup various deprecation warnings.Andrew Butcher
2016-02-08Fix enabling iptables for latest rhel versionsJason DeTiberus
2016-01-19Merge pull request #1118 from detiber/os_firewall_disableBrenton Leanhardt
Add ability to disable os_firewall
2016-01-05Add ability to disable os_firewallJason DeTiberus
2015-12-22Install iptables, iptables-services when not is_aotmicScott Dodson
2015-12-15Skip yum/dnf ops when is_containerizedScott Dodson
2015-12-15Containerization work by @sdodsonScott Dodson
2015-12-15Initial containerization work from @ibottyTobias Florek
copied from https://github.com/eparis/kubernetes-ansible/blob/17f98edd7ff53e649b43e26822b8fbc0be42b233/roles/common/tasks/main.yml
2015-12-09Remove yum / dnf duplicationScott Dodson
2015-12-02Fedora changes:Adam Miller
- ansible bootstrap playbook for Fedora 23+ - add conditionals to handle yum vs dnf - add Fedora OpenShift COPR - update BYO host README for repo configs and fedora bootstrap Fix typo in etcd README, remove unnecessary parens in openshift_node main.yml rebase on master, update package cache refresh handler for yum vs dnf Fix typo in etcd README, remove unnecessary parens in openshift_node main.yml
2015-04-21fixes to better deal with gce image defaultsJason DeTiberus
- remove exception if INPUT rules are not found, gce centos-7 image is stripped of default rules - ignore_errors for systemctl mask operation, fails with permission denied on gce centos-7 image.
2015-04-03openshift_facts role/module refactor default settingsJason DeTiberus
- Add openshift_facts role and module - Created new role openshift_facts that contains an openshift_facts module - Refactor openshift_* roles to use openshift_facts instead of relying on defaults - Refactor playbooks to use openshift_facts - Cleanup inventory group_vars - Update defaults - update openshift_master role firewall defaults - remove etcd peer port, since we will not be supporting clustered embedded etcd - remove 8444 since console now runs on the api port by default - add 8444 and 7001 to disabled services to ensure removal if updating - Add new role os_env_extras_node that is a subset of the docker role - previously, we were starting/enabling docker which was causing issues with some installations - Does not install or start docker, since the openshift-node role will handle that for us - Only adds root to the dockerroot group - Update playbooks to use ops_env_extras_node role instead of docker role - os_firewall bug fixes - ignore ip6tables for now, since we are not configuring any ipv6 rules - if installing package do a daemon-reload before starting/enabling service - Add aws support to bin/cluster - Add list action to bin/cluster - Add update action to bin/cluster - cleanup some stray debug statements - some variable renaming for clarity
2015-03-09os_firewall fixesJason DeTiberus
- Fix variable references to os_firewall_{allow,deny} instead of {allow, deny} - Fix ordering of service stop/start to ensure firewall rules are properly initiated after service startup - Add test for package installed before attempting to disable or mask services
2015-03-06start fixing os_firewall issuesJason DeTiberus
- Fix missed references to old firewall scripts - Fix variable name references that didn't get updated
2015-03-05refactor firewall management into new roleJason DeTiberus
- Add os_firewall role - Remove firewall settings from base_os, add wait task to os_firewall - Added a iptables firewall module for maintaining the following (in a mostly naive manner): - ensure the OPENSHIFT_ALLOW chain is defined - ensure that there is a jump rule in the INPUT chain for OPENSHIFT_ALLOW - adds or removes entries from the OPENSHIFT_ALLOW chain - issues '/usr/libexec/iptables/iptables.init save' when rules are changed - Limitations of iptables firewall module - only allows setting of ports/protocols to open - no testing on ipv6 support - made os_firewall a dependency of openshift_common - Hardcoded openshift_common to use iptables (through the vars directory) until upstream support is in place for firewalld
generated by cgit v1.2.3 (git 2.39.1) at 2026-03-09 07:08:22 +0000