Skip to content

Commit 701eb96

Browse files
marcelmamulamarcelmamula
authored
Merge pull request sap-linuxlab#1157 from marcelmamula/hsr_fw
sap_ha_install_hana_hsr: Add firewall steps
2 parents a799369 + b2d7614 commit 701eb96

7 files changed

Lines changed: 247 additions & 0 deletions

File tree

‎roles/sap_ha_install_hana_hsr/README.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,4 +201,42 @@ If not specified, the default HANA backup location is used.</br>
201201
Required sub-directories (`SYSTEMDB` and `DB_<SID>`) will be created automatically within this path</br>
202202
The backup created will have a file prefix of `<SID>_PRE_HSR_<TIMESTAMP>`.</br>
203203

204+
### sap_ha_install_hana_hsr_configure_firewall
205+
- _Type:_ `bool`
206+
- _Default:_ `False`
207+
208+
Set this variable to `true` to configure the required firewall ports for SAP HANA System Replication.</br>
209+
What this configuration includes:<br>
210+
211+
- Installation of the `firewalld` package and starting the service.
212+
- If `sap_ha_install_hana_hsr_firewall_ports` is undefined: A `firewalld` service definition is created with recommended ports.<br>
213+
Note: `NN` refers to the SAP Instance Number defined in `sap_ha_install_hana_hsr_instance_number`.<br>
214+
215+
| Ports | Protocol | Reason |
216+
| --- | --- | --- |
217+
| 30105 | TCP | Fixed port for SAP HANA System Replication (SR) and internal endpoint communication |
218+
| 30107 | TCP | Fixed port for SAP HANA System Replication (SR) and internal endpoint communication |
219+
| 30140 | TCP | Fixed port for SAP HANA System Replication (SR) and internal endpoint communication |
220+
| 4NN00-4NN99 | TCP | Range for SAP HANA System Replication (SR) and internal endpoint communication |
221+
222+
- If `sap_ha_install_hana_hsr_firewall_ports` is defined: The specified ports are opened directly and no service definition is created.<br>
223+
224+
**Important:** This does not include configuration of SAP HANA services or ports, because they are managed separately in the `sap_hana_install` role.<br>
225+
Managing configured Firewall:<br>
226+
227+
- Setting this variable to `false` does not remove any existing firewall configuration.<br>
228+
- For ongoing firewall management, consider using the `community.sap_operations.sap_firewall` role or the `firewall` Linux System Role.</br>
229+
230+
### sap_ha_install_hana_hsr_firewall_ports
231+
- _Type:_ `list`
232+
233+
Optional list of firewall ports.<br>
234+
The specified ports are opened directly and no service definition is created.<br>
235+
236+
### sap_ha_install_hana_hsr_firewall_zone
237+
- _Type:_ `string`
238+
239+
Optional name of firewall zone where service or ports will be configured.<br>
240+
Default firewall zone, usually `public`, is used if this variable is undefined.
241+
204242
<!-- END Role Variables -->

‎roles/sap_ha_install_hana_hsr/defaults/main.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,35 @@ sap_ha_install_hana_hsr_update_etchosts: true
7272

7373
# Set to true to create a safety backup of the HANA database before configuring HSR (Boolean).
7474
sap_ha_install_hana_hsr_create_backup: true
75+
76+
# Set this variable to `true` to configure the required firewall ports for SAP HANA System Replication.
77+
# What this configuration includes:
78+
# - Installation of the `firewalld` package and starting the service.
79+
# - If `sap_ha_install_hana_hsr_firewall_ports` is undefined: A `firewalld` service definition is created with recommended ports.
80+
# Note: `NN` refers to the SAP Instance Number defined in `sap_ha_install_hana_hsr_instance_number`.
81+
# | Ports | Protocol | Reason |
82+
# | --- | --- | --- |
83+
# | 30105 | TCP | Fixed port for SAP HANA System Replication (SR) and internal endpoint communication |
84+
# | 30107 | TCP | Fixed port for SAP HANA System Replication (SR) and internal endpoint communication |
85+
# | 30140 | TCP | Fixed port for SAP HANA System Replication (SR) and internal endpoint communication |
86+
# | 4NN00-4NN99 | TCP | Range for SAP HANA System Replication (SR) and internal endpoint communication |
87+
# - If `sap_ha_install_hana_hsr_firewall_ports` is defined: The specified ports are opened directly and no service definition is created.
88+
# Important: This does not include configuration of SAP HANA services or ports, because they are managed separately in the `sap_hana_install` role.
89+
# Managing configured Firewall:
90+
# - Setting this variable to `false` does not remove any existing firewall configuration.
91+
# - For ongoing firewall management, consider using the `community.sap_operations.sap_firewall` role or the `firewall` Linux System Role.
92+
sap_ha_install_hana_hsr_configure_firewall: false
93+
94+
# Optional list of firewall ports.
95+
# The specified ports are opened directly and no service definition is created.
96+
# Commented out example: Ports that are defined in service file.
97+
# sap_ha_install_hana_hsr_firewall_ports:
98+
# # Fixed ports for SAP HANA System Replication (SR) and internal endpoint communication.
99+
# - "30105/tcp"
100+
# - "30107/tcp"
101+
# - "30140/tcp"
102+
# - "4{{ sap_ha_install_hana_hsr_instance_number }}00-4{{ sap_ha_install_hana_hsr_instance_number }}99/tcp"
103+
104+
# Optional name of firewall zone where service or ports will be configured.
105+
# Default firewall zone, usually `public`, is used if this variable is undefined.
106+
# sap_ha_install_hana_hsr_firewall_zone: ''

‎roles/sap_ha_install_hana_hsr/tasks/main.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,36 @@
11
# SPDX-License-Identifier: Apache-2.0
22
---
33

4+
# Example of files loading order:
5+
# 1. Suse.yml / RedHat.yml - Specific to OS family.
6+
# 2. SLES_15.yml / RedHat_9.yml - Specific to distribution (SLES, SLES_SAP or RedHat) and major release.
7+
# 3. SLES_15.6.yml / RedHat_9.2 - Specific to distribution (SLES, SLES_SAP or RedHat) and minor release.
8+
# 4. SLES_SAP_15.yml - Specific to distribution SLES_SAP and major release.
9+
# 5. SLES_SAP_15.6.yml - Specific to distribution SLES_SAP and minor release.
10+
- name: SAP HSR - Include OS specific vars
11+
ansible.builtin.include_vars: "{{ __vars_file }}"
12+
loop: "{{ __var_files }}"
13+
vars:
14+
__vars_file: "{{ role_path }}/vars/{{ item }}"
15+
__distribution_major: "{{ ansible_facts['distribution'] ~ '_' ~ ansible_facts['distribution_major_version'] }}"
16+
__distribution_minor: "{{ ansible_facts['distribution'] ~ '_' ~ ansible_facts['distribution_version'] }}"
17+
# Enables loading of shared vars between SLES and SLES_SAP
18+
__distribution_major_split: "{{ ansible_facts['distribution'].split('_')[0] ~ '_' ~ ansible_facts['distribution_major_version'] }}"
19+
__distribution_minor_split: "{{ ansible_facts['distribution'].split('_')[0] ~ '_' ~ ansible_facts['distribution_version'] }}"
20+
__var_files: >-
21+
{{
22+
[
23+
ansible_facts['os_family'] ~ '.yml',
24+
(ansible_facts['distribution'] ~ '.yml') if ansible_facts['distribution'] != ansible_facts['os_family'] else None,
25+
(__distribution_major_split ~ '.yml') if __distribution_major_split != __distribution_major else None,
26+
(__distribution_minor_split ~ '.yml') if __distribution_minor_split != __distribution_minor else None,
27+
__distribution_major ~ '.yml',
28+
__distribution_minor ~ '.yml'
29+
] | select('defined') | select('string') | list
30+
}}
31+
when: __vars_file is file
32+
tags: always
33+
434
- name: SAP HSR - Prepare and validate variables
535
ansible.builtin.include_tasks:
636
file: pre_tasks/prepare_variables.yml
@@ -93,6 +123,11 @@
93123
- sap_ha_install_hana_hsr_create_backup | d(true)| bool
94124
tags: hsr_backup
95125

126+
- name: SAP HSR - Configure Firewall
127+
ansible.builtin.include_tasks:
128+
file: pre_tasks/firewall.yml
129+
when: sap_ha_install_hana_hsr_configure_firewall
130+
96131

97132
- name: SAP HSR - Ensure HSR is configured
98133
ansible.builtin.include_tasks:

‎roles/sap_ha_install_hana_hsr/tasks/pre_tasks/firewall.yml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
---
3+
4+
- name: SAP HSR - Firewall - Install packages
5+
ansible.builtin.package:
6+
name: "{{ __sap_ha_install_hana_hsr_firewall_packages + __sap_ha_install_hana_hsr_firewall_extra_packages }}"
7+
state: present
8+
9+
- name: SAP HSR - Firewall - Start and enable firewalld service
10+
ansible.builtin.systemd_service:
11+
name: firewalld
12+
state: started
13+
enabled: true
14+
masked: false
15+
16+
17+
# Validate firewall zone if defined
18+
- name: Block for validation of firewall zone
19+
when: sap_ha_install_hana_hsr_firewall_zone is defined
20+
block:
21+
- name: SAP HSR - Firewall - Get list of configured zones from firewalld
22+
ansible.builtin.command:
23+
cmd: firewall-cmd --get-zones
24+
register: __sap_ha_install_hana_hsr_register_firewall_zones
25+
changed_when: false
26+
27+
- name: SAP HSR - Firewall - Assert that the firewall zone is available
28+
ansible.builtin.assert:
29+
that:
30+
- sap_ha_install_hana_hsr_firewall_zone in __sap_ha_install_hana_hsr_register_firewall_zones.stdout.split()
31+
success_msg: |
32+
PASS: The zone '{{ sap_ha_install_hana_hsr_firewall_zone }}' is present in firewalld.
33+
fail_msg: |
34+
FAIL: The zone '{{ sap_ha_install_hana_hsr_firewall_zone }}' is not preset in firewalld.
35+
Available zones: {{ __sap_ha_install_hana_hsr_register_firewall_zones.stdout }}
36+
quiet: true
37+
38+
39+
- name: Block for service
40+
when: sap_ha_install_hana_hsr_firewall_ports | d([]) | length == 0
41+
block:
42+
- name: SAP HSR - Firewall - Generate service file from template
43+
ansible.builtin.template:
44+
src: firewall-hana-replication.j2
45+
dest: "/etc/firewalld/services/{{ __sap_ha_install_hana_hsr_firewall_service_name }}.xml"
46+
owner: 'root'
47+
group: 'root'
48+
mode: '0640'
49+
50+
- name: SAP HSR - Firewall - Reload firewalld after creating service file
51+
ansible.builtin.command:
52+
cmd: firewall-cmd --reload
53+
changed_when: true
54+
55+
- name: SAP HSR - Firewall - Configure service in firewall
56+
ansible.builtin.command:
57+
cmd: >-
58+
firewall-cmd
59+
{% if sap_ha_install_hana_hsr_firewall_zone is defined %}
60+
--zone={{ sap_ha_install_hana_hsr_firewall_zone }}
61+
{% endif %}
62+
--permanent
63+
--add-service={{ __sap_ha_install_hana_hsr_firewall_service_name }}
64+
register: __sap_ha_install_hana_hsr_register_firewall_add_service
65+
changed_when: true
66+
67+
68+
- name: Block for ports
69+
when: sap_ha_install_hana_hsr_firewall_ports | d([]) | length > 0
70+
block:
71+
- name: SAP HSR - Firewall - Open Ports without service file
72+
ansible.builtin.command:
73+
cmd: >-
74+
firewall-cmd
75+
{% if sap_ha_install_hana_hsr_firewall_zone is defined %}
76+
--zone={{ sap_ha_install_hana_hsr_firewall_zone }}
77+
{% endif %}
78+
--permanent
79+
{% for port_item in sap_ha_install_hana_hsr_firewall_ports %}
80+
--add-port={{ port_item }}
81+
{% endfor %}
82+
register: __sap_ha_install_hana_hsr_register_firewall_add_port
83+
changed_when: true
84+
85+
86+
- name: SAP HSR - Firewall - Reload firewalld after applying changes
87+
ansible.builtin.command:
88+
cmd: firewall-cmd --reload
89+
changed_when: true
90+
91+
- name: SAP HSR - Firewall - Get current firewall configuration of the default zone
92+
ansible.builtin.command:
93+
cmd: firewall-cmd --list-all
94+
changed_when: false
95+
register: __sap_ha_install_hana_hsr_register_current_firewall_configuration
96+
97+
98+
- name: SAP HSR - Firewall - Show details of configured firewall
99+
ansible.builtin.debug:
100+
msg: |
101+
Firewall was configured for SAP HANA System Replication and reloaded.
102+
Output of command 'firewall-cmd --list-all':
103+
{{ __sap_ha_install_hana_hsr_register_current_firewall_configuration.stdout }}
104+
when: __sap_ha_install_hana_hsr_register_current_firewall_configuration.stdout is defined

‎roles/sap_ha_install_hana_hsr/templates/firewall-hana-replication.j2‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<service>
3+
<short>SAP HANA System Replication</short>
4+
<description>Ports required for the SAP HANA System Replication. Maintained by Ansible Role sap_install.sap_ha_install_hana_hsr.</description>
5+
6+
{# Fixed ports for SAP HANA System Replication (SR) and internal endpoint communication. -#}
7+
<port protocol="tcp" port="30105"/>
8+
<port protocol="tcp" port="30107"/>
9+
<port protocol="tcp" port="30140"/>
10+
<port protocol="tcp" port="4{{ sap_ha_install_hana_hsr_instance_number }}00-4{{ sap_ha_install_hana_hsr_instance_number }}99"/>
11+
12+
</service>

‎roles/sap_ha_install_hana_hsr/vars/SLES_15.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
---
3+
# Variables specific to following versions:
4+
# - SUSE Linux Enterprise Server 15
5+
6+
# NOTE: SLES 16 contains dependency between firewalld and python313-firewall package.
7+
8+
__sap_ha_install_hana_hsr_firewall_extra_packages:
9+
"{{ __sap_ha_install_hana_hsr_firewall_extra_packages_3
10+
if ansible_facts['distribution_version'].split('.')[1] | int < 6
11+
else __sap_ha_install_hana_hsr_firewall_extra_packages_311 }}"
12+
13+
# The lists of bindings for specific python version
14+
__sap_ha_install_hana_hsr_firewall_extra_packages_3:
15+
- "python3-firewall"
16+
17+
__sap_ha_install_hana_hsr_firewall_extra_packages_311:
18+
- "python311-firewall"

‎roles/sap_ha_install_hana_hsr/vars/main.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,11 @@ __sap_ha_install_hana_hsr_backup_data_path:
1818
# The flags used for separation of tasks between hosts
1919
__sap_ha_install_hana_hsr_fact_is_primary: false
2020
__sap_ha_install_hana_hsr_fact_is_secondary: false
21+
22+
# List of firewall packages
23+
__sap_ha_install_hana_hsr_firewall_packages:
24+
- firewalld
25+
__sap_ha_install_hana_hsr_firewall_extra_packages: []
26+
27+
# Predefined firewall service name.
28+
__sap_ha_install_hana_hsr_firewall_service_name: "sap-hana-replication"

0 commit comments

Comments
 (0)