---
- name: Traefik | Open firewall ports on workers
  hosts: workers
  become: true
  tasks:
    - name: Firewall | Open Traefik service port range
      ansible.posix.firewalld:
        port: "10000-10999/tcp"
        permanent: true
        state: enabled
        immediate: true

    - name: Firewall | Trust CNI interfaces
      ansible.posix.firewalld:
        zone: trusted
        interface: "{{ item }}"
        permanent: true
        state: enabled
        immediate: true
      loop:
        - flannel.1
        - cni0

- name: Traefik | Install via Helm and configure routes
  hosts: manager_nodes
  vars_files:
    - "{{ playbook_dir }}/../inventory/prod/group_vars/traefik.yml"
  roles:
    - traefik