firewall: configure firewalld if it's already installed on the host (#2192).

Signed-off-by: Eduard Egorov <eduard.egorov@icl-services.com>

diff --git a/group_vars/all.yml.sample b/group_vars/all.yml.sample
index 6b42ea21a6925a346a5abbb4e5ad0b45bfe2c757..3871dfd0d90dbe2e1e5415b5b4afb62f033f6803 100644 (file)
--- a/group_vars/all.yml.sample
+++ b/group_vars/all.yml.sample
@@ -60,6 +60,11 @@ dummy:
 # want to set this to False to skip those checks.
 #check_firewall: False
 
+# Note: this task will only configure pre-installed firewall
+#configure_firewall: False
+#ceph_mon_firewall_zone: dmz
+#ceph_osd_firewall_zone: dmz
+#ceph_rgw_firewall_zone: dmz
 
 ############
 # PACKAGES #

diff --git a/group_vars/rhcs.yml.sample b/group_vars/rhcs.yml.sample
index 76de30f309ae2346e6451205ea408b3b31251705..3ec464af500cb377ca328b800863ae0bc6eb1272 100644 (file)
--- a/group_vars/rhcs.yml.sample
+++ b/group_vars/rhcs.yml.sample
@@ -60,6 +60,11 @@ fetch_directory: ~/ceph-ansible-keys
 # want to set this to False to skip those checks.
 #check_firewall: False
 
+# Note: this task will only configure pre-installed firewall
+#configure_firewall: False
+#ceph_mon_firewall_zone: dmz
+#ceph_osd_firewall_zone: dmz
+#ceph_rgw_firewall_zone: dmz
 
 ############
 # PACKAGES #

diff --git a/roles/ceph-common/handlers/main.yml b/roles/ceph-common/handlers/main.yml
new file mode 100644 (file)
index 0000000..5a9d524
--- /dev/null
+++ b/roles/ceph-common/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+- name: restart firewalld
+  service:
+    name: firewalld
+    state: restarted
+    enabled: yes

diff --git a/roles/ceph-common/tasks/main.yml b/roles/ceph-common/tasks/main.yml
index 5aee03eb016f2094ce10e6d0bed752c6da9be403..5acb41a3dc24240613d2b949d49ec499a9e94f2a 100644 (file)
--- a/roles/ceph-common/tasks/main.yml
+++ b/roles/ceph-common/tasks/main.yml
@@ -12,6 +12,13 @@
   # Hard code this so we will skip the entire file instead of individual tasks (Default isn't Consistent)
   static: False
 
+- name: include misc/configure_firewall.yml
+  include: misc/configure_firewall.yml
+  when:
+    - configure_firewall
+  # Hard code this so we will skip the entire file instead of individual tasks (Default isn't Consistent)
+  static: False
+
 - name: include misc/system_tuning.yml
   include: misc/system_tuning.yml
   when:

diff --git a/roles/ceph-common/tasks/misc/configure_firewall.yml b/roles/ceph-common/tasks/misc/configure_firewall.yml
new file mode 100644 (file)
index 0000000..4b16687
--- /dev/null
+++ b/roles/ceph-common/tasks/misc/configure_firewall.yml
@@ -0,0 +1,57 @@
+---
+- name: check firewalld installation on redhat
+  command: rpm -q firewalld
+  register: firewalld
+  ignore_errors: true
+  always_run: true
+  changed_when: false
+  when: ansible_os_family == 'RedHat'
+  tags:
+    - firewall
+
+- name: open monitor ports
+  firewalld:
+    service: ceph-mon
+    zone: "{{ ceph_mon_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - mon_group_name is defined
+    - mon_group_name in group_names
+    - firewalld.rc == 0
+  tags:
+    - firewall
+
+- name: open osd ports
+  firewalld:
+    service: ceph
+    zone: "{{ ceph_osd_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - osd_group_name is defined
+    - osd_group_name in group_names
+    - firewalld.rc == 0
+  tags:
+    - firewall
+
+- name: open rgw ports
+  firewalld:
+    port: "{{ radosgw_civetweb_port }}/tcp"
+    zone: "{{ ceph_rgw_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - rgw_group_name is defined
+    - rgw_group_name in group_names
+    - firewalld.rc == 0
+  tags:
+    - firewall
+
+- meta: flush_handlers

diff --git a/roles/ceph-defaults/defaults/main.yml b/roles/ceph-defaults/defaults/main.yml
index ec2fcae0b907973b533064709bddbf7b00b25ae5..3d19ea2b0edb812e61bcebebe8ffba84eb544dee 100644 (file)
--- a/roles/ceph-defaults/defaults/main.yml
+++ b/roles/ceph-defaults/defaults/main.yml
@@ -52,6 +52,11 @@ mgr_group_name: mgrs
 # want to set this to False to skip those checks.
 check_firewall: False
 
+# Note: this task will only configure pre-installed firewall
+configure_firewall: False
+ceph_mon_firewall_zone: dmz
+ceph_osd_firewall_zone: dmz
+ceph_rgw_firewall_zone: dmz
 
 ############
 # PACKAGES #