From 507a69ed1d1bb3f19ed49d21685840fbd95d1465 Mon Sep 17 00:00:00 2001 From: Andrew Butcher Date: Mon, 2 May 2016 14:20:36 -0400 Subject: Default os_firewall_use_firewalld to false in os_firewall and remove overrides. --- roles/cockpit/defaults/main.yml | 1 - roles/etcd/defaults/main.yaml | 1 - roles/haproxy/defaults/main.yml | 1 - roles/openshift_common/vars/main.yml | 7 ------- roles/openshift_storage_nfs/defaults/main.yml | 1 - roles/os_firewall/defaults/main.yml | 6 +++++- 6 files changed, 5 insertions(+), 12 deletions(-) delete mode 100644 roles/openshift_common/vars/main.yml diff --git a/roles/cockpit/defaults/main.yml b/roles/cockpit/defaults/main.yml index ffd55f1dd..9cf665841 100644 --- a/roles/cockpit/defaults/main.yml +++ b/roles/cockpit/defaults/main.yml @@ -1,5 +1,4 @@ --- -os_firewall_use_firewalld: false os_firewall_allow: - service: cockpit-ws port: 9090/tcp diff --git a/roles/etcd/defaults/main.yaml b/roles/etcd/defaults/main.yaml index a2212bacd..1cb055816 100644 --- a/roles/etcd/defaults/main.yaml +++ b/roles/etcd/defaults/main.yaml @@ -15,7 +15,6 @@ etcd_listen_client_urls: "{{ etcd_url_scheme }}://{{ etcd_ip }}:{{ etcd_client_p etcd_data_dir: /var/lib/etcd/ -os_firewall_use_firewalld: False os_firewall_allow: - service: etcd port: "{{etcd_client_port}}/tcp" diff --git a/roles/haproxy/defaults/main.yml b/roles/haproxy/defaults/main.yml index 937d94209..a1524cfe1 100644 --- a/roles/haproxy/defaults/main.yml +++ b/roles/haproxy/defaults/main.yml @@ -15,7 +15,6 @@ haproxy_backends: address: 127.0.0.1:9000 opts: check -os_firewall_use_firewalld: False os_firewall_allow: - service: haproxy stats port: "9000/tcp" diff --git a/roles/openshift_common/vars/main.yml b/roles/openshift_common/vars/main.yml deleted file mode 100644 index 50816d319..000000000 --- a/roles/openshift_common/vars/main.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# TODO: Upstream kubernetes only supports iptables currently, if this changes, -# then these variable should be moved to defaults -# TODO: it might be possible to still use firewalld if we wire up the created -# chains with the public zone (or the zone associated with the correct -# interfaces) -os_firewall_use_firewalld: False diff --git a/roles/openshift_storage_nfs/defaults/main.yml b/roles/openshift_storage_nfs/defaults/main.yml index 90592e9d0..df0bb9fd4 100644 --- a/roles/openshift_storage_nfs/defaults/main.yml +++ b/roles/openshift_storage_nfs/defaults/main.yml @@ -16,7 +16,6 @@ openshift: options: "*(rw,root_squash)" volume: name: "metrics" -os_firewall_use_firewalld: False os_firewall_allow: - service: nfs port: "2049/tcp" diff --git a/roles/os_firewall/defaults/main.yml b/roles/os_firewall/defaults/main.yml index 20413d563..c870a301a 100644 --- a/roles/os_firewall/defaults/main.yml +++ b/roles/os_firewall/defaults/main.yml @@ -1,5 +1,9 @@ --- os_firewall_enabled: True -os_firewall_use_firewalld: True +# TODO: Upstream kubernetes only supports iptables currently +# TODO: it might be possible to still use firewalld if we wire up the created +# chains with the public zone (or the zone associated with the correct +# interfaces) +os_firewall_use_firewalld: False os_firewall_allow: [] os_firewall_deny: [] -- cgit v1.2.3