Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

metrics-for-apps: Renamed tag, added firewall rules for proxies

Browse source 
Signed-off-by: David Kirwan <dkirwan@redhat.com>
This commit is contained in:
David Kirwan 2021-09-06 12:36:00 +09:00
parent d8193ced1f
commit 991da5d981
2 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

18
inventory/group_vars/proxies
View file

@ -62,6 +62,24 @@ custom_rules: [
# For Zanata # For Zanata
# See files/httpd/website_id_fp_o_zanata.conf for info # See files/httpd/website_id_fp_o_zanata.conf for info
'-A INPUT -p tcp -m tcp --dport 44342 -s 209.132.183.252 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 44342 -s 209.132.183.252 -j ACCEPT',
# Allow ocp control plane hosts
'-A INPUT -p tcp -m tcp --dport 6443 -s 10.3.163.120 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 6443 -s 10.3.163.121 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 6443 -s 10.3.163.122 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 6443 -s 10.3.163.123 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 6443 -s 10.3.163.124 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 6443 -s 10.3.163.125 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 6443 -s 10.3.163.126 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 6443 -s 10.3.163.65 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.3.163.120 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.3.163.121 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.3.163.122 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.3.163.123 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.3.163.124 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.3.163.125 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.3.163.126 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.3.163.65 -j ACCEPT',
] ]
nat_rules: [ nat_rules: [

4
playbooks/include/proxies-reverseproxy.yml
View file

@ -637,7 +637,7 @@
balancer_members: "{{ ocp_nodes_stg }}" balancer_members: "{{ ocp_nodes_stg }}"
keephost: true keephost: true
tags: tags:
- ocp.fedoraproject.org - ocp.stg.fedoraproject.org
when: env == "staging" when: env == "staging"
- role: httpd/reverseproxy - role: httpd/reverseproxy
@ -649,7 +649,7 @@
balancer_members: "{{ ocp_nodes_stg }}" balancer_members: "{{ ocp_nodes_stg }}"
keephost: true keephost: true
tags: tags:
- apps.ocp.fedoraproject.org - apps.ocp.stg.fedoraproject.org
when: env == "staging" when: env == "staging"
- role: httpd/reverseproxy - role: httpd/reverseproxy