zuul-jobs/roles/multi-node-firewall/tasks/main.yaml
Ian Wienand 3230139d65 Handle blank public_ipv4
Some clouds such as limestone have no public_ipv4; handle this in the
firewall setup

Change-Id: Id4a8032a6a14a040d62d1c70bf5e6e789fd8ff55
2018-03-27 12:27:21 +00:00

48 lines
1.2 KiB
YAML

- name: Set up the host ip addresses
set_fact:
ipv4_addresses: >
{% set hosts = [] -%}
{% for host, vars in hostvars.items() -%}
{% if vars['nodepool']['private_ipv4'] -%}
{% set _ = hosts.append(vars['nodepool']['private_ipv4']) -%}
{% endif -%}
{% if vars['nodepool']['public_ipv4'] -%}
{% set _ = hosts.append(vars['nodepool']['public_ipv4']) -%}
{% endif -%}
{% endfor -%}
{{- hosts | sort | unique -}}
ipv6_addresses: >
{% set hosts = [] -%}
{% for host, vars in hostvars.items() -%}
{% if vars['nodepool']['public_ipv6'] -%}
{% set _ = hosts.append(vars['nodepool']['public_ipv6']) -%}
{% endif -%}
{% endfor -%}
{{- hosts | sort | unique -}}
- name: Set up ipv4 iptables rules
become: yes
iptables:
state: present
action: insert
chain: INPUT
ip_version: ipv4
source: "{{ item }}"
jump: ACCEPT
with_items: "{{ ipv4_addresses }}"
- name: Set up ipv6 iptables rules
become: yes
iptables:
state: present
action: insert
chain: INPUT
ip_version: ipv6
source: "{{ item }}"
jump: ACCEPT
with_items: "{{ ipv6_addresses }}"
- name: Persist iptables rules
include_role:
name: persistent-firewall