Update harbor playbook, add auto retry when docker fails, update k8s iptables rule

ansible/main/tasks/harbor.yaml

@@ -22,12 +22,21 @@
     src: home/user/harbor/harbor.yml.j2
     dest: /home/{{ user }}/harbor/harbor.yml
 
-- name: Setup harbor (You might need to restart the docker service manually!)
-  become: yes
+- name: Setup harbor
   shell: "/home/{{ user }}/harbor/install.sh"
+  register: install_command
+
+- name: Restart docker daemon on harbor setup failure
+  systemd:
+    name: docker
+    state: restarted
+  when: install_command.rc != 0
+
+- name: Setup harbor again (Retry after docker daemon restart)
+  shell: "/home/{{ user }}/harbor/install.sh"
+  when: install_command.rc != 0
 
 - name: Add service to start harbor on startup
-  become: yes
   template:
     src: etc/systemd/system/harbor-docker-compose.service
     dest: /etc/systemd/system/harbor-docker-compose.service
@@ -37,13 +46,11 @@
   register: service_conf
 
 - name: System daemon-reload on service file change
-  become: yes
   systemd:
     daemon-reload: yes
   when: service_conf.changed
   
 - name: Ensure harbor service is enabled
-  become: yes
   systemd:
     name: harbor-docker-compose.service
     enabled: yes

ansible/main/templates/etc/iptables/rules.v4.j2

@@ -14,11 +14,11 @@
 -A INPUT -i lo -j ACCEPT
 -A INPUT -p icmp -j ACCEPT
 
--A INPUT -p tcp -m tcp --dport {{ base_ssh.port }} --src 152.66.0.0/8,192.168.0.0/16,10.0.0.0/8 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport {{ base_ssh.port }} --src 152.66.0.0/8,10.0.0.0/8 -j ACCEPT
 -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
 -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
 # Accept from the Kubernetes cluster
--A INPUT -p tcp -m tcp --dport 9100 --src 192.168.101.0/24 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 9100 --src 10.44.0.0/16 -j ACCEPT
 
 -A INPUT -j DROP
 

ansible/main/vars/harbor.yaml

@@ -42,7 +42,7 @@ iptables_rules_v6_file: etc/iptables/rules.v6.j2
 
 user: harbor
 harbor_hostname: harbor.sch.bme.hu
-acme_email: laszlo.rafael@kszk.bme.hu
+acme_email: k8sadmin@sch.bme.hu
 sites: 
   - name: harbor.sch.bme.hu
     proxy_to: http://localhost:8080