From 4032d5c1d3d40916de05bf0bfec147d3302b7a0d Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Thu, 26 Sep 2024 20:34:46 +0200 Subject: [PATCH] Refactor ufw.yml to include retries and delay for firewall rules --- ansible/roles/cis_hardening/tasks/ufw.yml | 16 ++++++++++++++++ ansible/roles/microk8s/tasks/microk8s/ufw.yml | 10 ++++++++++ 2 files changed, 26 insertions(+) diff --git a/ansible/roles/cis_hardening/tasks/ufw.yml b/ansible/roles/cis_hardening/tasks/ufw.yml index b807b9b..5135d38 100644 --- a/ansible/roles/cis_hardening/tasks/ufw.yml +++ b/ansible/roles/cis_hardening/tasks/ufw.yml @@ -93,6 +93,8 @@ policy: deny log: true comment: ansible managed + retries: 5 + delay: 10 tags: - ufw - CIS-UBUNTU2004-3.5.1.7 @@ -108,6 +110,8 @@ log: true logging: low comment: ansible managed + retries: 5 + delay: 10 tags: - ufw - CIS-UBUNTU2004-3.5.1.7 @@ -137,6 +141,8 @@ comment: ansible managed with_items: - "{{ ssh_allowed_networks }}" + retries: 5 + delay: 10 tags: - ufw - M1037 @@ -151,6 +157,8 @@ comment: ansible managed with_items: - "{{ fw_allowed_ports }}" + retries: 5 + delay: 10 tags: - ufw - M1037 @@ -164,6 +172,8 @@ comment: ansible managed with_items: - "{{ ufw_outgoing_traffic }}" + retries: 5 + delay: 10 tags: - ufw - CIS-UBUNTU2004-3.5.1.5 @@ -182,6 +192,8 @@ - ufw - CIS-UBUNTU2004-3.5.1.4 - M1037 + retries: 5 + delay: 10 when: fw_loopback_traffic_deny - name: Allow loopback traffic in @@ -191,6 +203,8 @@ interface: lo direction: in comment: ansible managed + retries: 5 + delay: 10 tags: - ufw - CIS-UBUNTU2004-3.5.1.4 @@ -203,6 +217,8 @@ interface: lo direction: out comment: ansible managed + retries: 5 + delay: 10 tags: - ufw - CIS-UBUNTU2004-3.5.1.4 diff --git a/ansible/roles/microk8s/tasks/microk8s/ufw.yml b/ansible/roles/microk8s/tasks/microk8s/ufw.yml index 7b23e62..b7c7527 100644 --- a/ansible/roles/microk8s/tasks/microk8s/ufw.yml +++ b/ansible/roles/microk8s/tasks/microk8s/ufw.yml @@ -7,6 +7,8 @@ comment: ansible managed with_items: - "{{ k8s_net_devices }}" + retries: 5 + delay: 10 - name: Allow out required devices become: true @@ -17,6 +19,8 @@ comment: ansible managed with_items: - "{{ k8s_net_devices }}" + retries: 5 + delay: 10 - name: Allow incoming specific ports become: true @@ -28,6 +32,8 @@ comment: ansible managed with_items: - "{{ k8s_incoming_traffic }}" + retries: 5 + delay: 10 - name: Allow outgoing specified ports become: true @@ -38,6 +44,8 @@ comment: ansible managed with_items: - "{{ k8s_outgoing_traffic }}" + retries: 5 + delay: 10 - name: Allow hosts to access the API become: true @@ -49,3 +57,5 @@ comment: ansible managed with_items: - "{{ k8s_allowed_hosts }}" + retries: 5 + delay: 10