80 lines
2.1 KiB
YAML
80 lines
2.1 KiB
YAML
---
|
|
# Copyright 2019 Red Hat, Inc.
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
|
|
- name: Save firewall rules ipv4
|
|
command: /usr/libexec/iptables/iptables.init save
|
|
become: true
|
|
listen: Save firewall rules
|
|
|
|
- name: Save firewall rules ipv6
|
|
command: /usr/libexec/iptables/ip6tables.init save
|
|
become: true
|
|
listen: Save firewall rules
|
|
|
|
- name: Enable iptables service (and do a daemon-reload systemd)
|
|
systemd:
|
|
daemon_reload: true
|
|
enabled: true
|
|
name: "{{ item }}"
|
|
state: started
|
|
loop:
|
|
- iptables.service
|
|
- ip6tables.service
|
|
become: true
|
|
listen: Save firewall rules
|
|
|
|
- name: Enable tripleo-iptables service (and do a daemon-reload systemd)
|
|
systemd:
|
|
daemon_reload: true
|
|
enabled: true
|
|
name: "{{ item }}"
|
|
state: started
|
|
loop:
|
|
- tripleo-iptables.service
|
|
- tripleo-ip6tables.service
|
|
failed_when: false
|
|
become: true
|
|
listen: Save firewall rules
|
|
|
|
- name: Stop and disable firewalld
|
|
systemd:
|
|
enabled: false
|
|
name: "firewalld.service"
|
|
state: stopped
|
|
failed_when: false
|
|
become: true
|
|
listen: Save firewall rules
|
|
|
|
- name: Find non-persistent rules
|
|
command: egrep -l 'comment.*(neutron-|ironic-inspector)' /etc/sysconfig/iptables* /etc/sysconfig/ip6tables*
|
|
failed_when: false
|
|
changed_when: false
|
|
register: neutron_rules
|
|
become: true
|
|
listen: Save firewall rules
|
|
|
|
- name: Remove non-persistent line(s)
|
|
lineinfile:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
regexp: '^((?!.*comment)(?=.*(ironic-inspector|neutron-)))'
|
|
when:
|
|
- item.find('v=' ~ '^/') == -1
|
|
loop: "{{ neutron_rules.stdout_lines }}"
|
|
become: true
|
|
listen: Save firewall rules
|