From 44687bb917e5b6f465ed51905d33697703ca859c Mon Sep 17 00:00:00 2001 From: Trishna Guha Date: Thu, 15 Jun 2017 22:07:03 +0530 Subject: [PATCH] Add iosxr_user implementation module (#25615) * Add iosxr_user implementation module Signed-off-by: Trishna Guha * iosxr_user Integration test Signed-off-by: Trishna Guha * iosxr_user Unit test Signed-off-by: Trishna Guha * Modify integration test with idempotent case Signed-off-by: Trishna Guha --- .../modules/network/iosxr/iosxr_user.py | 311 ++++++++++++++++++ test/integration/iosxr.yaml | 1 + .../targets/iosxr_user/defaults/main.yaml | 3 + .../targets/iosxr_user/meta/main.yaml | 2 + .../targets/iosxr_user/tasks/cli.yaml | 16 + .../targets/iosxr_user/tasks/main.yaml | 2 + .../targets/iosxr_user/tests/cli/basic.yaml | 71 ++++ .../iosxr/fixtures/iosxr_user_config.cfg | 2 + .../modules/network/iosxr/test_iosxr_user.py | 80 +++++ 9 files changed, 488 insertions(+) create mode 100644 lib/ansible/modules/network/iosxr/iosxr_user.py create mode 100644 test/integration/targets/iosxr_user/defaults/main.yaml create mode 100644 test/integration/targets/iosxr_user/meta/main.yaml create mode 100644 test/integration/targets/iosxr_user/tasks/cli.yaml create mode 100644 test/integration/targets/iosxr_user/tasks/main.yaml create mode 100644 test/integration/targets/iosxr_user/tests/cli/basic.yaml create mode 100644 test/units/modules/network/iosxr/fixtures/iosxr_user_config.cfg create mode 100644 test/units/modules/network/iosxr/test_iosxr_user.py diff --git a/lib/ansible/modules/network/iosxr/iosxr_user.py b/lib/ansible/modules/network/iosxr/iosxr_user.py new file mode 100644 index 0000000000..fa041a3e16 --- /dev/null +++ b/lib/ansible/modules/network/iosxr/iosxr_user.py @@ -0,0 +1,311 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +# (c) 2017, Ansible by Red Hat, inc +# +# This file is part of Ansible by Red Hat +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +ANSIBLE_METADATA = {'metadata_version': '1.0', + 'status': ['preview'], + 'supported_by': 'core'} + +DOCUMENTATION = """ +--- +module: iosxr_user +version_added: "2.4" +author: "Trishna Guha (@trishnag)" +short_description: Manage the collection of local users on Cisco IOS XR device +description: + - This module provides declarative management of the local usernames + configured on network devices. It allows playbooks to manage + either individual usernames or the collection of usernames in the + current running config. It also supports purging usernames from the + configuration that are not explicitly defined. +options: + users: + description: + - The set of username objects to be configured on the remote + Cisco IOS XR device. The list entries can either be the username + or a hash of username and properties. This argument is mutually + exclusive with the C(name) argument, alias C(collection). + name: + description: + - The username to be configured on the Cisco IOS XR device. + This argument accepts a string value and is mutually exclusive + with the C(collection) argument. + Please note that this option is not same as C(provider username). + password: + description: + - The password to be configured on the Cisco IOS XR device. The + password needs to be provided in clear and it will be encrypted + on the device. + Please note that this option is not same as C(provider password). + update_password: + description: + - Since passwords are encrypted in the device running config, this + argument will instruct the module when to change the password. When + set to C(always), the password will always be updated in the device + and when set to C(on_create) the password will be updated only if + the username is created. + default: always + choices: ['on_create', 'always'] + group: + description: + - Configures the group for the username in the + device running configuration. The argument accepts a string value + defining the group name. This argument does not check if the group + has been configured on the device, alias C(role). + purge: + description: + - Instructs the module to consider the + resource definition absolute. It will remove any previously + configured usernames on the device with the exception of the + `admin` user (the current defined set of users). + type: bool + default: false + state: + description: + - Configures the state of the username definition + as it relates to the device operational configuration. When set + to I(present), the username(s) should be configured in the device active + configuration and when set to I(absent) the username(s) should not be + in the device active configuration + default: present + choices: ['present', 'absent'] +""" + +EXAMPLES = """ +- name: create a new user + iosxr_user: + name: ansible + password: test + state: present +- name: remove all users except admin + iosxr_user: + purge: yes +- name: set multiple users to group sys-admin + iosxr_user: + users: + - name: netop + - name: netend + group: sysadmin + state: present +- name: Change Password for User netop + iosxr_user: + name: netop + password: "{{ new_password }}" + update_password: always + state: present +""" + +RETURN = """ +commands: + description: The list of configuration mode commands to send to the device + returned: always + type: list + sample: + - username ansible secret password group sysadmin + - username admin secret admin +""" + +import re + +from functools import partial + +from ansible.module_utils.basic import AnsibleModule +from ansible.module_utils.iosxr import get_config, load_config +from ansible.module_utils.six import iteritems +from ansible.module_utils.iosxr import iosxr_argument_spec, check_args + + +def map_obj_to_commands(updates, module): + commands = list() + state = module.params['state'] + update_password = module.params['update_password'] + + def needs_update(want, have, x): + return want.get(x) and (want.get(x) != have.get(x)) + + def add(command, want, x): + command.append('username %s %s' % (want['name'], x)) + + for update in updates: + want, have = update + + if want['state'] == 'absent': + commands.append('no username %s' % want['name']) + continue + + if needs_update(want, have, 'group'): + add(commands, want, 'group %s' % want['group']) + + if needs_update(want, have, 'password'): + if update_password == 'always' or not have: + add(commands, want, 'secret %s' % want['password']) + + return commands + + +def parse_group(data): + match = re.search(r'\n group (\S+)', data, re.M) + if match: + return match.group(1) + + +def map_config_to_obj(module): + data = get_config(module, flags=['username']) + + match = re.findall(r'^username (\S+)', data, re.M) + if not match: + return list() + + instances = list() + + for user in set(match): + regex = r'username %s .+$' % user + cfg = re.findall(regex, data, re.M) + cfg = '\n'.join(cfg) + obj = { + 'name': user, + 'state': 'present', + 'password': None, + 'group': parse_group(cfg) + } + instances.append(obj) + + return instances + + +def get_param_value(key, item, module): + # if key doesn't exist in the item, get it from module.params + if not item.get(key): + value = module.params[key] + + # if key does exist, do a type check on it to validate it + else: + value_type = module.argument_spec[key].get('type', 'str') + type_checker = module._CHECK_ARGUMENT_TYPES_DISPATCHER[value_type] + type_checker(item[key]) + value = item[key] + + # validate the param value (if validator func exists) + validator = globals().get('validate_%s' % key) + if all((value, validator)): + validator(value, module) + + return value + + +def map_params_to_obj(module): + users = module.params['users'] + if not users: + if not module.params['name'] and module.params['purge']: + return list() + elif not module.params['name']: + module.fail_json(msg='username is required') + else: + collection = [{'name': module.params['name']}] + else: + collection = list() + for item in users: + if not isinstance(item, dict): + collection.append({'name': item}) + elif 'name' not in item: + module.fail_json(msg='name is required') + else: + collection.append(item) + + objects = list() + + for item in collection: + get_value = partial(get_param_value, item=item, module=module) + item['password'] = get_value('password') + item['group'] = get_value('group') + item['state'] = get_value('state') + objects.append(item) + + return objects + + +def update_objects(want, have): + updates = list() + for entry in want: + item = next((i for i in have if i['name'] == entry['name']), None) + if all((item is None, entry['state'] == 'present')): + updates.append((entry, {})) + elif item: + for key, value in iteritems(entry): + if value and value != item[key]: + updates.append((entry, item)) + return updates + + +def main(): + """ main entry point for module execution + """ + argument_spec = dict( + users=dict(type='list', aliases=['collection']), + name=dict(), + + password=dict(no_log=True), + update_password=dict(default='always', choices=['on_create', 'always']), + + group=dict(aliases=['role']), + + purge=dict(type='bool', default=False), + state=dict(default='present', choices=['present', 'absent']) + ) + + argument_spec.update(iosxr_argument_spec) + mutually_exclusive = [('name', 'users')] + + module = AnsibleModule(argument_spec=argument_spec, + mutually_exclusive=mutually_exclusive, + supports_check_mode=True) + + warnings = list() + check_args(module, warnings) + + result = {'changed': False} + + want = map_params_to_obj(module) + have = map_config_to_obj(module) + + commands = map_obj_to_commands(update_objects(want, have), module) + + if module.params['purge']: + want_users = [x['name'] for x in want] + have_users = [x['name'] for x in have] + for item in set(have_users).difference(want_users): + if item != 'admin': + commands.append('no username %s' % item) + + result['commands'] = commands + result['warnings'] = warnings + + if 'no username admin' in commands: + module.fail_json(msg='cannot delete the `admin` account') + + if commands: + if not module.check_mode: + load_config(module, commands, result['warnings'], commit=True) + result['changed'] = True + + module.exit_json(**result) + +if __name__ == '__main__': + main() diff --git a/test/integration/iosxr.yaml b/test/integration/iosxr.yaml index e2d0960a2e..d3e2aade6c 100644 --- a/test/integration/iosxr.yaml +++ b/test/integration/iosxr.yaml @@ -13,3 +13,4 @@ - { role: iosxr_facts, when: "limit_to in ['*', 'iosxr_facts']" } - { role: iosxr_template, when: "limit_to in ['*', 'iosxr_template']" } - { role: iosxr_system, when: "limit_to in ['*', 'iosxr_system']" } + - { role: iosxr_user, when: "limit_to in ['*', 'iosxr_user']" } diff --git a/test/integration/targets/iosxr_user/defaults/main.yaml b/test/integration/targets/iosxr_user/defaults/main.yaml new file mode 100644 index 0000000000..9ef5ba5165 --- /dev/null +++ b/test/integration/targets/iosxr_user/defaults/main.yaml @@ -0,0 +1,3 @@ +--- +testcase: "*" +test_items: [] diff --git a/test/integration/targets/iosxr_user/meta/main.yaml b/test/integration/targets/iosxr_user/meta/main.yaml new file mode 100644 index 0000000000..d4da833dd5 --- /dev/null +++ b/test/integration/targets/iosxr_user/meta/main.yaml @@ -0,0 +1,2 @@ +dependencies: + - prepare_iosxr_tests diff --git a/test/integration/targets/iosxr_user/tasks/cli.yaml b/test/integration/targets/iosxr_user/tasks/cli.yaml new file mode 100644 index 0000000000..46d86dd698 --- /dev/null +++ b/test/integration/targets/iosxr_user/tasks/cli.yaml @@ -0,0 +1,16 @@ +--- +- name: collect all cli test cases + find: + paths: "{{ role_path }}/tests/cli" + patterns: "{{ testcase }}.yaml" + register: test_cases + delegate_to: localhost + +- name: set test_items + set_fact: test_items="{{ test_cases.files | map(attribute='path') | list }}" + +- name: run test case + include: "{{ test_case_to_run }}" + with_items: "{{ test_items }}" + loop_control: + loop_var: test_case_to_run diff --git a/test/integration/targets/iosxr_user/tasks/main.yaml b/test/integration/targets/iosxr_user/tasks/main.yaml new file mode 100644 index 0000000000..415c99d8b1 --- /dev/null +++ b/test/integration/targets/iosxr_user/tasks/main.yaml @@ -0,0 +1,2 @@ +--- +- { include: cli.yaml, tags: ['cli'] } diff --git a/test/integration/targets/iosxr_user/tests/cli/basic.yaml b/test/integration/targets/iosxr_user/tests/cli/basic.yaml new file mode 100644 index 0000000000..a1c806870b --- /dev/null +++ b/test/integration/targets/iosxr_user/tests/cli/basic.yaml @@ -0,0 +1,71 @@ +--- +- name: Create user (SetUp) + iosxr_user: + name: ansibletest1 + password: test + state: present + provider: "{{ cli }}" + register: result + +- assert: + that: + - 'result.changed == true' + - '"username ansibletest1 secret" in result.commands' + +- name: Collection of users (SetUp) + iosxr_user: + users: + - name: ansibletest2 + - name: ansibletest3 + state: present + group: sysadmin + provider: "{{ cli }}" + register: result + +- assert: + that: + - 'result.changed == true' + - 'result.commands == ["username ansibletest2 group sysadmin", "username ansibletest3 group sysadmin"]' + +- name: Add user again (Idempotent) + iosxr_user: + name: ansibletest1 + password: test + state: present + provider: "{{ cli }}" + register: result + +- assert: + that: + - 'result.changed == false' + - 'result.commands | length == 0' + +- name: Add collection of users again (Idempotent) + iosxr_user: + users: + - name: ansibletest2 + - name: ansibletest3 + state: present + group: sysadmin + provider: "{{ cli }}" + register: result + +- assert: + that: + - 'result.changed == false' + - 'result.commands | length == 0' + +- name: tearDown + iosxr_user: + users: + - name: ansibletest1 + - name: ansibletest2 + - name: ansibletest3 + state: absent + provider: "{{ cli }}" + register: result + +- assert: + that: + - 'result.changed == true' + - 'result.commands == ["no username ansibletest1", "no username ansibletest2", "no username ansibletest3"]' diff --git a/test/units/modules/network/iosxr/fixtures/iosxr_user_config.cfg b/test/units/modules/network/iosxr/fixtures/iosxr_user_config.cfg new file mode 100644 index 0000000000..449dde510d --- /dev/null +++ b/test/units/modules/network/iosxr/fixtures/iosxr_user_config.cfg @@ -0,0 +1,2 @@ +username admin secret 5 $1$mdQIUxjg$3t3lzBpfKfITKvFm1uEIY. group sysadmin +username ansible secret 5 $1$3yWSXiIi$VdzV59ChiurrNdGxlDeAW/ group sysadmin diff --git a/test/units/modules/network/iosxr/test_iosxr_user.py b/test/units/modules/network/iosxr/test_iosxr_user.py new file mode 100644 index 0000000000..eda3aeaeec --- /dev/null +++ b/test/units/modules/network/iosxr/test_iosxr_user.py @@ -0,0 +1,80 @@ +# (c) 2016 Red Hat Inc. +# +# This file is part of Ansible +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . + +# Make coding more python3-ish +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +import json + +from ansible.compat.tests.mock import patch +from ansible.modules.network.iosxr import iosxr_user +from .iosxr_module import TestIosxrModule, load_fixture, set_module_args + + +class TestIosxrUserModule(TestIosxrModule): + + module = iosxr_user + + def setUp(self): + self.mock_get_config = patch('ansible.modules.network.iosxr.iosxr_user.get_config') + self.get_config = self.mock_get_config.start() + + self.mock_load_config = patch('ansible.modules.network.iosxr.iosxr_user.load_config') + self.load_config = self.mock_load_config.start() + + def tearDown(self): + self.mock_get_config.stop() + self.mock_load_config.stop() + + def load_fixtures(self, commands=None, transport='cli'): + self.get_config.return_value = load_fixture('iosxr_user_config.cfg') + self.load_config.return_value = dict(diff=None, session='session') + + def test_iosxr_user_delete(self): + set_module_args(dict(name='ansible', state='absent')) + result = self.execute_module(changed=True) + self.assertEqual(result['commands'], ['no username ansible']) + + def test_iosxr_user_password(self): + set_module_args(dict(name='ansible', password='test')) + result = self.execute_module(changed=True) + self.assertEqual(result['commands'], ['username ansible secret test']) + + def test_iosxr_user_purge(self): + set_module_args(dict(purge=True)) + result = self.execute_module(changed=True) + self.assertEqual(result['commands'], ['no username ansible']) + + def test_iosxr_user_group(self): + set_module_args(dict(name='ansible', group='sysadmin')) + result = self.execute_module(changed=True) + self.assertEqual(result['commands'], ['username ansible group sysadmin']) + + def test_iosxr_user_update_password_changed(self): + set_module_args(dict(name='test', password='test', update_password='on_create')) + result = self.execute_module(changed=True) + self.assertEqual(result['commands'], ['username test secret test']) + + def test_iosxr_user_update_password_on_create_ok(self): + set_module_args(dict(name='ansible', password='test', update_password='on_create')) + self.execute_module() + + def test_iosxr_user_update_password_always(self): + set_module_args(dict(name='ansible', password='test', update_password='always')) + result = self.execute_module(changed=True) + self.assertEqual(result['commands'], ['username ansible secret test'])