Extend firewall management for agent role

changelogs/fragments/agent.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - Agent role - Add support to open firewall for a list of IPs.

roles/agent/README.md

@@ -11,6 +11,9 @@ It can be installed as easy as running:
 
     ansible-galaxy collection install checkmk.general
 
+Additionally, this role needs the Python module `netaddr`.
+Please make sure it is installed on your system and available for Ansible.
+
 ## Role Variables
 
     checkmk_agent_version: "2.3.0p3"
@@ -134,6 +137,12 @@ Automatically configure the firewall (*currently only on RedHat and Debian deriv
 
 When checkmk_agent_configure_firewall is set to `true` then configure the firewall zone on RedHat derivatives. Defaults to 'public'.
 
+    checkmk_agent_server_ips: []
+
+A list of IP addresses, that will be whitelisted in the firewall for agent access on `checkmk_agent_port`.
+The `checkmk_agent_server` will automatically be added, but only if it is an IP address.
+This parameter also does **not** take care of any agent-side whitelisting!
+
     checkmk_agent_force_install: 'false'
 
 Force the installation of the agent package, no matter the constraints.

roles/agent/defaults/main.yml

@@ -23,6 +23,7 @@ checkmk_agent_update: 'false'
 checkmk_agent_tls: 'false'
 checkmk_agent_configure_firewall: 'true'
 checkmk_agent_configure_firewall_zone: 'public'
+checkmk_agent_server_ips: []
 checkmk_agent_force_install: 'false'
 checkmk_agent_prep_legacy: 'false'
 checkmk_agent_delegate_api_calls: localhost

roles/agent/molecule/2.1.0/converge.yml

@@ -9,14 +9,25 @@
         update_cache: true
         cache_valid_time: 600
       when: ansible_os_family == 'Debian'
+
     - name: Install prerequisites.
       ansible.builtin.apt:
         name: "{{ item }}"
         state: present
       loop:
         - apt-utils
         - man
+        - ufw
       when: ansible_os_family == 'Debian'
+
+    - name: Install prerequisites.
+      ansible.builtin.yum:
+        name: "{{ item }}"
+        state: present
+      loop:
+        - firewalld
+      when: ansible_os_family == 'RedHat'
+
     - name: Create '/usr/share/man/man8/' on Ubuntu.
       ansible.builtin.file:
         path: /usr/share/man/man8/

roles/agent/molecule/2.1.0/group_vars/all.yml

@@ -29,7 +29,12 @@ checkmk_agent_discover: 'true'
 checkmk_agent_discover_max_parallel_tasks: 2
 checkmk_agent_update: 'false'
 checkmk_agent_tls: 'false'
-checkmk_agent_configure_firewall: 'false'
+checkmk_agent_configure_firewall: 'true'
+checkmk_agent_configure_firewall_zone: 'public'
+checkmk_agent_server_ips:
+  - 10.10.10.10
+  - 172.16.16.16
+  - 192.168.1.1
 checkmk_agent_force_install: 'false'
 checkmk_agent_prep_legacy: 'false'
 checkmk_agent_delegate_api_calls: "{{ inventory_hostname }}"

roles/agent/molecule/2.2.0/converge.yml

@@ -17,8 +17,17 @@
       loop:
         - apt-utils
         - man
+        - ufw
       when: ansible_os_family == 'Debian'
 
+    - name: Install prerequisites.
+      ansible.builtin.yum:
+        name: "{{ item }}"
+        state: present
+      loop:
+        - firewalld
+      when: ansible_os_family == 'RedHat'
+
     - name: Create '/usr/share/man/man8/' on Ubuntu.
       ansible.builtin.file:
         path: /usr/share/man/man8/

roles/agent/molecule/2.2.0/group_vars/all.yml

@@ -29,7 +29,12 @@ checkmk_agent_discover: 'true'
 checkmk_agent_discover_max_parallel_tasks: 2
 checkmk_agent_update: 'false'
 checkmk_agent_tls: 'false'
-checkmk_agent_configure_firewall: 'false'
+checkmk_agent_configure_firewall: 'true'
+checkmk_agent_configure_firewall_zone: 'public'
+checkmk_agent_server_ips:
+  - 10.10.10.10
+  - 172.16.16.16
+  - 192.168.1.1
 checkmk_agent_force_install: 'false'
 checkmk_agent_prep_legacy: 'false'
 checkmk_agent_delegate_api_calls: "{{ inventory_hostname }}"

roles/agent/molecule/2.3.0/converge.yml

@@ -17,8 +17,17 @@
       loop:
         - apt-utils
         - man
+        - ufw
       when: ansible_os_family == 'Debian'
 
+    - name: Install prerequisites.
+      ansible.builtin.yum:
+        name: "{{ item }}"
+        state: present
+      loop:
+        - firewalld
+      when: ansible_os_family == 'RedHat'
+
     - name: Create '/usr/share/man/man8/' on Ubuntu.
       ansible.builtin.file:
         path: /usr/share/man/man8/

roles/agent/molecule/2.3.0/group_vars/all.yml

@@ -29,7 +29,12 @@ checkmk_agent_discover: 'true'
 checkmk_agent_discover_max_parallel_tasks: 2
 checkmk_agent_update: 'false'
 checkmk_agent_tls: 'false'
-checkmk_agent_configure_firewall: 'false'
+checkmk_agent_configure_firewall: 'true'
+checkmk_agent_configure_firewall_zone: 'public'
+checkmk_agent_server_ips:
+  - 10.10.10.10
+  - 172.16.16.16
+  - 192.168.1.1
 checkmk_agent_force_install: 'false'
 checkmk_agent_prep_legacy: 'false'
 checkmk_agent_delegate_api_calls: "{{ inventory_hostname }}"

roles/agent/tasks/Debian.yml

@@ -47,17 +47,18 @@
 - name: "{{ ansible_os_family }} Derivatives: Configure Firewall for Agent."
   when: checkmk_agent_configure_firewall | bool and "ufw.service" in ansible_facts.services
   block:
-    - name: "{{ ansible_os_family }} Derivatives: Check if checkmk_agent_server is an IP address."
+    - name: "{{ ansible_os_family }} Derivatives: Add Checkmk Server to Firewall Whitelist if it is an IP address."
+      when: checkmk_agent_server | ansible.utils.ipaddr()
       ansible.builtin.set_fact:
-        checkmk_agent_server_ip: "{{ checkmk_agent_server }}"
-      when: checkmk_agent_server_ip is not defined and checkmk_agent_server | ansible.utils.ipaddr()
+        checkmk_agent_server_ips: "{{ checkmk_agent_server_ips + [checkmk_agent_server] }}"
 
     - name: "{{ ansible_os_family }} Derivatives: Allow Checkmk services access to the agent."
+      when: checkmk_agent_server_ips is defined
       community.general.ufw:
         rule: allow
         proto: tcp
-        src: "{{ checkmk_agent_server_ip }}"
+        src: "{{ item }}"
         port: '6556'
         comment: Allow Checkmk
-      when: checkmk_agent_server_ip is defined
+      loop: "{{ checkmk_agent_server_ips }}"
       become: true

roles/agent/tasks/RedHat.yml

@@ -47,17 +47,18 @@
 - name: "{{ ansible_os_family }} Derivatives: Configure Firewall for Agent."
   when: checkmk_agent_configure_firewall | bool and "firewalld.service" in ansible_facts.services
   block:
-    - name: "{{ ansible_os_family }} Derivatives: Check if checkmk_agent_server is an IP address."
+    - name: "{{ ansible_os_family }} Derivatives: Add Checkmk Server to Firewall Whitelist if it is an IP address."
+      when: checkmk_agent_server | ansible.utils.ipaddr()
       ansible.builtin.set_fact:
-        checkmk_agent_server_ip: "{{ checkmk_agent_server }}"
-      when: checkmk_agent_server_ip is not defined and checkmk_agent_server | ansible.utils.ipaddr()
+        checkmk_agent_server_ips: "{{ checkmk_agent_server_ips + [checkmk_agent_server] }}"
 
     - name: "{{ ansible_os_family }} Derivatives: Allow Checkmk services access to the agent."
+      when: checkmk_agent_server_ips is defined
       ansible.posix.firewalld:
         permanent: 'yes'
         immediate: 'yes'
         state: enabled
-        rich_rule: 'rule family="ipv4" source address={{ checkmk_agent_server_ip }} port port="{{ checkmk_agent_port }}" protocol="tcp" accept'
+        rich_rule: 'rule family="ipv4" source address={{ item }} port port="{{ checkmk_agent_port }}" protocol="tcp" accept'
         zone: "{{ checkmk_agent_configure_firewall_zone | default('public') }}"
-      when: checkmk_agent_server_ip is defined
+      loop: "{{ checkmk_agent_server_ips }}"
       become: true