firewall: add mds, nfs, restapi and iscsi ports, remove 'configure_firewall' variable...

Signed-off-by: Eduard Egorov <eduard.egorov@icl-services.com>

diff --git a/group_vars/all.yml.sample b/group_vars/all.yml.sample
index 3871dfd0d90dbe2e1e5415b5b4afb62f033f6803..dbcc290bb9a1b2f1c16b8751d466a50b9a6c4d72 100644 (file)
--- a/group_vars/all.yml.sample
+++ b/group_vars/all.yml.sample
@@ -60,11 +60,15 @@ dummy:
 # want to set this to False to skip those checks.
 #check_firewall: False
 
-# Note: this task will only configure pre-installed firewall
-#configure_firewall: False
-#ceph_mon_firewall_zone: dmz
-#ceph_osd_firewall_zone: dmz
-#ceph_rgw_firewall_zone: dmz
+# Open ports on corresponding nodes if firewall is installed on it
+#ceph_mon_firewall_zone: public
+#ceph_osd_firewall_zone: public
+#ceph_rgw_firewall_zone: public
+#ceph_mds_firewall_zone: public
+#ceph_nfs_firewall_zone: public
+#ceph_restapi_firewall_zone: public
+#ceph_rbdmirror_firewall_zone: public
+#ceph_iscsi_firewall_zone: public
 
 ############
 # PACKAGES #

diff --git a/group_vars/rhcs.yml.sample b/group_vars/rhcs.yml.sample
index 3ec464af500cb377ca328b800863ae0bc6eb1272..e97b924541e078c7cceeadf636ad88526651f4b1 100644 (file)
--- a/group_vars/rhcs.yml.sample
+++ b/group_vars/rhcs.yml.sample
@@ -60,11 +60,15 @@ fetch_directory: ~/ceph-ansible-keys
 # want to set this to False to skip those checks.
 #check_firewall: False
 
-# Note: this task will only configure pre-installed firewall
-#configure_firewall: False
-#ceph_mon_firewall_zone: dmz
-#ceph_osd_firewall_zone: dmz
-#ceph_rgw_firewall_zone: dmz
+# Open ports on corresponding nodes if firewall is installed on it
+#ceph_mon_firewall_zone: public
+#ceph_osd_firewall_zone: public
+#ceph_rgw_firewall_zone: public
+#ceph_mds_firewall_zone: public
+#ceph_nfs_firewall_zone: public
+#ceph_restapi_firewall_zone: public
+#ceph_rbdmirror_firewall_zone: public
+#ceph_iscsi_firewall_zone: public
 
 ############
 # PACKAGES #

diff --git a/roles/ceph-common/tasks/main.yml b/roles/ceph-common/tasks/main.yml
index 5acb41a3dc24240613d2b949d49ec499a9e94f2a..090debdf582bb49c376bb548dcfcab58b50ec55b 100644 (file)
--- a/roles/ceph-common/tasks/main.yml
+++ b/roles/ceph-common/tasks/main.yml
@@ -12,10 +12,10 @@
   # Hard code this so we will skip the entire file instead of individual tasks (Default isn't Consistent)
   static: False
 
-- name: include misc/configure_firewall.yml
-  include: misc/configure_firewall.yml
+- name: include misc/configure_firewall_rpm.yml
+  include: misc/configure_firewall_rpm.yml
   when:
-    - configure_firewall
+    - ansible_os_family in ['RedHat', 'Suse']
   # Hard code this so we will skip the entire file instead of individual tasks (Default isn't Consistent)
   static: False
 

diff --git a/roles/ceph-common/tasks/misc/configure_firewall.yml b/roles/ceph-common/tasks/misc/configure_firewall.yml
deleted file mode 100644 (file)
index 4b16687..0000000
--- a/roles/ceph-common/tasks/misc/configure_firewall.yml
+++ /dev/null
@@ -1,57 +0,0 @@
----
-- name: check firewalld installation on redhat
-  command: rpm -q firewalld
-  register: firewalld
-  ignore_errors: true
-  always_run: true
-  changed_when: false
-  when: ansible_os_family == 'RedHat'
-  tags:
-    - firewall
-
-- name: open monitor ports
-  firewalld:
-    service: ceph-mon
-    zone: "{{ ceph_mon_firewall_zone }}"
-    permanent: true
-    immediate: false # if true then fails in case firewalld is stopped
-    state: enabled
-  notify: restart firewalld
-  when:
-    - mon_group_name is defined
-    - mon_group_name in group_names
-    - firewalld.rc == 0
-  tags:
-    - firewall
-
-- name: open osd ports
-  firewalld:
-    service: ceph
-    zone: "{{ ceph_osd_firewall_zone }}"
-    permanent: true
-    immediate: false # if true then fails in case firewalld is stopped
-    state: enabled
-  notify: restart firewalld
-  when:
-    - osd_group_name is defined
-    - osd_group_name in group_names
-    - firewalld.rc == 0
-  tags:
-    - firewall
-
-- name: open rgw ports
-  firewalld:
-    port: "{{ radosgw_civetweb_port }}/tcp"
-    zone: "{{ ceph_rgw_firewall_zone }}"
-    permanent: true
-    immediate: false # if true then fails in case firewalld is stopped
-    state: enabled
-  notify: restart firewalld
-  when:
-    - rgw_group_name is defined
-    - rgw_group_name in group_names
-    - firewalld.rc == 0
-  tags:
-    - firewall
-
-- meta: flush_handlers

diff --git a/roles/ceph-common/tasks/misc/configure_firewall_rpm.yml b/roles/ceph-common/tasks/misc/configure_firewall_rpm.yml
new file mode 100644 (file)
index 0000000..f6da3cb
--- /dev/null
+++ b/roles/ceph-common/tasks/misc/configure_firewall_rpm.yml
@@ -0,0 +1,148 @@
+---
+- name: check firewalld installation on redhat or suse
+  command: rpm -q firewalld
+  args:
+    warn: no
+  register: firewalld_pkg_query
+  ignore_errors: true
+  check_mode: no
+  changed_when: false
+  tags:
+    - firewall
+
+- name: open monitor ports
+  firewalld:
+    service: ceph-mon
+    zone: "{{ ceph_mon_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - mon_group_name is defined
+    - mon_group_name in group_names
+    - firewalld_pkg_query.rc == 0
+  tags:
+    - firewall
+
+- name: open osd ports
+  firewalld:
+    service: ceph
+    zone: "{{ ceph_osd_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - osd_group_name is defined
+    - osd_group_name in group_names
+    - firewalld_pkg_query.rc == 0
+  tags:
+    - firewall
+
+- name: open rgw ports
+  firewalld:
+    port: "{{ radosgw_civetweb_port }}/tcp"
+    zone: "{{ ceph_rgw_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - rgw_group_name is defined
+    - rgw_group_name in group_names
+    - firewalld_pkg_query.rc == 0
+  tags:
+    - firewall
+
+- name: open mds ports
+  firewalld:
+    service: ceph
+    zone: "{{ ceph_mds_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - mds_group_name is defined
+    - mds_group_name in group_names
+    - firewalld_pkg_query.rc == 0
+  tags:
+    - firewall
+
+- name: open nfs ports
+  firewalld:
+    service: nfs
+    zone: "{{ ceph_nfs_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - nfs_group_name is defined
+    - nfs_group_name in group_names
+    - firewalld_pkg_query.rc == 0
+  tags:
+    - firewall
+
+- name: open nfs ports (portmapper)
+  firewalld:
+    port: "111/tcp"
+    zone: "{{ ceph_nfs_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - nfs_group_name is defined
+    - nfs_group_name in group_names
+    - firewalld_pkg_query.rc == 0
+  tags:
+    - firewall
+
+- name: open restapi ports
+  firewalld:
+    port: "{{ restapi_port }}/tcp"
+    zone: "{{ ceph_restapi_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - restapi_group_name is defined
+    - restapi_group_name in group_names
+    - firewalld_pkg_query.rc == 0
+  tags:
+    - firewall
+
+- name: open rbdmirror ports
+  firewalld:
+    service: ceph
+    zone: "{{ ceph_rbdmirror_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - rbdmirror_group_name is defined
+    - rbdmirror_group_name in group_names
+    - firewalld_pkg_query.rc == 0
+  tags:
+    - firewall
+
+- name: open iscsi ports
+  firewalld:
+    port: "5001/tcp"
+    zone: "{{ ceph_iscsi_firewall_zone }}"
+    permanent: true
+    immediate: false # if true then fails in case firewalld is stopped
+    state: enabled
+  notify: restart firewalld
+  when:
+    - iscsi_group_name is defined
+    - iscsi_group_name in group_names
+    - firewalld_pkg_query.rc == 0
+  tags:
+    - firewall
+
+- meta: flush_handlers

diff --git a/roles/ceph-defaults/defaults/main.yml b/roles/ceph-defaults/defaults/main.yml
index 3d19ea2b0edb812e61bcebebe8ffba84eb544dee..5817a653f33bcee5b475b0bc10b0ca42de4d75a3 100644 (file)
--- a/roles/ceph-defaults/defaults/main.yml
+++ b/roles/ceph-defaults/defaults/main.yml
@@ -52,11 +52,15 @@ mgr_group_name: mgrs
 # want to set this to False to skip those checks.
 check_firewall: False
 
-# Note: this task will only configure pre-installed firewall
-configure_firewall: False
-ceph_mon_firewall_zone: dmz
-ceph_osd_firewall_zone: dmz
-ceph_rgw_firewall_zone: dmz
+# Open ports on corresponding nodes if firewall is installed on it
+ceph_mon_firewall_zone: public
+ceph_osd_firewall_zone: public
+ceph_rgw_firewall_zone: public
+ceph_mds_firewall_zone: public
+ceph_nfs_firewall_zone: public
+ceph_restapi_firewall_zone: public
+ceph_rbdmirror_firewall_zone: public
+ceph_iscsi_firewall_zone: public
 
 ############
 # PACKAGES #