Fix firewalld policy

k3s-io · Apr 4, 2024 · 58e1d34 · 58e1d34
1 parent 1cae275
commit 58e1d34
Showing 1 changed file with 17 additions and 2 deletions.
diff --git a/roles/prereq/tasks/main.yml b/roles/prereq/tasks/main.yml
@@ -73,7 +73,7 @@
     - name: If firewalld enabled, open api port
       ansible.posix.firewalld:
         port: "{{ api_port }}/tcp"
-        zone: trusted
+        zone: internal
         state: enabled
         permanent: true
         immediate: true
@@ -82,10 +82,25 @@
       when: groups['server'] | length > 1
       ansible.posix.firewalld:
         port: "2379-2381/tcp"
-        zone: trusted
+        zone: internal
+        state: enabled
+        permanent: true
+        immediate: true
+
+    - name: If firewalld enabled, open inbound ports
+      ansible.posix.firewalld:
+        port: "{{ item }}"
+        zone: internal
         state: enabled
         permanent: true
         immediate: true
+      with_items:
+        - 8472/udp
+        - 10250/tcp
+        - 51820/udp
+        - 51821/udp
+        - 5001/tcp
+        - 6443/tcp
 
     - name: If firewalld enabled, allow default CIDRs
       ansible.posix.firewalld: