fix: only open etcd firewall ports for embedded datastore (#567)

Signed-off-by: satoru260 <18518167+satoru260@users.noreply.github.com>

roles/prereq/tasks/main.yml

@@ -128,6 +128,7 @@
       when:
         - "'Status: active' in prereq_ufw_status['stdout']"
         - groups[server_group] | length > 1
+        - not (use_external_database | default(false) | bool)
       community.general.ufw:
         rule: allow
         port: "2379:2381"
@@ -170,7 +171,9 @@
         immediate: true
 
     - name: If firewalld enabled, open etcd ports
-      when: groups[server_group] | length > 1
+      when:
+        - groups[server_group] | length > 1
+        - not (use_external_database | default(false) | bool)
       ansible.posix.firewalld:
         port: "2379-2381/tcp"
         zone: internal

roles/prereq/templates/k3s.nft.j2

@@ -9,7 +9,7 @@ insert rule inet filter input ip saddr {{ hostvars[host].ansible_default_ipv4.ad
 
 # K3s core ports
 insert rule inet filter input tcp dport {{ api_port | default(6443) }} accept
-{% if groups[server_group] | length > 1 %}
+{% if groups[server_group] | length > 1 and not (use_external_database | default(false) | bool) %}
 insert rule inet filter input tcp dport 2379-2381 accept
 {% endif %}
 
@@ -28,4 +28,4 @@ insert rule inet filter input udp dport 30000-32767 accept
 
 # Keep forward traffic open for CNI/pod networking
 insert rule inet filter forward ct state established,related accept
-insert rule inet filter forward accept
+insert rule inet filter forward accept