Skip to content

Commit 71c6f23

Browse files
Alex-WelshAlex-Welsh
committed
Add firewalld watchdog playbook
1 parent 9cdb20c commit 71c6f23

File tree

3 files changed

+152
-6
lines changed

3 files changed

+152
-6
lines changed

‎doc/source/configuration/firewall.rst

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -348,14 +348,22 @@ hosts:
348348
349349
kayobe overcloud host command run --command "echo 'stack:super-secret-password' | sudo chpasswd" --show-output
350350
351-
Alternatively, create a cron job to stop the firewall after some time. If the
352-
firewall rules block connectivity, you will still be able to get in after the
353-
job triggers. If the host is still accessible, remove the job. The following
354-
cron job will stop the firewall service every 10 minutes.
351+
The ``firewalld-watchdog.yml`` playbook can be used to set up a timer that
352+
disables the firewalld service after a period of time (default 600s). It should
353+
be used as follows:
355354

356-
.. code-block::
355+
.. code-block:: bash
356+
357+
# Enable the watchdog BEFORE applying the firewall configuration
358+
kayobe playbook run etc/kayobe/ansible/firewalld-watchdog.yml -l <hosts>
359+
360+
# Disable the watchdog after applying the firewall configuration
361+
kayobe playbook run etc/kayobe/ansible/firewalld-watchdog.yml -l <hosts> -e firewalld_watchdog_state=absent
357362
358-
*/10 * * * * sudo systemctl stop firewalld
363+
If the firewall rules block connectivity, the second playbook run (disabling
364+
the watchdog) will fail. You will still be able to get in after the watchdog
365+
triggers. Remember to disable the watchdog when you are finished, otherwise the
366+
firewall will be disabled!
359367

360368
Changes should be applied to controllers one at a time to ensure connectivity
361369
is not lost.

‎etc/kayobe/ansible/firewall-watchdog.yml

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
# This playbook can be applied in advance of rolling out a firewall
3+
# configuration. It sets up a timer that disables the firewalld service after a
4+
# period of time (default 600s). It should be used as follows:
5+
# 1. Enable firewalld-watchdog
6+
# kayobe playbook run etc/kayobe/ansible/firewalld-watchdog.yml -l <hosts>
7+
# 2. Apply firewall config
8+
# kayobe <group> host configure -l <hosts> -t network,firewall
9+
# 3. Disable watchdog
10+
# kayobe playbook run etc/kayobe/ansible/firewalld-watchdog.yml -l <hosts> -e firewalld_watchdog_state=absent
11+
# If the firewall changes result in being locked out of the system, the
12+
# watchdog will disable the firewall after the timeout.
13+
# Remember to disable the watchdog, otherwise the firewall will be disabled!
14+
15+
- name: Create a systemd timer to stop firewalld
16+
hosts: seed:seed-hypervisor:overcloud:infra-vms
17+
tags:
18+
- firewalld-watchdog
19+
vars:
20+
# Watchdog state: present or absent.
21+
firewalld_watchdog_state: present
22+
# Watchdog timeout in seconds.
23+
firewalld_watchdog_timeout_s: 600
24+
become: true
25+
tasks:
26+
- when: firewalld_watchdog_state == 'present'
27+
block:
28+
- name: Create firewalld-watchdog service unit file
29+
ansible.builtin.copy:
30+
dest: /etc/systemd/system/firewalld-watchdog.service
31+
content: |
32+
[Unit]
33+
Description=Firewalld watchdog service
34+
35+
[Service]
36+
Type=oneshot
37+
ExecStart=/usr/bin/systemctl stop firewalld
38+
register: service_result
39+
40+
- name: Create firewalld-watchdog timer unit file
41+
ansible.builtin.copy:
42+
dest: /etc/systemd/system/firewalld-watchdog.timer
43+
content: |
44+
[Unit]
45+
Description=Firewalld watchdog timer
46+
47+
[Timer]
48+
OnActiveSec={{ firewalld_watchdog_timeout_s }}
49+
Unit=firewalld-watchdog.service
50+
51+
[Install]
52+
WantedBy=timers.target
53+
register: timer_result
54+
55+
- name: Enable or disable firewalld-watchdog timer
56+
ansible.builtin.systemd_service:
57+
name: firewalld-watchdog.timer
58+
daemon_reload: "{{ service_result is changed or timer_result is changed }}"
59+
enabled: false
60+
state: "{{ 'started' if firewalld_watchdog_state == 'present' else 'stopped' }}"
61+
62+
- name: Remove firewalld-watchdog unit files
63+
ansible.builtin.file:
64+
path: "/etc/systemd/system/{{ item }}"
65+
state: absent
66+
loop:
67+
- firewalld-watchdog.service
68+
- firewalld-watchdog.timer
69+
when: firewalld_watchdog_state == 'absent'

‎etc/kayobe/ansible/firewalld-watchdog.yml

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
# This playbook can be applied in advance of rolling out a firewall
3+
# configuration. It sets up a timer that disables the firewalld service after a
4+
# period of time (default 600s). It should be used as follows:
5+
# 1. Enable firewalld-watchdog
6+
# kayobe playbook run etc/kayobe/ansible/firewalld-watchdog.yml -l <hosts>
7+
# 2. Apply firewall config
8+
# kayobe <group> host configure -l <hosts> -t network,firewall
9+
# 3. Disable watchdog
10+
# kayobe playbook run etc/kayobe/ansible/firewalld-watchdog.yml -l <hosts> -e firewalld_watchdog_state=absent
11+
# If the firewall changes result in being locked out of the system, the
12+
# watchdog will disable the firewall after the timeout.
13+
# Remember to disable the watchdog, otherwise the firewall will be disabled!
14+
15+
- name: Create a systemd timer to stop firewalld
16+
hosts: seed:seed-hypervisor:overcloud:infra-vms
17+
tags:
18+
- firewalld-watchdog
19+
vars:
20+
# Watchdog state: present or absent.
21+
firewalld_watchdog_state: present
22+
# Watchdog timeout in seconds.
23+
firewalld_watchdog_timeout_s: 600
24+
become: true
25+
tasks:
26+
- when: firewalld_watchdog_state == 'present'
27+
block:
28+
- name: Create firewalld-watchdog service unit file
29+
ansible.builtin.copy:
30+
dest: /etc/systemd/system/firewalld-watchdog.service
31+
content: |
32+
[Unit]
33+
Description=Firewalld watchdog service
34+
35+
[Service]
36+
Type=oneshot
37+
ExecStart=/usr/bin/systemctl stop firewalld
38+
register: service_result
39+
40+
- name: Create firewalld-watchdog timer unit file
41+
ansible.builtin.copy:
42+
dest: /etc/systemd/system/firewalld-watchdog.timer
43+
content: |
44+
[Unit]
45+
Description=Firewalld watchdog timer
46+
47+
[Timer]
48+
OnActiveSec={{ firewalld_watchdog_timeout_s }}
49+
Unit=firewalld-watchdog.service
50+
51+
[Install]
52+
WantedBy=timers.target
53+
register: timer_result
54+
55+
- name: Enable or disable firewalld-watchdog timer
56+
ansible.builtin.systemd_service:
57+
name: firewalld-watchdog.timer
58+
daemon_reload: "{{ service_result is changed or timer_result is changed }}"
59+
enabled: false
60+
state: "{{ 'started' if firewalld_watchdog_state == 'present' else 'stopped' }}"
61+
62+
- name: Remove firewalld-watchdog unit files
63+
ansible.builtin.file:
64+
path: "/etc/systemd/system/{{ item }}"
65+
state: absent
66+
loop:
67+
- firewalld-watchdog.service
68+
- firewalld-watchdog.timer
69+
when: firewalld_watchdog_state == 'absent'

0 commit comments

Comments
 (0)