mirrors/k3s-ansible
1
0 Fork 1
mirror of https://github.com/k3s-io/k3s-ansible.git synced 2026-10-23 03:22:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: only open etcd firewall ports for embedded datastore (#567)

Browse Source 
Signed-off-by: satoru260 <18518167+satoru260@users.noreply.github.com>
This commit is contained in:
Muma authored and GitHub committed 2026-10-05 11:11:21 -07:00
1 parent b1f5388471
commit 3693646fce
2 files changed
+5 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/prereq/tasks/main.yml
+4 -1
View File
@@ -128,6 +128,7 @@
when: when:
- "'Status: active' in prereq_ufw_status['stdout']" - "'Status: active' in prereq_ufw_status['stdout']"
- groups[server_group] | length > 1 - groups[server_group] | length > 1
- not (use_external_database | default(false) | bool)
community.general.ufw: community.general.ufw:
rule: allow rule: allow
port: "2379:2381" port: "2379:2381"
@@ -170,7 +171,9 @@
immediate: true immediate: true
- name: If firewalld enabled, open etcd ports - name: If firewalld enabled, open etcd ports
when: groups[server_group] | length > 1 when:
- groups[server_group] | length > 1
- not (use_external_database | default(false) | bool)
ansible.posix.firewalld: ansible.posix.firewalld:
port: "2379-2381/tcp" port: "2379-2381/tcp"
zone: internal zone: internal
roles/prereq/templates/k3s.nft.j2
+1 -1
View File
@@ -9,7 +9,7 @@ insert rule inet filter input ip saddr {{ hostvars[host].ansible_default_ipv4.ad
# K3s core ports # K3s core ports
insert rule inet filter input tcp dport {{ api_port | default(6443) }} accept insert rule inet filter input tcp dport {{ api_port | default(6443) }} accept
{% if groups[server_group] | length > 1 %} {% if groups[server_group] | length > 1 and not (use_external_database | default(false) | bool) %}
insert rule inet filter input tcp dport 2379-2381 accept insert rule inet filter input tcp dport 2379-2381 accept
{% endif %} {% endif %}