diff --git a/ansible/main/tasks/harbor.yaml b/ansible/main/tasks/harbor.yaml index 70a294ad7e72ed13799572b2e5df0c4d22ec40a8..a33aaaa5e718efe2a38913c9b7445a235dc3d31a 100644 --- a/ansible/main/tasks/harbor.yaml +++ b/ansible/main/tasks/harbor.yaml @@ -22,12 +22,21 @@ src: home/user/harbor/harbor.yml.j2 dest: /home/{{ user }}/harbor/harbor.yml -- name: Setup harbor (You might need to restart the docker service manually!) - become: yes +- name: Setup harbor shell: "/home/{{ user }}/harbor/install.sh" + register: install_command + +- name: Restart docker daemon on harbor setup failure + systemd: + name: docker + state: restarted + when: install_command.rc != 0 + +- name: Setup harbor again (Retry after docker daemon restart) + shell: "/home/{{ user }}/harbor/install.sh" + when: install_command.rc != 0 - name: Add service to start harbor on startup - become: yes template: src: etc/systemd/system/harbor-docker-compose.service dest: /etc/systemd/system/harbor-docker-compose.service @@ -37,13 +46,11 @@ register: service_conf - name: System daemon-reload on service file change - become: yes systemd: daemon-reload: yes when: service_conf.changed - name: Ensure harbor service is enabled - become: yes systemd: name: harbor-docker-compose.service enabled: yes diff --git a/ansible/main/templates/etc/iptables/rules.v4.j2 b/ansible/main/templates/etc/iptables/rules.v4.j2 index afa1ba108aaa3b4cbf266f5301765c15b3df1c6f..579740ca39825d1a210d7359b79d578ddae869e6 100644 --- a/ansible/main/templates/etc/iptables/rules.v4.j2 +++ b/ansible/main/templates/etc/iptables/rules.v4.j2 @@ -14,11 +14,11 @@ -A INPUT -i lo -j ACCEPT -A INPUT -p icmp -j ACCEPT --A INPUT -p tcp -m tcp --dport {{ base_ssh.port }} --src 152.66.0.0/8,192.168.0.0/16,10.0.0.0/8 -j ACCEPT +-A INPUT -p tcp -m tcp --dport {{ base_ssh.port }} --src 152.66.0.0/8,10.0.0.0/8 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT # Accept from the Kubernetes cluster --A INPUT -p tcp -m tcp --dport 9100 --src 192.168.101.0/24 -j ACCEPT +-A INPUT -p tcp -m tcp --dport 9100 --src 10.44.0.0/16 -j ACCEPT -A INPUT -j DROP diff --git a/ansible/main/vars/harbor.yaml b/ansible/main/vars/harbor.yaml index cd1b8910420fe6e406fb49029fb018c2ea19c3bd..8cc7723469038baecf032a67a1a7eb4cc4a850ad 100644 --- a/ansible/main/vars/harbor.yaml +++ b/ansible/main/vars/harbor.yaml @@ -42,7 +42,7 @@ iptables_rules_v6_file: etc/iptables/rules.v6.j2 user: harbor harbor_hostname: harbor.sch.bme.hu -acme_email: laszlo.rafael@kszk.bme.hu +acme_email: k8sadmin@sch.bme.hu sites: - name: harbor.sch.bme.hu proxy_to: http://localhost:8080