ansible/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2024-09-14 20:13:21 +02:00
Code Releases Activity

VMware: Add new module : vmware_host_firewall_manager (#35596)

Browse source 
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
This commit is contained in:
Abhijeet Kasurde 2018-02-06 08:29:56 +05:30 committed by GitHub
parent 636ef65099
commit 635036fb62
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 349 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

225
lib/ansible/modules/cloud/vmware/vmware_host_firewall_manager.py Normal file
View file

@ -0,0 +1,225 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Copyright: (c) 2018, Abhijeet Kasurde <akasurde@redhat.com>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
from __future__ import absolute_import, division, print_function
__metaclass__ = type
ANSIBLE_METADATA = {
'metadata_version': '1.1',
'status': ['preview'],
'supported_by': 'community'
}
DOCUMENTATION = r'''
---
module: vmware_host_firewall_manager
short_description: Manage firewall configurations about an ESXi host
description:
- This module can be used to manage firewall configurations about an ESXi host when ESXi hostname or Cluster name is given.
version_added: '2.5'
author:
- Abhijeet Kasurde (@akasurde)
notes:
- Tested on vSphere 6.5
requirements:
- python >= 2.6
- PyVmomi
options:
cluster_name:
description:
- Name of the cluster.
- Firewall settings are applied to every ESXi host system in given cluster.
- If C(esxi_hostname) is not given, this parameter is required.
esxi_hostname:
description:
- ESXi hostname.
- Firewall settings are applied to this ESXi host system.
- If C(cluster_name) is not given, this parameter is required.
rules:
description:
- A list of Rule set which needs to be managed.
- Each member of list is rule set name and state to be set the rule.
- Both rule name and rule state are required parameters.
- Please see examples for more information.
extends_documentation_fragment: vmware.documentation
'''
EXAMPLES = r'''
- name: Enable vvold rule set for all ESXi Host in given Cluster
vmware_host_firewall_manager:
hostname: '{{ vcenter_hostname }}'
username: '{{ vcenter_username }}'
password: '{{ vcenter_password }}'
cluster_name: cluster_name
rules:
- name: vvold
enabled: True
- name: Enable vvold rule set for an ESXi Host
vmware_host_firewall_manager:
hostname: '{{ vcenter_hostname }}'
username: '{{ vcenter_username }}'
password: '{{ vcenter_password }}'
esxi_hostname: '{{ esxi_hostname }}'
rules:
- name: vvold
enabled: True
- name: Manage multiple rule set for an ESXi Host
vmware_host_firewall_manager:
hostname: '{{ vcenter_hostname }}'
username: '{{ vcenter_username }}'
password: '{{ vcenter_password }}'
esxi_hostname: '{{ esxi_hostname }}'
rules:
- name: vvold
enabled: True
- name: CIMHttpServer
enabled: False
'''
RETURN = r'''
rule_set_state:
description:
- dict with hostname as key and dict with firewall rule set facts as value
returned: success
type: dict
sample: {
"rule_set_state": {
"localhost.localdomain": {
"CIMHttpServer": {
"current_state": true,
"desired_state": true,
"previous_state": true
},
"vvold": {
"current_state": true,
"desired_state": true,
"previous_state": true
}
}
}
}
'''
try:
from pyVmomi import vim, vmodl
except ImportError:
pass
from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.vmware import vmware_argument_spec, PyVmomi
from ansible.module_utils._text import to_native
class VmwareFirewallManager(PyVmomi):
def __init__(self, module):
super(VmwareFirewallManager, self).__init__(module)
cluster_name = self.params.get('cluster_name', None)
esxi_host_name = self.params.get('esxi_hostname', None)
self.options = self.params.get('options', dict())
self.hosts = []
if cluster_name:
cluster_obj = self.find_cluster_by_name(cluster_name=cluster_name)
if cluster_obj:
self.hosts = [host for host in cluster_obj.host]
else:
module.fail_json(changed=False, msg="Cluster '%s' not found" % cluster_name)
elif esxi_host_name:
esxi_host_obj = self.find_hostsystem_by_name(host_name=esxi_host_name)
if esxi_host_obj:
self.hosts = [esxi_host_obj]
else:
module.fail_json(changed=False, msg="ESXi '%s' not found" % esxi_host_name)
self.firewall_facts = dict()
self.rule_options = self.module.params.get("rules")
self.gather_rule_set()
def gather_rule_set(self):
for host in self.hosts:
self.firewall_facts[host.name] = {}
firewall_system = host.configManager.firewallSystem
if firewall_system:
for rule_set_obj in firewall_system.firewallInfo.ruleset:
temp_rule_dict = dict()
temp_rule_dict['enabled'] = rule_set_obj.enabled
self.firewall_facts[host.name][rule_set_obj.key] = temp_rule_dict
def ensure(self):
"""
Function to ensure rule set configuration
"""
fw_change_list = []
results = dict(changed=False, rule_set_state=dict())
for host in self.hosts:
firewall_system = host.configManager.firewallSystem
if firewall_system is None:
continue
results['rule_set_state'][host.name] = dict()
for rule_option in self.rule_options:
rule_name = rule_option.get('name', None)
if rule_name is None:
self.module.fail_json(msg="Please specify rule.name for rule set"
" as it is required parameter.")
if rule_name not in self.firewall_facts[host.name]:
self.module.fail_json(msg="rule named '%s' wasn't found." % rule_name)
rule_enabled = rule_option.get('enabled', None)
if rule_enabled is None:
self.module.fail_json(msg="Please specify rules.enabled for rule set"
" %s as it is required parameter." % rule_name)
current_rule_state = self.firewall_facts[host.name][rule_name]['enabled']
if current_rule_state != rule_enabled:
try:
if rule_enabled:
firewall_system.EnableRuleset(id=rule_name)
else:
firewall_system.DisableRuleset(id=rule_name)
fw_change_list.append(True)
except vim.fault.NotFound as not_found:
self.module.fail_json(msg="Failed to enable rule set %s as"
" rule set id is unknown : %s" % (rule_name,
to_native(not_found.msg)))
except vim.fault.HostConfigFault as host_config_fault:
self.module.fail_json(msg="Failed to enabled rule set %s as an internal"
" error happened while reconfiguring"
" rule set : %s" % (rule_name,
to_native(host_config_fault.msg)))
results['rule_set_state'][host.name][rule_name] = dict(current_state=rule_enabled,
previous_state=current_rule_state,
desired_state=rule_enabled,
)
if any(fw_change_list):
results['changed'] = True
self.module.exit_json(**results)
def main():
argument_spec = vmware_argument_spec()
argument_spec.update(
cluster_name=dict(type='str', required=False),
esxi_hostname=dict(type='str', required=False),
rules=dict(type='list', default=list(), required=False),
)
module = AnsibleModule(
argument_spec=argument_spec,
required_one_of=[
['cluster_name', 'esxi_hostname'],
]
)
vmware_firewall_manager = VmwareFirewallManager(module)
vmware_firewall_manager.ensure()
if __name__ == "__main__":
main()

3
test/integration/targets/vmware_host_firewall_manager/aliases Normal file
View file

@ -0,0 +1,3 @@
posix/ci/cloud/group4/vcenter
cloud/vcenter
destructive

121
test/integration/targets/vmware_host_firewall_manager/tasks/main.yml Normal file
View file

@ -0,0 +1,121 @@
# Test code for the vmware_host_firewall_manager module.
# Copyright: (c) 2018, Abhijeet Kasurde <akasurde@redhat.com>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
- name: make sure pyvmomi is installed
pip:
name: pyvmomi
state: latest
when: "{{ ansible_user_id == 'root' }}"
- name: store the vcenter container ip
set_fact:
vcsim: "{{ lookup('env', 'vcenter_host') }}"
- debug: var=vcsim
- name: Wait for Flask controller to come up online
wait_for:
host: "{{ vcsim }}"
port: 5000
state: started
- name: kill vcsim
uri:
url: http://{{ vcsim }}:5000/killall
- name: start vcsim
uri:
url: http://{{ vcsim }}:5000/spawn?cluster=2
register: vcsim_instance
- debug:
var: vcsim_instance
- name: Wait for vcsim server to come up online
wait_for:
host: "{{ vcsim }}"
port: 443
state: started
- name: get a list of Cluster from vcsim
uri:
url: http://{{ vcsim }}:5000/govc_find?filter=CCR
register: clusters
- name: get a cluster
set_fact:
ccr1: "{{ clusters.json[0] | basename }}"
- name: get a list of hosts from vcsim
uri:
url: http://{{ vcsim }}:5000/govc_find?filter=H
register: hosts
- name: get a cluster
set_fact:
host1: "{{ hosts.json[0] | basename }}"
- debug: var=ccr1
- debug: var=host1
- name: Enable vvold rule set on all hosts of {{ ccr1 }}
vmware_host_firewall_manager:
hostname: "{{ vcsim }}"
username: "{{ vcsim_instance.json.username }}"
password: "{{ vcsim_instance.json.password }}"
validate_certs: no
cluster_name: "{{ ccr1 }}"
rules:
- name: vvold
enabled: True
register: all_hosts_result
- debug: msg="{{ all_hosts_result }}"
- name: ensure everything is changed for all hosts of {{ ccr1 }}
assert:
that:
- all_hosts_result.changed
- all_hosts_result.rule_set_state is defined
- name: ensure facts are gathered for all hosts of {{ ccr1 }}
assert:
that:
- all_hosts_result.rule_set_state[item]['vvold']['current_state'] == True
- all_hosts_result.rule_set_state[item]['vvold']['desired_state'] == True
- all_hosts_result.rule_set_state[item]['vvold']['previous_state'] == False
with_items:
- DC0_C0_H0
- DC0_C0_H1
- DC0_C0_H2
- name: Disable vvold for {{ host1 }}
vmware_host_firewall_manager:
hostname: "{{ vcsim }}"
username: "{{ vcsim_instance.json.username }}"
password: "{{ vcsim_instance.json.password }}"
validate_certs: no
esxi_hostname: "{{ host1 }}"
rules:
- name: vvold
enabled: False
register: host_result
- debug: msg="{{ host_result }}"
- name: ensure vvold is disabled for {{ host1 }}
assert:
that:
- host_result.changed
- host_result.rule_set_state is defined
- name: ensure facts are gathered for {{ host1 }}
assert:
that:
- host_result.rule_set_state[item]['vvold']['current_state'] == False
- host_result.rule_set_state[item]['vvold']['desired_state'] == False
- host_result.rule_set_state[item]['vvold']['previous_state'] == True
with_items:
- "{{ host1 }}"