Minimal Firewall Exceptions (#242)

* Add rules to UFW firewall for basic K3s funtionality Signed-off-by: Derek Nola <[email protected]> * Add firewalld exceptions Signed-off-by: Derek Nola <[email protected]> --------- Signed-off-by: Derek Nola <[email protected]>
k3s-io · Nov 10, 2023 · e9a283b · e9a283b
1 parent fd4e8bf
commit e9a283b
Showing 1 changed file with 74 additions and 0 deletions.
diff --git a/roles/prereq/tasks/main.yml b/roles/prereq/tasks/main.yml
@@ -20,6 +20,80 @@
     reload: true
   when: ansible_all_ipv6_addresses
 
+- name: Populate service facts
+  ansible.builtin.service_facts:
+
+- name: Allow UFW Exceptions
+  when:
+    - ansible_facts.services['ufw'] is defined
+    - ansible_facts.services['ufw'].state == 'running'
+  block:
+    - name: Get ufw status
+      ansible.builtin.command:
+        cmd: ufw status
+      changed_when: false
+      register: ufw_status
+
+    - name: If ufw enabled, open api port
+      when:
+        - ufw_status['stdout'] == "Status':' active"
+      community.general.ufw:
+        rule: allow
+        port: "{{ api_port }}"
+        proto: tcp
+
+    - name: If ufw enabled, open etcd ports
+      when:
+        - ufw_status['stdout'] == "Status':' active"
+        - groups['server'] | length > 1
+      community.general.ufw:
+        rule: allow
+        port: "2379:2381"
+        proto: tcp
+
+    - name: If ufw enabled, allow default CIDRs
+      when:
+        - ufw_status['stdout'] == "Status':' active"
+      community.general.ufw:
+        rule: allow
+        src: '{{ item }}'
+      loop:
+        - 10.42.0.0/16  # Pods
+        - 10.43.0.0/16  # Services
+
+- name: Allow Firewalld Exceptions
+  when:
+    - ansible_facts.services['firewalld.service'] is defined
+    - ansible_facts.services['firewalld.service'].state == 'running'
+  block:
+    - name: If firewalld enabled, open api port
+      ansible.posix.firewalld:
+        port: "{{ api_port }}/tcp"
+        zone: trusted
+        state: enabled
+        permanent: true
+        immediate: true
+
+    - name: If firewalld enabled, open etcd ports
+      when: groups['server'] | length > 1
+      ansible.posix.firewalld:
+        port: "2379-2381/tcp"
+        zone: trusted
+        state: enabled
+        permanent: true
+        immediate: true
+
+    - name: If firewalld enabled, allow default CIDRs
+      ansible.posix.firewalld:
+        source: "{{ item }}"
+        zone: trusted
+        state: enabled
+        permanent: true
+        immediate: true
+      loop:
+        - 10.42.0.0/16  # Pods
+        - 10.43.0.0/16  # Services
+
 - name: Add br_netfilter to /etc/modules-load.d/
   ansible.builtin.copy:
     content: "br_netfilter"