From 90f35c759af2cb483f0dc4ccccbb9ad0cf450d7a Mon Sep 17 00:00:00 2001 From: Scott Dodson Date: Mon, 9 May 2016 11:20:00 -0400 Subject: Fix firewall rules --- roles/openshift_master/meta/main.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'roles/openshift_master/meta') diff --git a/roles/openshift_master/meta/main.yml b/roles/openshift_master/meta/main.yml index e882e0b8b..02fab6e82 100644 --- a/roles/openshift_master/meta/main.yml +++ b/roles/openshift_master/meta/main.yml @@ -18,3 +18,30 @@ dependencies: - role: openshift_builddefaults - role: openshift_master_facts - role: openshift_hosted_facts +- role: os_firewall + os_firewall_allow: + - service: etcd embedded + port: 4001/tcp + - service: api server https + port: "{{ openshift.master.api_port }}/tcp" + - service: api controllers https + port: "{{ openshift.master.controllers_port }}/tcp" + - service: skydns tcp + port: "{{ openshift.master.dns_port }}/tcp" + - service: skydns udp + port: "{{ openshift.master.dns_port }}/udp" + - service: Fluentd td-agent tcp + port: 24224/tcp + - service: Fluentd td-agent udp + port: 24224/udp + - service: pcsd + port: 2224/tcp + - service: Corosync UDP + port: 5404/udp + - service: Corosync UDP + port: 5405/udp + os_firewall_deny: + - service: api server http + port: 8080/tcp + - service: former etcd peer port + port: 7001/tcp -- cgit v1.2.3 From a97cbe973a76b95d64855dcb558b4f5629d82a62 Mon Sep 17 00:00:00 2001 From: Scott Dodson Date: Mon, 9 May 2016 14:59:13 -0400 Subject: Remove old unused firewall rules --- roles/openshift_master/meta/main.yml | 5 ----- 1 file changed, 5 deletions(-) (limited to 'roles/openshift_master/meta') diff --git a/roles/openshift_master/meta/main.yml b/roles/openshift_master/meta/main.yml index 02fab6e82..d8834d27f 100644 --- a/roles/openshift_master/meta/main.yml +++ b/roles/openshift_master/meta/main.yml @@ -40,8 +40,3 @@ dependencies: port: 5404/udp - service: Corosync UDP port: 5405/udp - os_firewall_deny: - - service: api server http - port: 8080/tcp - - service: former etcd peer port - port: 7001/tcp -- cgit v1.2.3