revert infra: don't restart firewalld if unit is masked

If firewalld unit is masked, setting `configure_firewall: false` is
enough

Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1655059

Signed-off-by: Guillaume Abrioux <gabrioux@redhat.com>
(cherry picked from commit 1cff1f9806)

roles/ceph-defaults/tasks/facts.yml

@@ -247,6 +247,3 @@
 - name: set_fact osd_pool_default_size
   set_fact:
     osd_pool_default_size: "{{ ceph_conf_overrides.get('global', {}).get('osd_pool_default_size', ceph_osd_pool_default_size) }}"
-
-- name: populate service facts
-  service_facts:

roles/ceph-infra/handlers/main.yml

@@ -4,6 +4,3 @@
     name: firewalld
     state: restarted
     enabled: yes
-  when:
-    - ansible_facts['services']['firewalld.service'] is defined
-    - ansible_facts['services']['firewalld.service']['state'] != 'masked'

roles/ceph-infra/tasks/configure_firewall.yml

@@ -12,32 +12,32 @@
   when:
     - not containerized_deployment
 
-- name: start firewalld
+- block:
+  - name: start firewalld
     service:
       name: firewalld
       state: started
       enabled: yes
-  when:
-    - firewalld_pkg_query.get('rc', 1) == 0
-      or is_atomic
 
-- name: open monitor ports
+  - name: open monitor and manager ports
     firewalld:
-    service: ceph-mon
-    zone: "{{ ceph_mon_firewall_zone }}"
+      service: "{{ item.service }}"
+      zone: "{{ item.zone }}"
       source: "{{ public_network }}"
       permanent: true
       immediate: true
       state: enabled
     notify: restart firewalld
+    with_items:
+      - { 'service': 'ceph-mon', 'zone': "{{ ceph_mon_firewall_zone }}" }
+      - { 'service': 'ceph', 'zone': "{{ ceph_mgr_firewall_zone }}" }
     when:
       - mon_group_name is defined
       - mon_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
     tags:
       - firewall
 
-- name: open manager ports
+  - name: open manager ports
     firewalld:
       service: ceph
       zone: "{{ ceph_mgr_firewall_zone }}"
@@ -49,11 +49,10 @@
     when:
       - mgr_group_name is defined
       - mgr_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
     tags:
       - firewall
 
-- name: open osd ports
+  - name: open osd ports
     firewalld:
       service: ceph
       zone: "{{ ceph_osd_firewall_zone }}"
@@ -68,11 +67,10 @@
     when:
       - osd_group_name is defined
       - osd_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
     tags:
       - firewall
 
-- name: open rgw ports
+  - name: open rgw ports
     firewalld:
       port: "{{ radosgw_frontend_port }}/tcp"
       zone: "{{ ceph_rgw_firewall_zone }}"
@@ -84,11 +82,10 @@
     when:
       - rgw_group_name is defined
       - rgw_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
     tags:
       - firewall
 
-- name: open mds ports
+  - name: open mds ports
     firewalld:
       service: ceph
       zone: "{{ ceph_mds_firewall_zone }}"
@@ -100,11 +97,10 @@
     when:
       - mds_group_name is defined
       - mds_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
     tags:
       - firewall
 
-- name: open nfs ports
+  - name: open nfs ports
     firewalld:
       service: nfs
       zone: "{{ ceph_nfs_firewall_zone }}"
@@ -116,11 +112,10 @@
     when:
       - nfs_group_name is defined
       - nfs_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
     tags:
       - firewall
 
-- name: open nfs ports (portmapper)
+  - name: open nfs ports (portmapper)
     firewalld:
       port: "111/tcp"
       zone: "{{ ceph_nfs_firewall_zone }}"
@@ -132,27 +127,10 @@
     when:
       - nfs_group_name is defined
       - nfs_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
     tags:
       - firewall
 
-- name: open restapi ports
-  firewalld:
-    port: "{{ restapi_port }}/tcp"
-    zone: "{{ ceph_restapi_firewall_zone }}"
-    source: "{{ public_network }}"
-    permanent: true
-    immediate: true
-    state: enabled
-  notify: restart firewalld
-  when:
-    - restapi_group_name is defined
-    - restapi_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
-  tags:
-    - firewall
-
-- name: open rbdmirror ports
+  - name: open rbdmirror ports
     firewalld:
       service: ceph
       zone: "{{ ceph_rbdmirror_firewall_zone }}"
@@ -164,11 +142,10 @@
     when:
       - rbdmirror_group_name is defined
       - rbdmirror_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
     tags:
       - firewall
 
-- name: open iscsi target ports
+  - name: open iscsi target ports
     firewalld:
       port: "3260/tcp"
       zone: "{{ ceph_iscsi_firewall_zone }}"
@@ -180,11 +157,10 @@
     when:
       - iscsi_gw_group_name is defined
       - iscsi_gw_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
     tags:
       - firewall
 
-- name: open iscsi api ports
+  - name: open iscsi api ports
     firewalld:
       port: "{{ api_port | default(5000) }}/tcp"
       zone: "{{ ceph_iscsi_firewall_zone }}"
@@ -196,8 +172,11 @@
     when:
       - iscsi_gw_group_name is defined
       - iscsi_gw_group_name in group_names
-    - (firewalld_pkg_query.get('rc', 1) == 0 or is_atomic)
     tags:
       - firewall
 
+  when:
+    - (firewalld_pkg_query.get('rc', 1) == 0
+      or is_atomic)
+
 - meta: flush_handlers