nodes=(
  10.51.167.70
  10.51.167.71
  10.51.167.72
  10.51.167.73
  10.51.167.74
  10.51.167.75
  10.51.167.76
  10.51.167.77
  10.51.167.78
  10.129.67.132
  10.129.67.133
)


# 将集群内所有的节点IP配置到防火墙可信区中
for ip in ${nodes[@]}
  firewall-cmd --permanent --zone=trusted --add-source=${ip}
done

# 增加防火墙规则
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 1 -j ACCEPT -m comment --comment "kube-proxy redirects" 
firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 1  -j ACCEPT -m comment --comment "allow forwards"

firewall-cmd --add-masquerade --permanent

# 所有k8s的NodePort端口添加到例外
#firewall-cmd --permanent --zone=public --add-port=30000-32767/tcp
firewall-cmd --permanent --zone=public --add-port=80/tcp

# 重新加载配置
firewall-cmd --reload