Skip to content

Commit 9865d4d

Browse files
Alex-WelshAlex-Welsh
committed
Improve firewall configuraton
1 parent 02e034d commit 9865d4d

File tree

8 files changed

+303
-168
lines changed

8 files changed

+303
-168
lines changed

‎etc/kayobe/compute.yml‎

Lines changed: 35 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -125,17 +125,13 @@
125125
###############################################################################
126126
# Compute node firewalld configuration.
127127

128-
# FIXME: Replace concrete names (provision_oc) with abstract net names ({{
129-
# provision_oc_net_name }}).
130-
131128
# Whether to install and enable firewalld.
132-
compute_firewalld_enabled: true
129+
compute_firewalld_enabled: false
133130

134131
# A list of zones to create. Each item is a dict containing a 'zone' item.
135-
compute_firewalld_zones:
136-
- zone: provision_oc
137-
- zone: storage
138-
- zone: tunnel
132+
compute_firewalld_zones: "{{ compute_firewalld_zones_default | union(compute_firewalld_zones_extra) | unique | select }}"
133+
compute_firewalld_zones_extra: []
134+
compute_firewalld_zones_default: "{% set network_zones = [] %}{% for network in network_interfaces %}{% set _ = network_zones.append({'zone': network | net_zone}) %}{% endfor %}{{ network_zones }}"
139135

140136
# A firewalld zone to set as the default. Default is unset, in which case the
141137
# default zone will not be changed.
@@ -148,21 +144,39 @@ compute_firewalld_default_zone: trusted
148144
# - offline: true
149145
# - permanent: true
150146
# - state: enabled
151-
compute_firewalld_rules:
152-
- service: ssh
153-
zone: provision_oc
154-
- service: dhcpv6-client
155-
state: disabled
156-
zone: public
157-
- service: ssh
158-
state: disabled
159-
zone: public
147+
148+
compute_firewalld_rules: "{{ compute_firewalld_rules_default | selectattr('enabled', 'true') | map(attribute='rules') | flatten | selectattr('network', 'in', network_interfaces) | selectattr('zone') | union(compute_firewalld_rules_extra) | unique | select }}"
149+
compute_firewalld_rules_extra: []
150+
compute_firewalld_rules_default:
151+
# Common
152+
- rules:
153+
- service: ssh
154+
state: enabled
155+
zone: "{{ provision_oc_net_name | net_zone}}"
156+
network: "{{ provision_oc_net_name }}"
157+
- service: dhcpv6-client
158+
state: disabled
159+
zone: "{{ public_net_name | net_zone}}"
160+
network: "{{ public_net_name }}"
161+
- service: ssh
162+
state: disabled
163+
zone: "{{ public_net_name | net_zone}}"
164+
network: "{{ public_net_name }}"
165+
enabled: true
160166
# GENEVE
161-
- port: 6081/udp
162-
zone: tunnel
167+
- rules:
168+
- port: 6081/udp
169+
state: enabled
170+
zone: "{{ tunnel_net_name | net_zone}}"
171+
network: "{{ tunnel_net_name }}"
172+
enabled: "{{ 'geneve' in (kolla_neutron_ml2_type_drivers + kolla_neutron_ml2_tenant_network_types) | bool }}"
163173
# VXLAN
164-
- port: 4789/udp
165-
zone: tunnel
174+
- rules:
175+
- port: 4789/udp
176+
state: enabled
177+
zone: "{{ tunnel_net_name | net_zone}}"
178+
network: "{{ tunnel_net_name }}"
179+
enabled: "{{ 'geneve' in (kolla_neutron_ml2_type_drivers + kolla_neutron_ml2_tenant_network_types) | bool }}"
166180

167181
###############################################################################
168182
# Compute node host libvirt configuration.

‎etc/kayobe/controllers.yml‎

Lines changed: 78 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -138,19 +138,12 @@
138138
# provision_oc_net_name }}).
139139

140140
# Whether to install and enable firewalld.
141-
# FIXME: Disable by default?
142-
controller_firewalld_enabled: true
141+
controller_firewalld_enabled: false
143142

144143
# A list of zones to create. Each item is a dict containing a 'zone' item.
145-
# FIXME: Filter out duplicates and unset networks?
146-
controller_firewalld_zones:
147-
- zone: external
148-
- zone: mgmt_wl
149-
- zone: provision_oc
150-
- zone: provision_wl
151-
- zone: public
152-
- zone: storage
153-
- zone: tunnel
144+
controller_firewalld_zones: "{{ controller_firewalld_zones_default | union(controller_firewalld_zones_extra) | unique | select }}"
145+
controller_firewalld_zones_extra: []
146+
controller_firewalld_zones_default: "{% set network_zones = [] %}{% for network in network_interfaces %}{% set _ = network_zones.append({'zone': network | net_zone}) %}{% endfor %}{{ network_zones }}"
154147

155148
# A firewalld zone to set as the default. Default is unset, in which case the
156149
# default zone will not be changed.
@@ -163,46 +156,84 @@ controller_firewalld_default_zone: trusted
163156
# - offline: true
164157
# - permanent: true
165158
# - state: enabled
166-
# FIXME: Add all services, add conditionals, filter out unused
167-
controller_firewalld_rules:
168-
- service: ssh
169-
zone: provision_oc
170-
- service: dhcp
171-
zone: provision_wl
172-
- service: ntp
173-
zone: provision_wl
174-
- service: tftp
175-
zone: provision_wl
176-
- port: 8089/tcp
177-
zone: provision_wl
178-
- service: cockpit
179-
state: disabled
180-
zone: public
181-
- service: dhcpv6-client
182-
state: disabled
183-
zone: public
184-
- service: ssh
185-
state: disabled
186-
zone: public
159+
controller_firewalld_rules: "{{ controller_firewalld_rules_default | selectattr('enabled', 'true') | map(attribute='rules') | flatten | selectattr('network', 'in', network_interfaces) | selectattr('zone') | union(controller_firewalld_rules_extra) | unique | select }}"
160+
controller_firewalld_rules_extra: []
161+
controller_firewalld_rules_default:
162+
# Common
163+
- rules:
164+
- service: ssh
165+
zone: "{{ provision_oc_net_name | net_zone }}"
166+
network: "{{ provision_oc_net_name }}"
167+
state: enabled
168+
- service: dhcp
169+
zone: "{{ provision_wl_net_name | net_zone }}"
170+
network: "{{ provision_wl_net_name }}"
171+
state: enabled
172+
- service: ntp
173+
zone: "{{ provision_wl_net_name | net_zone }}"
174+
network: "{{ provision_wl_net_name }}"
175+
state: enabled
176+
- service: tftp
177+
zone: "{{ provision_wl_net_name | net_zone }}"
178+
network: "{{ provision_wl_net_name }}"
179+
state: enabled
180+
- port: 8089/tcp
181+
zone: "{{ provision_wl_net_name | net_zone }}"
182+
network: "{{ provision_wl_net_name }}"
183+
state: enabled
184+
- service: cockpit
185+
zone: "{{ public_net_name | net_zone }}"
186+
network: "{{ public_net_name }}"
187+
state: disabled
188+
- service: dhcpv6-client
189+
zone: "{{ public_net_name | net_zone }}"
190+
network: "{{ public_net_name }}"
191+
state: disabled
192+
- service: ssh
193+
zone: "{{ public_net_name | net_zone }}"
194+
network: "{{ public_net_name }}"
195+
state: disabled
196+
enabled: true
187197
# Designate
188-
- port: 53/tcp
189-
zone: public
190-
- port: 53/udp
191-
zone: public
192-
# Designate AXFR
193-
- port: 5354/tcp
194-
zone: public
195-
- port: 5354/udp
196-
zone: public
198+
- rules:
199+
- port: 53/tcp
200+
zone: "{{ public_net_name | net_zone }}"
201+
network: "{{ public_net_name }}"
202+
state: enabled
203+
- port: 53/udp
204+
zone: "{{ public_net_name | net_zone }}"
205+
network: "{{ public_net_name }}"
206+
state: enabled
207+
- port: 5354/tcp
208+
zone: "{{ public_net_name | net_zone }}"
209+
network: "{{ public_net_name }}"
210+
state: enabled
211+
- port: 5354/udp
212+
zone: "{{ public_net_name | net_zone }}"
213+
network: "{{ public_net_name }}"
214+
state: enabled
215+
enabled: "{{ kolla_enable_designate | bool }}"
197216
# GENEVE
198-
- port: 6081/udp
199-
zone: tunnel
217+
- rules:
218+
- port: 6081/udp
219+
zone: "{{ tunnel_net_name | net_zone }}"
220+
network: "{{ tunnel_net_name }}"
221+
state: enabled
222+
enabled: "{{ 'geneve' in (kolla_neutron_ml2_type_drivers + kolla_neutron_ml2_tenant_network_types) | bool }}"
200223
# VXLAN
201-
- port: 4789/udp
202-
zone: tunnel
224+
- rules:
225+
- port: 4789/udp
226+
zone: "{{ tunnel_net_name | net_zone }}"
227+
network: "{{ tunnel_net_name }}"
228+
state: enabled
229+
enabled: "{{ 'vxlan' in (kolla_neutron_ml2_type_drivers + kolla_neutron_ml2_tenant_network_types) | bool }}"
203230
# Octavia
204-
- port: 5555/udp
205-
zone: lb_mgmt
231+
- rules:
232+
- port: 5555/udp
233+
zone: "{{ octavia_net_name | net_zone }}"
234+
network: "{{ octavia_net_name }}"
235+
state: enabled
236+
enabled: "{{ kolla_enable_octavia | bool }}"
206237

207238
###############################################################################
208239
# Controller node swap configuration.

‎etc/kayobe/inventory/group_vars/ansible-control/infra-vm‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,13 @@
22
###############################################################################
33
# Infrastructure VM node firewalld configuration.
44

5-
# FIXME: Replace concrete names (provision_oc) with abstract net names ({{
6-
# provision_oc_net_name }}).
7-
85
# Whether to install and enable firewalld.
9-
infra_vm_firewalld_enabled: true
6+
infra_vm_firewalld_enabled: false
107

118
# A list of zones to create. Each item is a dict containing a 'zone' item.
12-
infra_vm_firewalld_zones:
13-
- zone: mgmt_oc
14-
- zone: mgmt_wl
15-
- zone: provision_oc
16-
- zone: public
17-
- zone: switch_mgmt
9+
infra_vm_firewalld_zones: "{{ infra_vm_firewalld_zones_default | union(infra_vm_firewalld_zones_extra) | unique | select }}"
10+
infra_vm_firewalld_zones_extra: []
11+
infra_vm_firewalld_zones_default: "{% set network_zones = [] %}{% for network in network_interfaces %}{% set _ = network_zones.append({'zone': network | net_zone}) %}{% endfor %}{{ network_zones }}"
1812

1913
# A firewalld zone to set as the default. Default is unset, in which case the
2014
# default zone will not be changed.
@@ -26,8 +20,16 @@ infra_vm_firewalld_default_zone: drop
2620
# - offline: true
2721
# - permanent: true
2822
# - state: enabled
29-
infra_vm_firewalld_rules:
30-
- service: ssh
31-
zone: provision_oc
32-
- service: ssh
33-
zone: switch_mgmt
23+
infra_vm_firewalld_rules: "{{ infra_vm_firewalld_rules_default | selectattr('enabled', 'true') | map(attribute='rules') | flatten | selectattr('network', 'in', network_interfaces) | selectattr('zone') | union(infra_vm_firewalld_rules_extra) | unique | select }}"
24+
infra_vm_firewalld_rules_extra: []
25+
infra_vm_firewalld_rules_default:
26+
- rules:
27+
- service: ssh
28+
zone: "{{ provision_oc_net_name | net_zone}}"
29+
network: "{{ provision_oc_net_name }}"
30+
state: enabled
31+
- service: ssh
32+
zone: "{{ switch_mgmt_net_name | net_zone}}"
33+
network: "{{ switch_mgmt_net_name }}"
34+
state: enabled
35+
enabled: true

‎etc/kayobe/inventory/group_vars/wazuh-manager/infra-vm‎

Lines changed: 45 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,12 @@
66
# provision_oc_net_name }}).
77

88
# Whether to install and enable firewalld.
9-
infra_vm_firewalld_enabled: true
9+
infra_vm_firewalld_enabled: false
1010

1111
# A list of zones to create. Each item is a dict containing a 'zone' item.
12-
infra_vm_firewalld_zones:
13-
- zone: provision_oc
14-
- zone: public
15-
- zone: switch_mgmt
12+
infra_vm_firewalld_zones: "{{ infra_vm_firewalld_zones_default | union(infra_vm_firewalld_zones_extra) | unique | select }}"
13+
infra_vm_firewalld_zones_extra: []
14+
infra_vm_firewalld_zones_default: "{% set network_zones = [] %}{% for network in network_interfaces %}{% set _ = network_zones.append({'zone': network | net_zone}) %}{% endfor %}{{ network_zones }}"
1615

1716
# A firewalld zone to set as the default. Default is unset, in which case the
1817
# default zone will not be changed.
@@ -24,20 +23,44 @@ infra_vm_firewalld_default_zone: drop
2423
# - offline: true
2524
# - permanent: true
2625
# - state: enabled
27-
infra_vm_firewalld_rules:
28-
- service: ssh
29-
zone: provision_oc
30-
- port: 1514/tcp
31-
zone: provision_oc
32-
- port: 1514/udp
33-
zone: provision_oc
34-
- port: 1515/tcp
35-
zone: provision_oc
36-
- port: 443/tcp
37-
zone: public
38-
- port: 9200/tcp
39-
zone: provision_oc
40-
- port: 9300-9400/tcp
41-
zone: provision_oc
42-
- port: 55000/tcp
43-
zone: provision_oc
26+
infra_vm_firewalld_rules: "{{ infra_vm_firewalld_rules_default | selectattr('enabled', 'true') | map(attribute='rules') | flatten | selectattr('network', 'in', network_interfaces) | selectattr('zone') | union(infra_vm_firewalld_rules_extra) | unique | select }}"
27+
infra_vm_firewalld_rules_extra: []
28+
infra_vm_firewalld_rules_default:
29+
- rules:
30+
- service: ssh
31+
zone: "{{ provision_oc_net_name | net_zone}}"
32+
network: "{{ provision_oc_net_name }}"
33+
state: enabled
34+
- service: ssh
35+
zone: "{{ switch_mgmt_net_name | net_zone}}"
36+
network: "{{ switch_mgmt_net_name }}"
37+
state: enabled
38+
- port: 1514/tcp
39+
zone: "{{ provision_oc_net_name | net_zone }}"
40+
network: "{{ provision_oc_net_name }}"
41+
state: enabled
42+
- port: 1514/udp
43+
zone: "{{ provision_oc_net_name | net_zone }}"
44+
network: "{{ provision_oc_net_name }}"
45+
state: enabled
46+
- port: 1515/tcp
47+
zone: "{{ provision_oc_net_name | net_zone }}"
48+
network: "{{ provision_oc_net_name }}"
49+
state: enabled
50+
- port: 443/tcp
51+
zone: "{{ public_net_name | net_zone }}"
52+
network: "{{ public_net_name }}"
53+
state: enabled
54+
- port: 9200/tcp
55+
zone: "{{ provision_oc_net_name | net_zone }}"
56+
network: "{{ provision_oc_net_name }}"
57+
state: enabled
58+
- port: 9300-9400/tcp
59+
zone: "{{ provision_oc_net_name | net_zone }}"
60+
network: "{{ provision_oc_net_name }}"
61+
state: enabled
62+
- port: 55000/tcp
63+
zone: "{{ provision_oc_net_name | net_zone }}"
64+
network: "{{ provision_oc_net_name }}"
65+
state: enabled
66+
enabled: true

‎etc/kayobe/monitoring.yml‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -99,11 +99,12 @@
9999
# Monitoring node firewalld configuration.
100100

101101
# Whether to install and enable firewalld.
102-
monitoring_firewalld_enabled: true
102+
monitoring_firewalld_enabled: false
103103

104104
# A list of zones to create. Each item is a dict containing a 'zone' item.
105-
monitoring_firewalld_zones:
106-
- zone: admin_oc
105+
monitoring_firewalld_zones: "{{ monitoring_firewalld_zones_default | union(monitoring_firewalld_zones_extra) | unique | select }}"
106+
monitoring_firewalld_zones_extra: []
107+
monitoring_firewalld_zones_default: "{% set network_zones = [] %}{% for network in network_interfaces %}{% set _ = network_zones.append({'zone': network | net_zone}) %}{% endfor %}{{ network_zones }}"
107108

108109
# A firewalld zone to set as the default. Default is unset, in which case the
109110
# default zone will not be changed.
@@ -116,9 +117,15 @@ monitoring_firewalld_default_zone: trusted
116117
# - offline: true
117118
# - permanent: true
118119
# - state: enabled
119-
monitoring_firewalld_rules:
120-
- service: ssh
121-
zone: admin_oc
120+
monitoring_firewalld_rules: "{{ monitoring_firewalld_rules_default | selectattr('enabled', 'true') | map(attribute='rules') | flatten | selectattr('network', 'in', network_interfaces) | selectattr('zone') | union(monitoring_firewalld_rules_extra) | unique | select }}"
121+
monitoring_firewalld_extra: []
122+
monitoring_firewalld_default:
123+
- rules:
124+
- service: ssh
125+
zone: "{{ admin_oc_net_name | net_zone }}"
126+
network: "{{ admin_oc_net_name }}"
127+
state: enabled
128+
enabled: true
122129

123130
###############################################################################
124131
# Monitoring node swap configuration.

‎etc/kayobe/networks.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,12 @@
5959
# hosts
6060
#cleaning_net_name:
6161

62+
# Name of the network used to manage octavia loadbalancers
63+
octavia_net_name: ""
64+
65+
# Name of the network used to manage network switches
66+
switch_mgmt_net_name: ""
67+
6268
###############################################################################
6369
# Network definitions.
6470

0 commit comments

Comments
 (0)