---
- name: Firewall | Open Traefik service port range on workers
  ansible.posix.firewalld:
    port: "10000-10999/tcp"
    permanent: true
    state: enabled
    immediate: true
  delegate_to: "{{ item }}"
  loop: "{{ groups['workers'] }}"

- name: Firewall | Trust CNI interfaces on workers
  ansible.posix.firewalld:
    zone: trusted
    interface: "{{ item.1 }}"
    permanent: true
    state: enabled
    immediate: true
  loop: "{{ groups['workers'] | product(['flannel.1', 'cni0']) | list }}"
  loop_control:
    label: "{{ item.0 }} {{ item.1 }}"
  delegate_to: "{{ item.0 }}"