infra: refact dashboard firewall rules

- There is no need to open ports 3000, 8234, 9283 on all nodes.
- Add missing rule for alertmanager (port 9093)

Closes: #4023
Signed-off-by: Guillaume Abrioux <gabrioux@redhat.com>
(cherry picked from commit 14f5fc3c86bcda875a1b3a989efca4cc9188d93e)

diff --git a/roles/ceph-infra/tasks/configure_firewall.yml b/roles/ceph-infra/tasks/configure_firewall.yml
index 48a8eb3a12534206ffadda3ffd8423da5407f77b..6a5b855c14aacb9933da55b226c2609c182f45d4 100644 (file)
--- a/roles/ceph-infra/tasks/configure_firewall.yml
+++ b/roles/ceph-infra/tasks/configure_firewall.yml
@@ -155,26 +155,40 @@
       - iscsi_gw_group_name in group_names
     tags: firewall
 
+  - name: open node_exporter port
+    firewalld:
+      port: "9100/tcp"
+      zone: "{{ ceph_dashboard_firewall_zone }}"
+      permanent: true
+      immediate: true
+      state: enabled
+    when: dashboard_enabled | bool
+
   - block:
-      - name: open grafana port
+      - name: open dashboard port
         firewalld:
-          port: "3000/tcp"
+          port: "{{ dashboard_port }}/tcp"
           zone: "{{ ceph_dashboard_firewall_zone }}"
           permanent: true
           immediate: true
           state: enabled
 
-      - name: open node_exporter port
+      - name: open mgr/prometheus port
         firewalld:
-          port: "9100/tcp"
+          port: "9283/tcp"
           zone: "{{ ceph_dashboard_firewall_zone }}"
           permanent: true
           immediate: true
           state: enabled
+    when:
+      - dashboard_enabled | bool
+      - mgr_group_name is defined
+      - mgr_group_name in group_names
 
-      - name: open mgr/prometheus port
+  - block:
+      - name: open grafana port
         firewalld:
-          port: "9283/tcp"
+          port: "3000/tcp"
           zone: "{{ ceph_dashboard_firewall_zone }}"
           permanent: true
           immediate: true
@@ -187,7 +201,17 @@
           permanent: true
           immediate: true
           state: enabled
-    when: dashboard_enabled
+
+      - name: open alertmanager port
+        firewalld:
+          port: "9093/tcp"
+          zone: "{{ ceph_dashboard_firewall_zone }}"
+          permanent: true
+          immediate: true
+          state: enabled
+    when:
+      - dashboard_enabled | bool
+      - inventory_hostname in groups.get('grafana-server', [])
 
   - name: open haproxy ports
     firewalld: