Move os_firewall_allow from defaults to role dependencies.

roles/cockpit/defaults/main.yml

@@ -1,4 +0,0 @@
----
-os_firewall_allow:
-- service: cockpit-ws
-  port: 9090/tcp

roles/cockpit/meta/main.yml

@@ -12,4 +12,7 @@ galaxy_info:
   categories:
   - cloud
 dependencies:
-  - { role: os_firewall }
+- role: os_firewall
+  os_firewall_allow:
+  - service: cockpit-ws
+    port: 9090/tcp

roles/etcd/defaults/main.yaml

@@ -14,9 +14,3 @@ etcd_advertise_client_urls: "{{ etcd_url_scheme }}://{{ etcd_ip }}:{{ etcd_clien
 etcd_listen_client_urls: "{{ etcd_url_scheme }}://{{ etcd_ip }}:{{ etcd_client_port }}"
 
 etcd_data_dir: /var/lib/etcd/
-
-os_firewall_allow:
-- service: etcd
-  port: "{{etcd_client_port}}/tcp"
-- service: etcd peering
-  port: "{{ etcd_peer_port }}/tcp"

roles/etcd/meta/main.yml

@@ -16,5 +16,10 @@ galaxy_info:
   - cloud
   - system
 dependencies:
-- { role: os_firewall }
-- { role: etcd_common }
+- role: os_firewall
+  os_firewall_allow:
+  - service: etcd
+    port: "{{etcd_client_port}}/tcp"
+  - service: etcd peering
+    port: "{{ etcd_peer_port }}/tcp"
+- role: etcd_common

roles/openshift_node/defaults/main.yml

@@ -1,16 +1,2 @@
 ---
-os_firewall_allow:
-- service: Kubernetes kubelet
-  port: 10250/tcp
-- service: http
-  port: 80/tcp
-- service: https
-  port: 443/tcp
-- service: Openshift kubelet ReadOnlyPort
-  port: 10255/tcp
-- service: Openshift kubelet ReadOnlyPort udp
-  port: 10255/udp
-- service: OpenShift OVS sdn
-  port: 4789/udp
-  when: openshift.node.use_openshift_sdn | bool
 openshift_version: "{{ openshift_pkg_version | default(openshift_image_tag | default(openshift.docker.openshift_image_tag | default(''))) }}"

roles/openshift_node/meta/main.yml

@@ -19,4 +19,17 @@ dependencies:
 - role: openshift_node_dnsmasq
   when: openshift.common.use_dnsmasq
 - role: os_firewall
-
+  os_firewall_allow:
+  - service: Kubernetes kubelet
+    port: 10250/tcp
+  - service: http
+    port: 80/tcp
+  - service: https
+    port: 443/tcp
+  - service: Openshift kubelet ReadOnlyPort
+    port: 10255/tcp
+  - service: Openshift kubelet ReadOnlyPort udp
+    port: 10255/udp
+  - service: OpenShift OVS sdn
+    port: 4789/udp
+    when: openshift.node.use_openshift_sdn | bool

roles/openshift_storage_nfs/defaults/main.yml

@@ -16,6 +16,3 @@ openshift:
           options: "*(rw,root_squash)"
         volume:
           name: "metrics"
-os_firewall_allow:
-- service: nfs
-  port: "2049/tcp"

roles/openshift_storage_nfs/meta/main.yml

@@ -11,5 +11,8 @@ galaxy_info:
     - 7
 dependencies:
 - role: os_firewall
+  os_firewall_allow:
+  - service: nfs
+    port: "2049/tcp"
 - role: openshift_hosted_facts
 - role: openshift_repos