Make the net ansible section never run and add appropriate warnings

This commit is contained in:
Alex 2020-05-21 14:00:47 +02:00
parent 5d3fdfbc16
commit 78f452587a
3 changed files with 25 additions and 7 deletions

View file

@ -1,24 +1,31 @@
---
- hosts: cluster_nodes
#serial: 1
roles:
- role: common
tags: base
- role: users
tags: account
# UNSAFE
# - role: network
# tags: net
# UNSAFE!! This section is disabled by default, to run it the flags -t net should be added
# to the ansible playbook command line.
# Reason: when rules.{v4,v6} are changed, the whole iptables configuration is reloaded.
# This creates issues with Docker, which injects its own configuration in iptables when it starts.
# In practice, most (all?) containers will break if rules.{v4,v6} are changed,
# and docker will have to be restared.
- hosts: cluster_nodes
roles:
- role: network
tags: [ net, never ]
- hosts: cluster_nodes
serial: 1
roles:
- role: consul
tags: kv
- role: nomad
tags: orchestrator
# UNSAFE
# UNSAFE!! This section configures glusterfs. Once done, don't run it ever again as it may break stuff.
# - role: storage
# tags: sto

View file

@ -1,3 +1,9 @@
# WARNING!! When rules.{v4,v6} are changed, the whole iptables configuration is reloaded.
# This creates issues with Docker, which injects its own configuration in iptables when it starts.
# In practice, most (all?) containers will break if rules.{v4,v6} are changed,
# and docker will have to be restared.
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]

View file

@ -1,3 +1,8 @@
# WARNING!! When rules.{v4,v6} are changed, the whole iptables configuration is reloaded.
# This creates issues with Docker, which injects its own configuration in iptables when it starts.
# In practice, most (all?) containers will break if rules.{v4,v6} are changed,
# and docker will have to be restared.
*filter
:INPUT DROP [0:0]