From 3693646fce9321ea17d67f2456e3f4b95df3e6bd Mon Sep 17 00:00:00 2001
From: Muma <18518167+satoru260@users.noreply.github.com>
Date: Mon, 5 Oct 2026 20:11:21 +0200
Subject: [PATCH] fix: only open etcd firewall ports for embedded datastore
 (#567)

Signed-off-by: satoru260 <18518167+satoru260@users.noreply.github.com>
---
 roles/prereq/tasks/main.yml       | 5 ++++-
 roles/prereq/templates/k3s.nft.j2 | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/roles/prereq/tasks/main.yml b/roles/prereq/tasks/main.yml
index 529b63c..b9b7a94 100644
--- a/roles/prereq/tasks/main.yml
+++ b/roles/prereq/tasks/main.yml
@@ -128,6 +128,7 @@
       when:
         - "'Status: active' in prereq_ufw_status['stdout']"
         - groups[server_group] | length > 1
+        - not (use_external_database | default(false) | bool)
       community.general.ufw:
         rule: allow
         port: "2379:2381"
@@ -170,7 +171,9 @@
         immediate: true
 
     - name: If firewalld enabled, open etcd ports
-      when: groups[server_group] | length > 1
+      when:
+        - groups[server_group] | length > 1
+        - not (use_external_database | default(false) | bool)
       ansible.posix.firewalld:
         port: "2379-2381/tcp"
         zone: internal
diff --git a/roles/prereq/templates/k3s.nft.j2 b/roles/prereq/templates/k3s.nft.j2
index 45794bb..27200c4 100644
--- a/roles/prereq/templates/k3s.nft.j2
+++ b/roles/prereq/templates/k3s.nft.j2
@@ -9,7 +9,7 @@ insert rule inet filter input ip saddr {{ hostvars[host].ansible_default_ipv4.ad
 
 # K3s core ports
 insert rule inet filter input tcp dport {{ api_port | default(6443) }} accept
-{% if groups[server_group] | length > 1 %}
+{% if groups[server_group] | length > 1 and not (use_external_database | default(false) | bool) %}
 insert rule inet filter input tcp dport 2379-2381 accept
 {% endif %}
 
@@ -28,4 +28,4 @@ insert rule inet filter input udp dport 30000-32767 accept
 
 # Keep forward traffic open for CNI/pod networking
 insert rule inet filter forward ct state established,related accept
-insert rule inet filter forward accept
\ No newline at end of file
+insert rule inet filter forward accept