VMware: add new module : vmware_host_lockdown (#35715)

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>

lib/ansible/modules/cloud/vmware/vmware_host_lockdown.py

@@ -0,0 +1,210 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+# Copyright: (c) 2018, Abhijeet Kasurde <akasurde@redhat.com>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.1',
+    'status': ['preview'],
+    'supported_by': 'community'
+}
+
+DOCUMENTATION = r'''
+---
+module: vmware_host_lockdown
+short_description: Manage administrator permission for the local administrative account for the ESXi host
+description:
+- This module can be used to manage administrator permission for the local administrative account for the host when ESXi hostname is given.
+- All parameters and VMware objects values are case sensitive.
+- This module is destructive as administrator permission are managed using APIs used, please read options carefully and proceed.
+- Please specify C(hostname) as vCenter IP or hostname only, as lockdown operations are not possible from standalone ESXi server.
+version_added: '2.5'
+author:
+- Abhijeet Kasurde (@akasurde)
+notes:
+- Tested on vSphere 6.5
+requirements:
+- python >= 2.6
+- PyVmomi
+options:
+  cluster_name:
+    description:
+    - Name of cluster.
+    - All host systems from given cluster used to manage lockdown.
+    - Required parameter, if C(esxi_hostname) is not set.
+  esxi_hostname:
+    description:
+    - List of ESXi hostname to manage lockdown.
+    - Required parameter, if C(cluster_name) is not set.
+    - See examples for specifications.
+extends_documentation_fragment: vmware.documentation
+'''
+
+EXAMPLES = r'''
+- name: Enter host system into lockdown mode
+  vmware_host_lockdown:
+    hostname: '{{ vcenter_hostname }}'
+    username: '{{ vcenter_username }}'
+    password: '{{ vcenter_password }}'
+    esxi_hostname: '{{ esxi_hostname }}'
+    state: present
+
+- name: Exit host systems from lockdown mode
+  vmware_host_lockdown:
+    hostname: '{{ vcenter_hostname }}'
+    username: '{{ vcenter_username }}'
+    password: '{{ vcenter_password }}'
+    esxi_hostname: '{{ esxi_hostname }}'
+    state: absent
+
+- name: Enter host systems into lockdown mode
+  vmware_host_lockdown:
+    hostname: '{{ vcenter_hostname }}'
+    username: '{{ vcenter_username }}'
+    password: '{{ vcenter_password }}'
+    esxi_hostname:
+        - '{{ esxi_hostname_1 }}'
+        - '{{ esxi_hostname_2 }}'
+    state: present
+
+- name: Exit host systems from lockdown mode
+  vmware_host_lockdown:
+    hostname: '{{ vcenter_hostname }}'
+    username: '{{ vcenter_username }}'
+    password: '{{ vcenter_password }}'
+    esxi_hostname:
+        - '{{ esxi_hostname_1 }}'
+        - '{{ esxi_hostname_2 }}'
+    state: absent
+
+- name: Enter all host system from cluster into lockdown mode
+  vmware_host_lockdown:
+    hostname: '{{ vcenter_hostname }}'
+    username: '{{ vcenter_username }}'
+    password: '{{ vcenter_password }}'
+    cluster_name: '{{ cluster_name }}'
+    state: present
+'''
+
+RETURN = r'''
+results:
+    description: metadata about state of Host system lock down
+    returned: always
+    type: dict
+    sample: {
+                "host_lockdown_state": {
+                    "DC0_C0": {
+                        "current_state": "present",
+                        "previous_state": "absent",
+                        "desired_state": "present",
+                    },
+                }
+            }
+'''
+
+try:
+    from pyvmomi import vim, vmodl
+except ImportError:
+    pass
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.vmware import vmware_argument_spec, PyVmomi
+from ansible.module_utils._text import to_native
+
+
+class VmwareLockdownManager(PyVmomi):
+    def __init__(self, module):
+        super(VmwareLockdownManager, self).__init__(module)
+        if not self.is_vcenter():
+            self.module.fail_json(msg="Lockdown operations are performed from vCenter only. "
+                                      "hostname %s is an ESXi server. Please specify hostname "
+                                      "as vCenter server." % self.module.params['hostname'])
+        cluster_name = self.params.get('cluster_name', None)
+        esxi_host_name = self.params.get('esxi_hostname', None)
+        self.hosts = []
+        if cluster_name:
+            cluster_obj = self.find_cluster_by_name(cluster_name=cluster_name)
+            if cluster_obj:
+                self.hosts = [host for host in cluster_obj.host]
+            else:
+                module.fail_json(changed=False, msg="Cluster '%s' not found" % cluster_name)
+        elif esxi_host_name:
+            for host in esxi_host_name:
+                esxi_host_obj = self.find_hostsystem_by_name(host_name=host)
+                if esxi_host_obj:
+                    self.hosts.append(esxi_host_obj)
+                else:
+                    module.fail_json(changed=False, msg="ESXi '%s' not found" % host)
+
+    def ensure(self):
+        """
+        Function to manage internal state management
+        """
+        results = dict(changed=False, host_lockdown_state=dict())
+        change_list = []
+        for host in self.hosts:
+            desired_state = self.params.get('state')
+            results['host_lockdown_state'][host.name] = dict(current_state='',
+                                                             desired_state=desired_state,
+                                                             previous_state=''
+                                                             )
+            changed = False
+            try:
+                if host.config.adminDisabled:
+                    results['host_lockdown_state'][host.name]['previous_state'] = 'present'
+                    if desired_state == 'absent':
+                        host.ExitLockdownMode()
+                        results['host_lockdown_state'][host.name]['current_state'] = 'absent'
+                        changed = True
+                    else:
+                        results['host_lockdown_state'][host.name]['current_state'] = 'present'
+                elif not host.config.adminDisabled:
+                    results['host_lockdown_state'][host.name]['previous_state'] = 'absent'
+                    if desired_state == 'present':
+                        host.EnterLockdownMode()
+                        results['host_lockdown_state'][host.name]['current_state'] = 'present'
+                        changed = True
+                    else:
+                        results['host_lockdown_state'][host.name]['current_state'] = 'absent'
+            except vim.fault.HostConfigFault as host_config_fault:
+                self.module.fail_json(msg="Failed to manage lockdown mode for esxi"
+                                          " hostname %s : %s" % (host.name, to_native(host_config_fault.msg)))
+            except vim.fault.AdminDisabled as admin_disabled:
+                self.module.fail_json(msg="Failed to manage lockdown mode as administrator "
+                                          "permission has been disabled for "
+                                          "esxi hostname %s : %s" % (host.name, to_native(admin_disabled.msg)))
+            except Exception as generic_exception:
+                self.module.fail_json(msg="Failed to manage lockdown mode due to generic exception for esxi "
+                                          "hostname %s : %s" % (host.name, to_native(generic_exception)))
+            change_list.append(changed)
+
+        if any(change_list):
+            results['changed'] = True
+
+        self.module.exit_json(**results)
+
+
+def main():
+    argument_spec = vmware_argument_spec()
+    argument_spec.update(
+        cluster_name=dict(type='str', required=False),
+        esxi_hostname=dict(type='str', required=False),
+    )
+
+    module = AnsibleModule(
+        argument_spec=argument_spec,
+        required_one_of=[
+            ['cluster_name', 'esxi_hostname'],
+        ]
+    )
+
+    vmware_lockdown_mgr = VmwareLockdownManager(module)
+    vmware_lockdown_mgr.ensure()
+
+
+if __name__ == "__main__":
+    main()