adding iptables exception SE Linux policies

roles/rke2/selinux/my-iptables.te

+module my-iptables 1.0;
+
+require {
+        type iptables_t;
+        type cgroup_t;
+        class dir ioctl;
+}
+
+#============= iptables_t ==============
+allow iptables_t cgroup_t:dir ioctl;
\ No newline at end of file

roles/rke2/tasks/main.yml

@@ -6,7 +6,7 @@
 - block:
   - include_tasks: setup_host.yml
   - include_tasks: install_rke2.yml
- # when: ( not rke2_installed.stat.exists and state != 'absent' ) or (upgrade and state != 'absent' )
+  when: ( not rke2_installed.stat.exists and state != 'absent' ) or (upgrade and state != 'absent' )
 
 - include_tasks: templates.yml
   when: "state != 'absent' and 'master' in group_names  "

roles/rke2/tasks/setup_host.yml

@@ -71,21 +71,26 @@
     name: etcd
     group: etcd
 
+- name: Reboot but not on upgrades, so kernel updates only install at initial runs 
+  ansible.builtin.reboot:
+    reboot_timeout: 3600
+  when: ( not upgrade ) 
 
 - name: Download root CA
   get_url:
     url: https://curl.se/ca/cacert.pem
     dest: /etc/ssl/certs
 
-- name: Update CA trust
-  shell: update-ca-trust
-  
 - name: Disable SELinux
   selinux:
     policy: targeted
     state: permissive
   when: ( 'control-plane' in group_names )
 
+- name: Update CA trust
+  shell: update-ca-trust
+  
+
 - name: Copy SELinux Policies
   template:
     src: ../selinux/my-openstack.te
@@ -99,6 +104,19 @@
     semodule -i /etc/selinux/targeted/policy/my-openstack.pp
   when: ( 'control-plane' in group_names )
 
+- name: Copy SELinux Policies for new Kernel ()
+  template:
+    src: ../selinux/my-iptables.te
+    dest: /etc/selinux/targeted/policy/my-iptables.te
+  #when: ( 'control-plane' in group_names )
+
+- name: Build SELinux exception module & allow xtables-nft-multi ioctl access on the cgroup directory
+  shell: |
+    checkmodule -M -m -o /etc/selinux/targeted/policy/my-iptables.mod /etc/selinux/targeted/policy/my-iptables.te
+    semodule_package -o /etc/selinux/targeted/policy/my-iptables.pp -m /etc/selinux/targeted/policy/my-iptables.mod
+    semodule -i /etc/selinux/targeted/policy/my-iptables.pp
+  #when: ( 'control-plane' in group_names )
+
 - name: Ensure /var/lib/rancher/rke2/server/manifests
   file:
     path: /var/lib/rancher/rke2/server/manifests
@@ -111,10 +129,3 @@
     state: directory
     recurse: yes
 
-#- name: reboot (make sure SELinux is off)
-#  shell: |
-#    systemctl reboot
-- name: Reboot but not on upgrades, so kernel updates only install at initial runs 
-  ansible.builtin.reboot:
-    reboot_timeout: 3600
-  when: ( not upgrade ) 
\ No newline at end of file