mirrors/k3s-ansible
1
0 Fork 1
mirror of https://github.com/k3s-io/k3s-ansible.git synced 2026-10-23 03:22:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: add firewall variable (#552)

Browse Source 
* feat: add firewall variable

Signed-off-by: Michel Bathe <michel.bathe.1996@googlemail.com>

* feat: put manage_firewall dafault in defaults/main.yml

Signed-off-by: Michel Bathe <michel.bathe.1996@googlemail.com>

* fix: lint

Signed-off-by: Michel Bathe <michel.bathe.1996@googlemail.com>

* fix: lint

Signed-off-by: Michel Bathe <michel.bathe.1996@googlemail.com>

---------

Signed-off-by: Michel Bathe <michel.bathe.1996@googlemail.com>
This commit is contained in:
mbathe19 authored and GitHub committed 2026-08-13 11:56:16 -07:00
1 parent 5f98ca7a23
commit cb38fd92e3
3 files changed
+6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

inventory-sample.yml
+1
View File
@@ -33,6 +33,7 @@ k3s_cluster:
# systemd_dir: /etc/systemd/system # systemd_dir: /etc/systemd/system
# extra_service_envs: [ 'ENV_VAR1=VALUE1', 'ENV_VAR2=VALUE2' ] # extra_service_envs: [ 'ENV_VAR1=VALUE1', 'ENV_VAR2=VALUE2' ]
# user_kubectl: true, by default kubectl is symlinked and configured for use by ansible_user. Set to false to only kubectl via root user. # user_kubectl: true, by default kubectl is symlinked and configured for use by ansible_user. Set to false to only kubectl via root user.
# manage_firewall: false
# Manifests or Airgap should be either full paths or relative to the playbook directory. # Manifests or Airgap should be either full paths or relative to the playbook directory.
# List of locally available manifests to apply to the cluster, useful for PVCs or Traefik modifications. # List of locally available manifests to apply to the cluster, useful for PVCs or Traefik modifications.
roles/prereq/defaults/main.yml
+1
View File
@@ -2,3 +2,4 @@
api_port: 6443 # noqa var-naming[no-role-prefix] api_port: 6443 # noqa var-naming[no-role-prefix]
server_group: server # noqa var-naming[no-role-prefix] server_group: server # noqa var-naming[no-role-prefix]
agent_group: agent # noqa var-naming[no-role-prefix] agent_group: agent # noqa var-naming[no-role-prefix]
manage_firewall: true
roles/prereq/tasks/main.yml
+4
View File
@@ -45,6 +45,7 @@
- name: Handle modern nftables/iptables-nft stack (Arch Linux 6.18+) - name: Handle modern nftables/iptables-nft stack (Arch Linux 6.18+)
when: when:
- manage_firewall
- ansible_facts['distribution'] == 'Archlinux' - ansible_facts['distribution'] == 'Archlinux'
- ansible_facts['kernel'] is version('6.18', '>=') - ansible_facts['kernel'] is version('6.18', '>=')
block: block:
@@ -72,6 +73,7 @@
- name: Configure nftables include and K3s rules fragment - name: Configure nftables include and K3s rules fragment
when: when:
- manage_firewall
- ansible_facts.services['nftables.service'] is defined - ansible_facts.services['nftables.service'] is defined
- ansible_facts.services['nftables.service'].status == 'enabled' - ansible_facts.services['nftables.service'].status == 'enabled'
block: block:
@@ -104,6 +106,7 @@
- name: Allow UFW Exceptions - name: Allow UFW Exceptions
when: when:
- manage_firewall
- ansible_facts.services['ufw'] is defined - ansible_facts.services['ufw'] is defined
- ansible_facts.services['ufw'].state == 'running' - ansible_facts.services['ufw'].state == 'running'
block: block:
@@ -154,6 +157,7 @@
- name: Allow Firewalld Exceptions - name: Allow Firewalld Exceptions
when: when:
- manage_firewall
- ansible_facts.services['firewalld.service'] is defined - ansible_facts.services['firewalld.service'] is defined
- ansible_facts.services['firewalld.service'].state == 'running' - ansible_facts.services['firewalld.service'].state == 'running'
block: block: