From 05e189a039dada5edc4f9afb700b594c4dea4c9b Mon Sep 17 00:00:00 2001
From: Russell Teague <rteague@redhat.com>
Date: Mon, 28 Nov 2016 14:43:47 -0500
Subject: Enable firewalld by default

---
 roles/os_firewall/README.md         | 7 +++++--
 roles/os_firewall/defaults/main.yml | 8 +++-----
 roles/os_firewall/tasks/main.yml    | 6 ++++++
 3 files changed, 14 insertions(+), 7 deletions(-)

(limited to 'roles/os_firewall')

diff --git a/roles/os_firewall/README.md b/roles/os_firewall/README.md
index c13c5dfc9..43db3cc74 100644
--- a/roles/os_firewall/README.md
+++ b/roles/os_firewall/README.md
@@ -4,6 +4,9 @@ OS Firewall
 OS Firewall manages firewalld and iptables firewall settings for a minimal use
 case (Adding/Removing rules based on protocol and port number).
 
+Note: firewalld is not supported on Atomic Host
+https://bugzilla.redhat.com/show_bug.cgi?id=1403331
+
 Requirements
 ------------
 
@@ -14,7 +17,7 @@ Role Variables
 
 | Name                      | Default |                                        |
 |---------------------------|---------|----------------------------------------|
-| os_firewall_use_firewalld | False   | If false, use iptables                 |
+| os_firewall_use_firewalld | True    | If false, use iptables                 |
 | os_firewall_allow         | []      | List of service,port mappings to allow |
 | os_firewall_deny          | []      | List of service, port mappings to deny |
 
@@ -31,6 +34,7 @@ Use iptables and open tcp ports 80 and 443:
 ---
 - hosts: servers
   vars:
+    os_firewall_use_firewalld: false
     os_firewall_allow:
     - service: httpd
       port: 80/tcp
@@ -45,7 +49,6 @@ Use firewalld and open tcp port 443 and close previously open tcp port 80:
 ---
 - hosts: servers
   vars:
-    os_firewall_use_firewalld: true
     os_firewall_allow:
     - service: https
       port: 443/tcp
diff --git a/roles/os_firewall/defaults/main.yml b/roles/os_firewall/defaults/main.yml
index c870a301a..4c544122f 100644
--- a/roles/os_firewall/defaults/main.yml
+++ b/roles/os_firewall/defaults/main.yml
@@ -1,9 +1,7 @@
 ---
 os_firewall_enabled: True
-# TODO: Upstream kubernetes only supports iptables currently
-# TODO: it might be possible to still use firewalld if we wire up the created
-# chains with the public zone (or the zone associated with the correct
-# interfaces)
-os_firewall_use_firewalld: False
+# firewalld is not supported on Atomic Host
+# https://bugzilla.redhat.com/show_bug.cgi?id=1403331
+os_firewall_use_firewalld: "{{ False if openshift.common.is_atomic | bool else True }}"
 os_firewall_allow: []
 os_firewall_deny: []
diff --git a/roles/os_firewall/tasks/main.yml b/roles/os_firewall/tasks/main.yml
index 076e5e311..20efe5b0d 100644
--- a/roles/os_firewall/tasks/main.yml
+++ b/roles/os_firewall/tasks/main.yml
@@ -1,4 +1,10 @@
 ---
+- name: Assert - Do not use firewalld on Atomic Host
+  assert:
+    that: not os_firewall_use_firewalld | bool
+    msg: "Firewalld is not supported on Atomic Host"
+  when: openshift.common.is_atomic | bool
+
 - include: firewall/firewalld.yml
   when: os_firewall_enabled | bool and os_firewall_use_firewalld | bool
 
-- 
cgit v1.2.1