F #274: Add simple firewall port opener role (helper/fw)

playbooks/pre.yml

@@ -65,6 +65,9 @@
     - role: helper/kernel
       tags: [kernel]
 
+    - role: helper/fw
+      tags: [fw]
+
     - role: helper/keys
       tags: [keys]
 

roles/helper/fw/README.md

@@ -0,0 +1,83 @@
+Role: opennebula.deploy.helper.fw
+=================================
+
+A role that opens TCP/UDP ports.
+
+Requirements
+------------
+
+N/A
+
+Role Variables
+--------------
+
+| Name                      | Type   | Default           | Description                          |
+|---------------------------|--------|-------------------|--------------------------------------|
+| `fw_ports`                | `list` | `null` (disabled) | FW configuration to apply.           |
+| `fw_ports[].skip`         | `bool` | `false`           | Decide to skip the rule.             |
+| `fw_ports[].name`         | `str`  |                   | Unique name of the rule.             |
+| `fw_ports[].ports`        | `list` |                   | List of ports to open.               |
+| `fw_ports[].groups.local` | `list` |                   | List of groups to open FW ports on.  |
+| `fw_ports[].groups.peers` | `list` |                   | List of groups to open FW ports for. |
+
+Dependencies
+------------
+
+N/A
+
+Example Playbook
+----------------
+
+    # Enable helper/fw, use default rules only.
+    - hosts: frontend:node
+      vars:
+        fw_ports: []
+      roles:
+        - role: opennebula.deploy.helper.facts
+        - role: opennebula.deploy.helper.fw
+
+    # Enable helper/fw, skip OneXmlRpc rule (please check role defaults).
+    - hosts: frontend:node
+      vars:
+        fw_ports:
+          - name: OneXmlRpc
+            skip: true
+      roles:
+        - role: opennebula.deploy.helper.facts
+        - role: opennebula.deploy.helper.fw
+
+    # Enable helper/fw, open custom UDP port on FEs, but allow datagrams only from HVs.
+    - hosts: frontend:node
+      vars:
+        fw_ports:
+          - name: CustomPort1
+            ports: [1234/udp]
+            groups:
+              local: [frontend]
+              peers: [node]
+      roles:
+        - role: opennebula.deploy.helper.facts
+        - role: opennebula.deploy.helper.fw
+
+    # Enable helper/fw, open custom TCP port range everywhere for everybody.
+    - hosts: frontend:node
+      vars:
+        fw_ports:
+          - name: CustomRange1
+            ports: [1234-4321/tcp] # 1234:4321/tcp is also allowed
+            groups:
+              local: [frontend, node]
+              peers: [] # `[]` means "any" or "0.0.0.0"
+      roles:
+        - role: opennebula.deploy.helper.facts
+        - role: opennebula.deploy.helper.fw
+
+License
+-------
+
+Apache-2.0
+
+Author Information
+------------------
+
+[OpenNebula Systems](https://opennebula.io/)

roles/helper/fw/defaults/main.yml

@@ -0,0 +1,117 @@
+---
+fw_ports: null # disabled, set it at least to [] to enable
+
+fw_default_ports:
+  - name: OpenSSH
+    ports: [22/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}", "{{ node_group | d('node') }}"]
+      peers: []
+
+  - name: OneFlow
+    ports: [2474/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}"]
+      peers: []
+
+  - name: FireEdge
+    ports: [2616/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}"]
+      peers: []
+
+  - name: OneXmlRpc
+    ports: [2633/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}"]
+      peers: []
+
+  - name: Grafana
+    ports: [3000/tcp]
+    groups:
+      local: ["{{ grafana_group | d('grafana') }}"]
+      peers: []
+
+  - name: OneMonitor
+    ports: [4124/tcp, 4124/udp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}"]
+      peers: ["{{ node_group | d('node') }}"]
+
+  - name: OneGate
+    ports: [5030/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}"]
+      peers: ["{{ node_group | d('node') }}"]
+
+  - name: VncPorts
+    ports: [5900-65535/tcp]
+    groups:
+      local: ["{{ node_group | d('node') }}"]
+      peers: ["{{ frontend_group | d('frontend') }}"]
+
+  - name: Prometheus
+    ports: [9090/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}"]
+      peers: []
+
+  - name: Alertmanager
+    ports: [9093/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}"]
+      peers: []
+
+  - name: NodeExporter
+    ports: [9100/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}", "{{ node_group | d('node') }}"]
+      peers: ["{{ frontend_group | d('frontend') }}"]
+
+  - name: DbExporter
+    ports: [9104/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}"]
+      peers: ["{{ frontend_group | d('frontend') }}"]
+
+  - name: OvsExporter
+    ports: [9475/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}", "{{ node_group | d('node') }}"]
+      peers: ["{{ frontend_group | d('frontend') }}"]
+
+  - name: SmartExporter
+    ports: [9633/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}", "{{ node_group | d('node') }}"]
+      peers: ["{{ frontend_group | d('frontend') }}"]
+
+  - name: LvmExporter
+    ports: [9845/tcp]
+    groups:
+      local: ["{{ node_group | d('node') }}"]
+      peers: ["{{ frontend_group | d('frontend') }}"]
+
+  - name: OneExporter
+    ports: [9925/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}"]
+      peers: ["{{ frontend_group | d('frontend') }}"]
+
+  - name: LibvirtExporter
+    ports: [9926/tcp]
+    groups:
+      local: ["{{ node_group | d('node') }}"]
+      peers: ["{{ frontend_group | d('frontend') }}"]
+
+  - name: NoVncProxy
+    ports: [29876/tcp]
+    groups:
+      local: ["{{ frontend_group | d('frontend') }}"]
+      peers: []
+
+  - name: LiveMigrations
+    ports: [49152-49215/tcp]
+    groups:
+      local: ["{{ node_group | d('node') }}"]
+      peers: ["{{ node_group | d('node') }}"]

roles/helper/fw/meta/main.yml

@@ -0,0 +1,3 @@
+---
+collections:
+  - opennebula.deploy