You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
117 lines
3.8 KiB
YAML
117 lines
3.8 KiB
YAML
---
|
|
|
|
# updates firewall config
|
|
|
|
# Parameters:
|
|
# playbook inventory
|
|
# stage := the name of the stage (e.g. dev, int, qa, prod)
|
|
|
|
#############################################################
|
|
# Creating inventory dynamically for given parameters
|
|
#############################################################
|
|
|
|
- hosts: localhost
|
|
gather_facts: false
|
|
connection: local
|
|
|
|
pre_tasks:
|
|
- name: "Check if ansible version is at least {{ ansible_minimal_version }}"
|
|
assert:
|
|
that:
|
|
- ansible_version.string is version(ansible_minimal_version, ">=")
|
|
msg: "The ansible version has to be at least {{ ansible_minimal_version }}"
|
|
|
|
# add virtual server to load stage specific variables as context
|
|
- name: "Add <{{ stage }}-virtual-host-to-read-groups-vars> to hosts"
|
|
add_host:
|
|
name: "{{ stage }}-virtual-host-to-read-groups-vars"
|
|
groups:
|
|
- "stage_{{ stage }}"
|
|
changed_when: False
|
|
|
|
#############################################################
|
|
# Creating inventory dynamically for given parameters
|
|
#############################################################
|
|
|
|
- hosts: "{{ stage }}-virtual-host-to-read-groups-vars"
|
|
serial: "{{ serial_number | default(1) }}"
|
|
gather_facts: false
|
|
connection: local
|
|
|
|
tasks:
|
|
- name: "Setup base hcloud firewall rules"
|
|
include_role:
|
|
name: hcloud
|
|
tasks_from: configure-firewall2
|
|
loop: "{{ hcloud_firewall_objects }}"
|
|
loop_control:
|
|
loop_var: firewall_object
|
|
#
|
|
- name: "Generate awx-related hcloud firewall rules"
|
|
block:
|
|
- name: "Lookup hetzner servers - smaradigo k8s worker nodes"
|
|
delegate_to: localhost
|
|
hcloud_server_info:
|
|
api_token: "{{ hetzner_authentication_ansible_vault }}"
|
|
label_selector: "service=kube_node,stage={{ stage }}"
|
|
register: found_servers
|
|
|
|
- name: "Initial VAR(s)"
|
|
set_fact:
|
|
k8s_worker_node_ips: []
|
|
|
|
- name: "Get IPs from k8s worker nodes"
|
|
set_fact:
|
|
k8s_worker_node_ips: '{{ k8s_worker_node_ips + [ item + "/32" ] }}'
|
|
loop: '{{ found_servers.hcloud_server_info | selectattr("ipv4_address","defined") | map(attribute="ipv4_address") }}'
|
|
|
|
- name: "Setup hcloud firewalls for AWX stuff..."
|
|
include_role:
|
|
name: hcloud
|
|
tasks_from: configure-firewall2
|
|
loop: "{{ hcloud_firewall_objects_awx }}"
|
|
loop_control:
|
|
loop_var: firewall_object
|
|
|
|
- name: "Setup hcloud firewalls for database backup..."
|
|
include_role:
|
|
name: hcloud
|
|
tasks_from: configure-firewall2
|
|
loop: "{{ hcloud_firewall_objects_backup }}"
|
|
loop_control:
|
|
loop_var: firewall_object
|
|
|
|
- name: "Setup hcloud firewalls for gitea..."
|
|
include_role:
|
|
name: hcloud
|
|
tasks_from: configure-firewall2
|
|
loop: "{{ hcloud_firewall_objects_gitea }}"
|
|
loop_control:
|
|
loop_var: firewall_object
|
|
|
|
- name: "Setup hcloud firewalls for keycloak..."
|
|
include_role:
|
|
name: hcloud
|
|
tasks_from: configure-firewall2
|
|
loop: "{{ hcloud_firewall_objects_keycloak }}"
|
|
loop_control:
|
|
loop_var: firewall_object
|
|
|
|
- name: "Setup hcloud firewalls for kibana..."
|
|
include_role:
|
|
name: hcloud
|
|
tasks_from: configure-firewall2
|
|
loop: "{{ hcloud_firewall_objects_kibana }}"
|
|
loop_control:
|
|
loop_var: firewall_object
|
|
|
|
- name: "Setup hcloud firewalls for management..."
|
|
include_role:
|
|
name: hcloud
|
|
tasks_from: configure-firewall2
|
|
loop: "{{ hcloud_firewall_objects_management }}"
|
|
loop_control:
|
|
loop_var: firewall_object
|
|
# end of BLOCK
|
|
when: hcloud_firewall_app_specific_stuff | default(True)
|