security-groups.yaml

# Required Python packages:
#
# ansible
# openstackclient
# openstacksdk

- import_playbook: common.yaml

- hosts: all
  gather_facts: no

  tasks:
  - name: 'Create the controlplane security group'
    os_security_group:
      name: "{{ os_sg_controlplane }}"

  - name: 'Set controlplane security group tag'
    command:
      cmd: "openstack security group set --tag {{ cluster_id_tag }} {{ os_sg_controlplane }} "

  - name: 'Create the worker security group'
    os_security_group:
      name: "{{ os_sg_worker }}"

  - name: 'Set worker security group tag'
    command:
      cmd: "openstack security group set --tag {{ cluster_id_tag }} {{ os_sg_worker }} "

  - name: 'Create the infra security group'
    os_security_group:
      name: "{{ os_sg_infra}}"

  - name: 'Set infra security group tag'
    command:
      cmd: "openstack security group set --tag {{ cluster_id_tag }} {{ os_sg_infra }} "

  - name: 'Create the API security group'
    os_security_group:
      name: "{{ os_sg_api }}"

  - name: 'Set API security group tag'
    command:
      cmd: "openstack security group set --tag {{ cluster_id_tag }} {{ os_sg_api }} "

  - name: 'Create the ingress security group'
    os_security_group:
      name: "{{ os_sg_ingress }}"

  - name: 'Set ingress security group tag'
    command:
      cmd: "openstack security group set --tag {{ cluster_id_tag }} {{ os_sg_ingress }} "

  - name: 'Create the SSH security group'
    os_security_group:
      name: "{{ os_sg_ssh }}"

  - name: 'Set SSH security group tag'
    command:
      cmd: "openstack security group set --tag {{ cluster_id_tag }} {{ os_sg_ssh }} "

  - name: 'Create controlplane-sg rule "ICMP"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: icmp

  - name: 'Create controlplane-sg rule "machine config server"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 22623
      port_range_max: 22623

  - name: 'Create controlplane-sg rule "DNS (TCP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      remote_ip_prefix: "{{ os_subnet_range }}"
      protocol: tcp
      port_range_min: 53
      port_range_max: 53

  - name: 'Create controlplane-sg rule "DNS (UDP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      remote_ip_prefix: "{{ os_subnet_range }}"
      protocol: udp
      port_range_min: 53
      port_range_max: 53

  - name: 'Create controlplane-sg rule "mDNS"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      remote_ip_prefix: "{{ os_subnet_range }}"
      protocol: udp
      port_range_min: 5353
      port_range_max: 5353

  - name: 'Create controlplane-sg rule "VXLAN"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 4789
      port_range_max: 4789

  - name: 'Create controlplane-sg rule "Geneve"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 6081
      port_range_max: 6081

  - name: 'Create controlplane-sg rule "ovndb"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 6641
      port_range_max: 6642

  - name: 'Create controlplane-sg rule "controlplane ingress internal (TCP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 9000
      port_range_max: 9999

  - name: 'Create controlplane-sg rule "controlplane ingress internal (UDP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 9000
      port_range_max: 9999

  - name: 'Create controlplane-sg rule "kube scheduler"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 10259
      port_range_max: 10259

  - name: 'Create controlplane-sg rule "kube controller manager"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 10257
      port_range_max: 10257

  - name: 'Create controlplane-sg rule "controlplane ingress kubelet secure"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 10250
      port_range_max: 10250

  - name: 'Create controlplane-sg rule "etcd"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 2379
      port_range_max: 2380

  - name: 'Create controlplane-sg rule "controlplane ingress services (TCP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 30000
      port_range_max: 32767

  - name: 'Create controlplane-sg rule "controlplane ingress services (UDP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 30000
      port_range_max: 32767

  - name: 'Create controlplane-sg rule "VRRP"'
    os_security_group_rule:
      security_group: "{{ os_sg_controlplane }}"
      protocol: '112'
      remote_ip_prefix: "{{ os_subnet_range }}"

  - name: 'Create worker-sg rule "ICMP"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: icmp

  - name: 'Create worker-sg rule "mDNS"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 5353
      port_range_max: 5353

  - name: 'Create worker-sg rule "router"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 1936
      port_range_max: 1936

  - name: 'Create worker-sg rule "VXLAN"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 4789
      port_range_max: 4789

  - name: 'Create worker-sg rule "Geneve"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 6081
      port_range_max: 6081

  - name: 'Create worker-sg rule "worker ingress internal (TCP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 9000
      port_range_max: 9999

  - name: 'Create worker-sg rule "worker ingress internal (UDP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 9000
      port_range_max: 9999

  - name: 'Create worker-sg rule "worker ingress kubelet insecure"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 10250
      port_range_max: 10250

  - name: 'Create worker-sg rule "worker ingress services (TCP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 30000
      port_range_max: 32767

  - name: 'Create worker-sg rule "worker ingress services (UDP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 30000
      port_range_max: 32767

  - name: 'Create worker-sg rule "VRRP"'
    os_security_group_rule:
      security_group: "{{ os_sg_worker }}"
      protocol: '112'
      remote_ip_prefix: "{{ os_subnet_range }}"

  - name: 'Create infra-sg rule "ICMP"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: icmp

  - name: 'Create infra-sg rule "mDNS"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 5353
      port_range_max: 5353

  - name: 'Create infra-sg rule "router"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 1936
      port_range_max: 1936

  - name: 'Create infra-sg rule "VXLAN"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 4789
      port_range_max: 4789

  - name: 'Create infra-sg rule "Geneve"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 6081
      port_range_max: 6081

  - name: 'Create infra-sg rule "infra ingress internal (TCP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 9000
      port_range_max: 9999

  - name: 'Create infra-sg rule "infra ingress internal (UDP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 9000
      port_range_max: 9999

  - name: 'Create infra-sg rule "infra ingress kubelet insecure"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 10250
      port_range_max: 10250

  - name: 'Create infra-sg rule "infra ingress services (TCP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: tcp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 30000
      port_range_max: 32767

  - name: 'Create infra-sg rule "infra ingress services (UDP)"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: udp
      remote_ip_prefix: "{{ os_subnet_range }}"
      port_range_min: 30000
      port_range_max: 32767

  - name: 'Create infra-sg rule "VRRP"'
    os_security_group_rule:
      security_group: "{{ os_sg_infra }}"
      protocol: '112'
      remote_ip_prefix: "{{ os_subnet_range }}"

  - name: 'Create api-sg rule "OpenShift API" internal'
    os_security_group_rule:
      security_group: "{{ os_sg_api }}"
      remote_ip_prefix: "{{ os_subnet_range }}"
      protocol: tcp
      port_range_min: 6443
      port_range_max: 6443

  - name: 'Create api-sg rule "OpenShift API external"'
    os_security_group_rule:
      security_group: "{{ os_sg_api }}"
      protocol: tcp
      remote_ip_prefix: "{{ item }}"
      port_range_min: 6443
      port_range_max: 6443
    loop: "{{ apiAllowedSources }}"

  - name: 'Create ingress-sg rule "Ingress HTTP internal"'
    os_security_group_rule:
      security_group: "{{ os_sg_ingress }}"
      remote_ip_prefix: "{{ os_subnet_range }}"
      protocol: tcp
      port_range_min: 80
      port_range_max: 80

  - name: 'Create ingress-sg rule "Ingress HTTPS internal"'
    os_security_group_rule:
      security_group: "{{ os_sg_ingress }}"
      remote_ip_prefix: "{{ os_subnet_range }}"
      protocol: tcp
      port_range_min: 443
      port_range_max: 443

  - name: 'Create ingress-sg rule "Ingress HTTP external"'
    os_security_group_rule:
      security_group: "{{ os_sg_ingress }}"
      remote_ip_prefix: "{{ item }}"
      protocol: tcp
      port_range_min: 80
      port_range_max: 80
    loop: "{{ ingressAllowedSources }}"

  - name: 'Create ingress-sg rule "Ingress HTTPS external"'
    os_security_group_rule:
      security_group: "{{ os_sg_ingress }}"
      remote_ip_prefix: "{{ item }}"
      protocol: tcp
      port_range_min: 443
      port_range_max: 443
    loop: "{{ ingressAllowedSources }}"

  - name: 'Create ssh-sg rule "SSH"'
    os_security_group_rule:
      security_group: "{{ os_sg_ssh }}"
      remote_ip_prefix: "{{ item }}"
      protocol: tcp
      port_range_min: 22
      port_range_max: 22
    loop: "{{ sshAllowedSources }}"