diff options
| author | Scott Dodson <sdodson@redhat.com> | 2016-05-09 11:20:00 -0400 |
|---|---|---|
| committer | Scott Dodson <sdodson@redhat.com> | 2016-05-11 10:57:49 -0400 |
| commit | 90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a (patch) | |
| tree | cf5861aec37fae436d895a0271c50aa50c9b3417 | |
| parent | 45e5e99b1d8d155a9680f1ac00ac5fb8cfab8bec (diff) | |
| download | openshift-90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a.tar.gz openshift-90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a.tar.bz2 openshift-90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a.tar.xz openshift-90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a.zip | |
Fix firewall rules
| -rw-r--r-- | roles/openshift_master/defaults/main.yml | 36 | ||||
| -rw-r--r-- | roles/openshift_master/meta/main.yml | 27 |
2 files changed, 27 insertions, 36 deletions
diff --git a/roles/openshift_master/defaults/main.yml b/roles/openshift_master/defaults/main.yml index 16df984f9..dbd62c80f 100644 --- a/roles/openshift_master/defaults/main.yml +++ b/roles/openshift_master/defaults/main.yml @@ -1,40 +1,4 @@ --- openshift_node_ips: [] - # TODO: update setting these values based on the facts -os_firewall_allow: -- service: etcd embedded - port: 4001/tcp -- service: api server https - port: "{{ openshift.master.api_port }}/tcp" -- service: api controllers https - port: "{{ openshift.master.controllers_port }}/tcp" -- service: skydns tcp - port: "{{ openshift.master.dns_port }}/tcp" -- service: skydns udp - port: "{{ openshift.master.dns_port }}/udp" -# On HA masters version_gte facts are not properly set so open port 53 -# whenever we're not certain of the need -- service: legacy skydns tcp - port: "53/tcp" - when: "{{ 'version' not in openshift.common or openshift.common.version == None }}" -- service: legacy skydns udp - port: "53/udp" - when: "{{ 'version' not in openshift.common or openshift.common.version == None }}" -- service: Fluentd td-agent tcp - port: 24224/tcp -- service: Fluentd td-agent udp - port: 24224/udp -- service: pcsd - port: 2224/tcp -- service: Corosync UDP - port: 5404/udp -- service: Corosync UDP - port: 5405/udp -os_firewall_deny: -- service: api server http - port: 8080/tcp -- service: former etcd peer port - port: 7001/tcp - openshift_version: "{{ openshift_pkg_version | default(openshift_image_tag | default(openshift.docker.openshift_image_tag | default(''))) }}" diff --git a/roles/openshift_master/meta/main.yml b/roles/openshift_master/meta/main.yml index e882e0b8b..02fab6e82 100644 --- a/roles/openshift_master/meta/main.yml +++ b/roles/openshift_master/meta/main.yml @@ -18,3 +18,30 @@ dependencies: - role: openshift_builddefaults - role: openshift_master_facts - role: openshift_hosted_facts +- role: os_firewall + os_firewall_allow: + - service: etcd embedded + port: 4001/tcp + - service: api server https + port: "{{ openshift.master.api_port }}/tcp" + - service: api controllers https + port: "{{ openshift.master.controllers_port }}/tcp" + - service: skydns tcp + port: "{{ openshift.master.dns_port }}/tcp" + - service: skydns udp + port: "{{ openshift.master.dns_port }}/udp" + - service: Fluentd td-agent tcp + port: 24224/tcp + - service: Fluentd td-agent udp + port: 24224/udp + - service: pcsd + port: 2224/tcp + - service: Corosync UDP + port: 5404/udp + - service: Corosync UDP + port: 5405/udp + os_firewall_deny: + - service: api server http + port: 8080/tcp + - service: former etcd peer port + port: 7001/tcp |