From 507a69ed1d1bb3f19ed49d21685840fbd95d1465 Mon Sep 17 00:00:00 2001 From: Andrew Butcher Date: Mon, 2 May 2016 14:20:36 -0400 Subject: Default os_firewall_use_firewalld to false in os_firewall and remove overrides. --- roles/os_firewall/defaults/main.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'roles/os_firewall') diff --git a/roles/os_firewall/defaults/main.yml b/roles/os_firewall/defaults/main.yml index 20413d563..c870a301a 100644 --- a/roles/os_firewall/defaults/main.yml +++ b/roles/os_firewall/defaults/main.yml @@ -1,5 +1,9 @@ --- os_firewall_enabled: True -os_firewall_use_firewalld: True +# TODO: Upstream kubernetes only supports iptables currently +# TODO: it might be possible to still use firewalld if we wire up the created +# chains with the public zone (or the zone associated with the correct +# interfaces) +os_firewall_use_firewalld: False os_firewall_allow: [] os_firewall_deny: [] -- cgit v1.2.3 From 404cf230da83f91a5dd9df1f289da2c6c1b7fee7 Mon Sep 17 00:00:00 2001 From: Andrew Butcher Date: Mon, 2 May 2016 14:57:15 -0400 Subject: Check and unmask iptables/firewalld. --- roles/os_firewall/tasks/firewall/firewalld.yml | 12 ++++++++++++ roles/os_firewall/tasks/firewall/iptables.yml | 18 ++++++++++++++++++ 2 files changed, 30 insertions(+) (limited to 'roles/os_firewall') diff --git a/roles/os_firewall/tasks/firewall/firewalld.yml b/roles/os_firewall/tasks/firewall/firewalld.yml index 241fa8823..5ddca1fc0 100644 --- a/roles/os_firewall/tasks/firewall/firewalld.yml +++ b/roles/os_firewall/tasks/firewall/firewalld.yml @@ -24,6 +24,18 @@ command: systemctl daemon-reload when: install_result | changed +- name: Determine if firewalld service masked + command: > + systemctl is-enabled firewalld + register: os_firewall_firewalld_masked_output + changed_when: false + failed_when: false + +- name: Unmask firewalld service + command: > + systemctl unmask firewalld + when: os_firewall_firewalld_masked_output.stdout == "masked" + - name: Start and enable firewalld service service: name: firewalld diff --git a/roles/os_firewall/tasks/firewall/iptables.yml b/roles/os_firewall/tasks/firewall/iptables.yml index 070fe6a3a..774916798 100644 --- a/roles/os_firewall/tasks/firewall/iptables.yml +++ b/roles/os_firewall/tasks/firewall/iptables.yml @@ -32,6 +32,24 @@ command: systemctl daemon-reload when: install_result | changed +- name: Determine if iptables service masked + command: > + systemctl is-enabled {{ item }} + with_items: + - iptables + - ip6tables + register: os_firewall_iptables_masked_output + changed_when: false + failed_when: false + +- name: Unmask iptables service + command: > + systemctl unmask {{ item }} + with_items: + - iptables + - ip6tables + when: "'masked' in os_firewall_iptables_masked_output.results | map(attribute='stdout')" + - name: Start and enable iptables service service: name: iptables -- cgit v1.2.3