Configure firewall rules
This change configures explicitly the firewall rules for the node running the Elasticsearch-Kibana plugin. This is needed because otherwise the node becomes unavailable on CentOS after a reboot. Change-Id: I6b123fac74e01c4cc4b16ff6a9f58654b9366fa1
This commit is contained in:
parent
da8c34daec
commit
92e21f9b75
|
@ -0,0 +1,60 @@
|
||||||
|
# Copyright 2015 Mirantis, Inc.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||||
|
# not use this file except in compliance with the License. You may obtain
|
||||||
|
# a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||||
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||||
|
# License for the specific language governing permissions and limitations
|
||||||
|
# under the License.
|
||||||
|
#
|
||||||
|
$elasticsearch_kibana = hiera('elasticsearch_kibana')
|
||||||
|
|
||||||
|
if $elasticsearch_kibana['node_name'] == hiera('user_node_name') {
|
||||||
|
class {'::firewall':}
|
||||||
|
|
||||||
|
firewall { '000 accept all icmp requests':
|
||||||
|
proto => 'icmp',
|
||||||
|
action => 'accept',
|
||||||
|
}
|
||||||
|
|
||||||
|
firewall { '001 accept all to lo interface':
|
||||||
|
proto => 'all',
|
||||||
|
iniface => 'lo',
|
||||||
|
action => 'accept',
|
||||||
|
}
|
||||||
|
|
||||||
|
firewall { '002 accept related established rules':
|
||||||
|
proto => 'all',
|
||||||
|
state => ['RELATED', 'ESTABLISHED'],
|
||||||
|
action => 'accept',
|
||||||
|
}
|
||||||
|
|
||||||
|
firewall {'020 ssh':
|
||||||
|
port => 22,
|
||||||
|
proto => 'tcp',
|
||||||
|
action => 'accept',
|
||||||
|
}
|
||||||
|
|
||||||
|
firewall { '100 elasticsearch':
|
||||||
|
port => 9200,
|
||||||
|
proto => 'tcp',
|
||||||
|
action => 'accept',
|
||||||
|
}
|
||||||
|
|
||||||
|
firewall { '101 kibana':
|
||||||
|
port => 80,
|
||||||
|
proto => 'tcp',
|
||||||
|
action => 'accept',
|
||||||
|
}
|
||||||
|
|
||||||
|
firewall { '999 drop all other requests':
|
||||||
|
proto => 'all',
|
||||||
|
chain => 'INPUT',
|
||||||
|
action => 'drop',
|
||||||
|
}
|
||||||
|
}
|
|
@ -6,6 +6,14 @@
|
||||||
puppet_modules: /etc/puppet/modules
|
puppet_modules: /etc/puppet/modules
|
||||||
timeout: 720
|
timeout: 720
|
||||||
|
|
||||||
|
- role: ['base-os']
|
||||||
|
stage: post_deployment
|
||||||
|
type: puppet
|
||||||
|
parameters:
|
||||||
|
puppet_manifest: puppet/manifests/firewall.pp
|
||||||
|
puppet_modules: /etc/puppet/modules
|
||||||
|
timeout: 300
|
||||||
|
|
||||||
- role: ['base-os']
|
- role: ['base-os']
|
||||||
stage: post_deployment
|
stage: post_deployment
|
||||||
type: puppet
|
type: puppet
|
||||||
|
|
Loading…
Reference in New Issue