diff --git a/lib/ansible/modules/cloud/vmware/vmware_host_lockdown.py b/lib/ansible/modules/cloud/vmware/vmware_host_lockdown.py new file mode 100644 index 0000000000..a3166a8fde --- /dev/null +++ b/lib/ansible/modules/cloud/vmware/vmware_host_lockdown.py @@ -0,0 +1,210 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# Copyright: (c) 2018, Abhijeet Kasurde +# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + + +ANSIBLE_METADATA = { + 'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community' +} + +DOCUMENTATION = r''' +--- +module: vmware_host_lockdown +short_description: Manage administrator permission for the local administrative account for the ESXi host +description: +- This module can be used to manage administrator permission for the local administrative account for the host when ESXi hostname is given. +- All parameters and VMware objects values are case sensitive. +- This module is destructive as administrator permission are managed using APIs used, please read options carefully and proceed. +- Please specify C(hostname) as vCenter IP or hostname only, as lockdown operations are not possible from standalone ESXi server. +version_added: '2.5' +author: +- Abhijeet Kasurde (@akasurde) +notes: +- Tested on vSphere 6.5 +requirements: +- python >= 2.6 +- PyVmomi +options: + cluster_name: + description: + - Name of cluster. + - All host systems from given cluster used to manage lockdown. + - Required parameter, if C(esxi_hostname) is not set. + esxi_hostname: + description: + - List of ESXi hostname to manage lockdown. + - Required parameter, if C(cluster_name) is not set. + - See examples for specifications. +extends_documentation_fragment: vmware.documentation +''' + +EXAMPLES = r''' +- name: Enter host system into lockdown mode + vmware_host_lockdown: + hostname: '{{ vcenter_hostname }}' + username: '{{ vcenter_username }}' + password: '{{ vcenter_password }}' + esxi_hostname: '{{ esxi_hostname }}' + state: present + +- name: Exit host systems from lockdown mode + vmware_host_lockdown: + hostname: '{{ vcenter_hostname }}' + username: '{{ vcenter_username }}' + password: '{{ vcenter_password }}' + esxi_hostname: '{{ esxi_hostname }}' + state: absent + +- name: Enter host systems into lockdown mode + vmware_host_lockdown: + hostname: '{{ vcenter_hostname }}' + username: '{{ vcenter_username }}' + password: '{{ vcenter_password }}' + esxi_hostname: + - '{{ esxi_hostname_1 }}' + - '{{ esxi_hostname_2 }}' + state: present + +- name: Exit host systems from lockdown mode + vmware_host_lockdown: + hostname: '{{ vcenter_hostname }}' + username: '{{ vcenter_username }}' + password: '{{ vcenter_password }}' + esxi_hostname: + - '{{ esxi_hostname_1 }}' + - '{{ esxi_hostname_2 }}' + state: absent + +- name: Enter all host system from cluster into lockdown mode + vmware_host_lockdown: + hostname: '{{ vcenter_hostname }}' + username: '{{ vcenter_username }}' + password: '{{ vcenter_password }}' + cluster_name: '{{ cluster_name }}' + state: present +''' + +RETURN = r''' +results: + description: metadata about state of Host system lock down + returned: always + type: dict + sample: { + "host_lockdown_state": { + "DC0_C0": { + "current_state": "present", + "previous_state": "absent", + "desired_state": "present", + }, + } + } +''' + +try: + from pyvmomi import vim, vmodl +except ImportError: + pass + +from ansible.module_utils.basic import AnsibleModule +from ansible.module_utils.vmware import vmware_argument_spec, PyVmomi +from ansible.module_utils._text import to_native + + +class VmwareLockdownManager(PyVmomi): + def __init__(self, module): + super(VmwareLockdownManager, self).__init__(module) + if not self.is_vcenter(): + self.module.fail_json(msg="Lockdown operations are performed from vCenter only. " + "hostname %s is an ESXi server. Please specify hostname " + "as vCenter server." % self.module.params['hostname']) + cluster_name = self.params.get('cluster_name', None) + esxi_host_name = self.params.get('esxi_hostname', None) + self.hosts = [] + if cluster_name: + cluster_obj = self.find_cluster_by_name(cluster_name=cluster_name) + if cluster_obj: + self.hosts = [host for host in cluster_obj.host] + else: + module.fail_json(changed=False, msg="Cluster '%s' not found" % cluster_name) + elif esxi_host_name: + for host in esxi_host_name: + esxi_host_obj = self.find_hostsystem_by_name(host_name=host) + if esxi_host_obj: + self.hosts.append(esxi_host_obj) + else: + module.fail_json(changed=False, msg="ESXi '%s' not found" % host) + + def ensure(self): + """ + Function to manage internal state management + """ + results = dict(changed=False, host_lockdown_state=dict()) + change_list = [] + for host in self.hosts: + desired_state = self.params.get('state') + results['host_lockdown_state'][host.name] = dict(current_state='', + desired_state=desired_state, + previous_state='' + ) + changed = False + try: + if host.config.adminDisabled: + results['host_lockdown_state'][host.name]['previous_state'] = 'present' + if desired_state == 'absent': + host.ExitLockdownMode() + results['host_lockdown_state'][host.name]['current_state'] = 'absent' + changed = True + else: + results['host_lockdown_state'][host.name]['current_state'] = 'present' + elif not host.config.adminDisabled: + results['host_lockdown_state'][host.name]['previous_state'] = 'absent' + if desired_state == 'present': + host.EnterLockdownMode() + results['host_lockdown_state'][host.name]['current_state'] = 'present' + changed = True + else: + results['host_lockdown_state'][host.name]['current_state'] = 'absent' + except vim.fault.HostConfigFault as host_config_fault: + self.module.fail_json(msg="Failed to manage lockdown mode for esxi" + " hostname %s : %s" % (host.name, to_native(host_config_fault.msg))) + except vim.fault.AdminDisabled as admin_disabled: + self.module.fail_json(msg="Failed to manage lockdown mode as administrator " + "permission has been disabled for " + "esxi hostname %s : %s" % (host.name, to_native(admin_disabled.msg))) + except Exception as generic_exception: + self.module.fail_json(msg="Failed to manage lockdown mode due to generic exception for esxi " + "hostname %s : %s" % (host.name, to_native(generic_exception))) + change_list.append(changed) + + if any(change_list): + results['changed'] = True + + self.module.exit_json(**results) + + +def main(): + argument_spec = vmware_argument_spec() + argument_spec.update( + cluster_name=dict(type='str', required=False), + esxi_hostname=dict(type='str', required=False), + ) + + module = AnsibleModule( + argument_spec=argument_spec, + required_one_of=[ + ['cluster_name', 'esxi_hostname'], + ] + ) + + vmware_lockdown_mgr = VmwareLockdownManager(module) + vmware_lockdown_mgr.ensure() + + +if __name__ == "__main__": + main()