62 lines
1.6 KiB
YAML
62 lines
1.6 KiB
YAML
---
|
|
- name: Allow SSH from admin subnet
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ k8s_firewall_ssh_port }}"
|
|
proto: tcp
|
|
from_ip: "{{ k8s_firewall_admin_subnet }}"
|
|
become: yes
|
|
|
|
- name: Allow common Kubernetes ports from admin subnet
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
from_ip: "{{ k8s_firewall_admin_subnet }}"
|
|
become: yes
|
|
loop: "{{ k8s_firewall_common_ports }}"
|
|
|
|
- name: Allow etcd and control plane ports on control-plane nodes
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
from_ip: "{{ k8s_firewall_admin_subnet }}"
|
|
become: yes
|
|
loop: "{{ k8s_firewall_master_ports }}"
|
|
when: inventory_hostname in groups['master']
|
|
|
|
- name: Allow kube-proxy and NodePort ports on worker nodes
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
from_ip: "{{ k8s_firewall_admin_subnet }}"
|
|
become: yes
|
|
loop: "{{ k8s_firewall_worker_ports }}"
|
|
when: inventory_hostname in groups['worker']
|
|
|
|
- name: Allow Cilium VXLAN and health check UDP ports from admin subnet
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: udp
|
|
from_ip: "{{ k8s_firewall_admin_subnet }}"
|
|
become: yes
|
|
loop: "{{ k8s_firewall_cilium_udp_ports }}"
|
|
|
|
- name: Allow Cilium health check TCP ports from admin subnet
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
from_ip: "{{ k8s_firewall_admin_subnet }}"
|
|
become: yes
|
|
loop: "{{ k8s_firewall_cilium_tcp_ports }}"
|
|
|
|
- name: Enable ufw and deny incoming by default
|
|
community.general.ufw:
|
|
state: enabled
|
|
policy: deny
|
|
direction: incoming
|
|
become: yes |