salt.master: add firewalld rules

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>

bin/prepare_minion.py

@@ -15,7 +15,7 @@ mypwd = os.getcwd()
 formulasfile = 'formulas.yaml'
 formulasdir = '/srv/formulas'
 
-configdata = {'file_roots': {'production': ['/srv/salt']}}
+configdata = {'file_roots': {'production': ['/srv/salt']}, 'pillar_merge_lists': True}
 grainsdata = {'roles': roles}
 
 with open(grainsfile, mode='w') as grainsfh:

pillar/global/init.sls

@@ -11,6 +11,14 @@ managed_header_pound: |
 {%- if grains['os'] == 'SUSE' %}
 zypper:
   refreshdb_force: False
+
+firewalld:
+  zones:
+    internal:
+      ports:
+        - comment: node_exporter
+          port: 9200
+          protocol: tcp
 {%- endif %}
 
 mine_functions:

pillar/global/ssh.sls

@@ -30,3 +30,8 @@ sshd_config:
   Subsystem: sftp /usr/lib/ssh/sftp-server
   Banner: /etc/ssh/banner
 
+firewalld:
+  zones:
+    internal:
+      services:
+        - ssh

pillar/role/salt/master.sls

@@ -79,3 +79,13 @@ salt:
     auth.ldap.binddn: ${'secret_salt:master:auth.ldap.binddn'}
     auth.ldap.bindpw: ${'secret_salt:master:auth.ldap.bindpw'}
     auth.ldap.filter: ${'secret_salt:master:auth.ldap.filter'}
+
+firewalld:
+  zones:
+    internal:
+      services:
+        - salt-master
+      ports:
+        - comment: salt-api
+          port: 4550
+          protocol: tcp

salt/common/suse.sls

@@ -1,4 +1,5 @@
 include:
+  - firewalld
   - profile.seccheck
   - profile.zypp
   - profile.node_exporter