fix: only open etcd firewall ports for embedded datastore (#567)

Signed-off-by: satoru260 <18518167+satoru260@users.noreply.github.com>

roles/prereq/templates/k3s.nft.j2

@@ -9,7 +9,7 @@ insert rule inet filter input ip saddr {{ hostvars[host].ansible_default_ipv4.ad
 
 # K3s core ports
 insert rule inet filter input tcp dport {{ api_port | default(6443) }} accept
-{% if groups[server_group] | length > 1 %}
+{% if groups[server_group] | length > 1 and not (use_external_database | default(false) | bool) %}
 insert rule inet filter input tcp dport 2379-2381 accept
 {% endif %}
 
@@ -28,4 +28,4 @@ insert rule inet filter input udp dport 30000-32767 accept
 
 # Keep forward traffic open for CNI/pod networking
 insert rule inet filter forward ct state established,related accept
-insert rule inet filter forward accept
+insert rule inet filter forward accept