Initial implementation of rax_clb_ssl.
This commit is contained in:
Ash Wilson
parent
2ffd7235e5
commit
817f603b6b
1 changed files with 284 additions and 0 deletions
284
cloud/rackspace/rax_clb_ssl.py
Normal file
284
cloud/rackspace/rax_clb_ssl.py
Normal file
|
|
@ -0,0 +1,284 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
# This file is part of Ansible
|
||||||
|
#
|
||||||
|
# Ansible is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# Ansible is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
# This is a DOCUMENTATION stub specific to this module, it extends
|
||||||
|
# a documentation fragment located in ansible.utils.module_docs_fragments
|
||||||
|
DOCUMENTATION='''
|
||||||
|
module: rax_clb_ssl
|
||||||
|
short_description: Manage SSL termination for a Rackspace Cloud Load Balancer.
|
||||||
|
description:
|
||||||
|
- Set up, reconfigure, or remove SSL termination for an existing load balancer.
|
||||||
|
version_added: "1.8.2"
|
||||||
|
options:
|
||||||
|
balancer_name:
|
||||||
|
description:
|
||||||
|
- Name or ID of the load balancer on which to manage SSL termination.
|
||||||
|
required: true
|
||||||
|
state:
|
||||||
|
description:
|
||||||
|
- If set to "present", SSL termination will be added to this load balancer.
|
||||||
|
- If "absent", SSL termination will be removed instead.
|
||||||
|
choices:
|
||||||
|
- present
|
||||||
|
- absent
|
||||||
|
default: present
|
||||||
|
enabled:
|
||||||
|
description:
|
||||||
|
- If set to "false", temporarily disable SSL termination without discarding
|
||||||
|
- existing credentials.
|
||||||
|
default: true
|
||||||
|
private_key:
|
||||||
|
description:
|
||||||
|
- The private SSL key as a string in PEM format.
|
||||||
|
certificate:
|
||||||
|
description:
|
||||||
|
- The public SSL certificates as a string in PEM format.
|
||||||
|
intermediate_certificate:
|
||||||
|
description:
|
||||||
|
- One or more intermediate certificate authorities as a string in PEM
|
||||||
|
- format, concatenated into a single string.
|
||||||
|
secure_port:
|
||||||
|
description:
|
||||||
|
- The port to listen for secure traffic.
|
||||||
|
default: 443
|
||||||
|
secure_traffic_only:
|
||||||
|
description:
|
||||||
|
- If "true", the load balancer will *only* accept secure traffic.
|
||||||
|
default: false
|
||||||
|
https_redirect:
|
||||||
|
description:
|
||||||
|
- If "true", the load balancer will redirect HTTP traffic to HTTPS.
|
||||||
|
- Requires "secure_traffic_only" to be true. Incurs an implicit wait if SSL
|
||||||
|
- termination is also applied or removed.
|
||||||
|
wait:
|
||||||
|
description:
|
||||||
|
- Wait for the balancer to be in state "running" before turning.
|
||||||
|
default: false
|
||||||
|
wait_timeout:
|
||||||
|
description:
|
||||||
|
- How long before "wait" gives up, in seconds.
|
||||||
|
default: 300
|
||||||
|
author: Ash Wilson
|
||||||
|
extends_documentation_fragment: rackspace
|
||||||
|
'''
|
||||||
|
|
||||||
|
EXAMPLES = '''
|
||||||
|
- name: Enable SSL termination on a load balancer
|
||||||
|
rax_clb_ssl:
|
||||||
|
balancer_name: the_loadbalancer
|
||||||
|
state: present
|
||||||
|
private_key: "{{ lookup('file', 'credentials/server.key' ) }}"
|
||||||
|
certificate: "{{ lookup('file', 'credentials/server.crt' ) }}"
|
||||||
|
intermediate_certificate: "{{ lookup('file', 'credentials/trust-chain.crt') }}"
|
||||||
|
secure_traffic_only: true
|
||||||
|
wait: true
|
||||||
|
|
||||||
|
- name: Disable SSL termination
|
||||||
|
rax_clb_ssl:
|
||||||
|
balancer_name: "{{ registered_lb.balancer.id }}"
|
||||||
|
state: absent
|
||||||
|
wait: true
|
||||||
|
'''
|
||||||
|
|
||||||
|
from ansible.module_utils.basic import *
|
||||||
|
from ansible.module_utils.rax import *
|
||||||
|
|
||||||
|
try:
|
||||||
|
import pyrax
|
||||||
|
HAS_PYRAX = True
|
||||||
|
except ImportError:
|
||||||
|
HAS_PYRAX = False
|
||||||
|
|
||||||
|
def cloud_load_balancer_ssl(module, balancer_name, state, enabled, private_key,
|
||||||
|
certificate, intermediate_certificate, secure_port,
|
||||||
|
secure_traffic_only, https_redirect,
|
||||||
|
wait, wait_timeout):
|
||||||
|
# Validate arguments.
|
||||||
|
|
||||||
|
if not balancer_name:
|
||||||
|
module.fail_json(msg='balancer_name is required.')
|
||||||
|
|
||||||
|
if state == 'present':
|
||||||
|
if not private_key:
|
||||||
|
module.fail_json(msg="private_key must be provided.")
|
||||||
|
else:
|
||||||
|
private_key = private_key.strip()
|
||||||
|
|
||||||
|
if not certificate:
|
||||||
|
module.fail_json(msg="certificate must be provided.")
|
||||||
|
else:
|
||||||
|
certificate = certificate.strip()
|
||||||
|
|
||||||
|
if state not in ('present', 'absent'):
|
||||||
|
module.fail_json(msg="State must be either 'present' or 'absent'.")
|
||||||
|
|
||||||
|
attempts = wait_timeout / 5
|
||||||
|
|
||||||
|
# Locate the load balancer.
|
||||||
|
|
||||||
|
clb = pyrax.cloud_loadbalancers
|
||||||
|
if not clb:
|
||||||
|
module.fail_json(msg='Failed to instantiate client. This '
|
||||||
|
'typically indicates an invalid region or an '
|
||||||
|
'incorrectly capitalized region name.')
|
||||||
|
|
||||||
|
balancers = []
|
||||||
|
for balancer in clb.list():
|
||||||
|
if balancer_name == balancer.name or balancer_name == str(balancer.id):
|
||||||
|
balancers.append(balancer)
|
||||||
|
|
||||||
|
if not balancers:
|
||||||
|
module.fail_json(msg='No load balancers matched your criteria. '
|
||||||
|
'Use rax_clb to create the balancer first.')
|
||||||
|
|
||||||
|
if len(balancers) > 1:
|
||||||
|
module.fail_json(msg="%d load balancers were matched your criteria. Try"
|
||||||
|
"using the balancer's id instead." % len(balancers))
|
||||||
|
|
||||||
|
balancer = balancers[0]
|
||||||
|
existing_ssl = balancer.get_ssl_termination()
|
||||||
|
|
||||||
|
changed = False
|
||||||
|
|
||||||
|
if state == 'present':
|
||||||
|
# Apply or reconfigure SSL termination on the load balancer.
|
||||||
|
ssl_attrs = dict(
|
||||||
|
securePort=secure_port,
|
||||||
|
privatekey=private_key,
|
||||||
|
certificate=certificate,
|
||||||
|
intermediateCertificate=intermediate_certificate,
|
||||||
|
enabled=enabled,
|
||||||
|
secureTrafficOnly=secure_traffic_only
|
||||||
|
)
|
||||||
|
|
||||||
|
needs_change = False
|
||||||
|
|
||||||
|
if existing_ssl:
|
||||||
|
for ssl_attr, value in ssl_attrs.iteritems():
|
||||||
|
if ssl_attr == 'privatekey':
|
||||||
|
# The private key is not included in get_ssl_termination's
|
||||||
|
# output (as it shouldn't be). Also, if you're changing the
|
||||||
|
# private key, you'll also be changing the certificate,
|
||||||
|
# so we don't lose anything by not checking it.
|
||||||
|
continue
|
||||||
|
|
||||||
|
if value is not None and existing_ssl.get(ssl_attr) != value:
|
||||||
|
# module.fail_json(msg='Unnecessary change', attr=ssl_attr, value=value, existing=existing_ssl.get(ssl_attr))
|
||||||
|
needs_change = True
|
||||||
|
else:
|
||||||
|
needs_change = True
|
||||||
|
|
||||||
|
if needs_change:
|
||||||
|
balancer.add_ssl_termination(**ssl_attrs)
|
||||||
|
changed = True
|
||||||
|
elif state == 'absent':
|
||||||
|
# Remove SSL termination if it's already configured.
|
||||||
|
if existing_ssl:
|
||||||
|
balancer.delete_ssl_termination()
|
||||||
|
changed = True
|
||||||
|
|
||||||
|
if https_redirect is not None and balancer.httpsRedirect != https_redirect:
|
||||||
|
if changed:
|
||||||
|
# This wait is unavoidable because load balancers are immutable
|
||||||
|
# while the SSL termination changes above are being applied.
|
||||||
|
pyrax.utils.wait_for_build(balancer, interval=5, attempts=attempts)
|
||||||
|
|
||||||
|
balancer.update(httpsRedirect=https_redirect)
|
||||||
|
changed = True
|
||||||
|
|
||||||
|
if changed and wait:
|
||||||
|
pyrax.utils.wait_for_build(balancer, interval=5, attempts=attempts)
|
||||||
|
|
||||||
|
balancer.get()
|
||||||
|
new_ssl_termination = balancer.get_ssl_termination()
|
||||||
|
|
||||||
|
# Intentionally omit the private key from the module output, so you don't
|
||||||
|
# accidentally echo it with `ansible-playbook -v` or `debug`, and the
|
||||||
|
# certificate, which is just long. Convert other attributes to snake_case
|
||||||
|
# and include https_redirect at the top-level.
|
||||||
|
if new_ssl_termination:
|
||||||
|
new_ssl = dict(
|
||||||
|
enabled=new_ssl_termination['enabled'],
|
||||||
|
secure_port=new_ssl_termination['securePort'],
|
||||||
|
secure_traffic_only=new_ssl_termination['secureTrafficOnly']
|
||||||
|
)
|
||||||
|
else:
|
||||||
|
new_ssl = None
|
||||||
|
|
||||||
|
result = dict(
|
||||||
|
changed=changed,
|
||||||
|
https_redirect=balancer.httpsRedirect,
|
||||||
|
ssl_termination=new_ssl
|
||||||
|
)
|
||||||
|
success = True
|
||||||
|
|
||||||
|
if balancer.status == 'ERROR':
|
||||||
|
result['msg'] = '%s failed to build' % balancer.id
|
||||||
|
success = False
|
||||||
|
elif wait and balancer.status not in ('ACTIVE', 'ERROR'):
|
||||||
|
result['msg'] = 'Timeout waiting on %s' % balancer.id
|
||||||
|
success = False
|
||||||
|
|
||||||
|
if success:
|
||||||
|
module.exit_json(**result)
|
||||||
|
else:
|
||||||
|
module.fail_json(**result)
|
||||||
|
|
||||||
|
def main():
|
||||||
|
argument_spec = rax_argument_spec()
|
||||||
|
argument_spec.update(dict(
|
||||||
|
balancer_name=dict(type='str'),
|
||||||
|
state=dict(default='present', choices=['present', 'absent']),
|
||||||
|
enabled=dict(type='bool', default=True),
|
||||||
|
private_key=dict(),
|
||||||
|
certificate=dict(),
|
||||||
|
intermediate_certificate=dict(),
|
||||||
|
secure_port=dict(type='int', default=443),
|
||||||
|
secure_traffic_only=dict(type='bool', default=False),
|
||||||
|
https_redirect=dict(type='bool'),
|
||||||
|
wait=dict(type='bool', default=False),
|
||||||
|
wait_timeout=dict(type='int', default=300)
|
||||||
|
))
|
||||||
|
|
||||||
|
module = AnsibleModule(
|
||||||
|
argument_spec=argument_spec,
|
||||||
|
required_together=rax_required_together(),
|
||||||
|
)
|
||||||
|
|
||||||
|
if not HAS_PYRAX:
|
||||||
|
module.fail_json(msg='pyrax is required for this module.')
|
||||||
|
|
||||||
|
balancer_name = module.params.get('balancer_name')
|
||||||
|
state = module.params.get('state')
|
||||||
|
enabled = module.boolean(module.params.get('enabled'))
|
||||||
|
private_key = module.params.get('private_key')
|
||||||
|
certificate = module.params.get('certificate')
|
||||||
|
intermediate_certificate = module.params.get('intermediate_certificate')
|
||||||
|
secure_port = module.params.get('secure_port')
|
||||||
|
secure_traffic_only = module.boolean(module.params.get('secure_traffic_only'))
|
||||||
|
https_redirect = module.boolean(module.params.get('https_redirect'))
|
||||||
|
wait = module.boolean(module.params.get('wait'))
|
||||||
|
wait_timeout = module.params.get('wait_timeout')
|
||||||
|
|
||||||
|
setup_rax_module(module, pyrax)
|
||||||
|
|
||||||
|
cloud_load_balancer_ssl(
|
||||||
|
module, balancer_name, state, enabled, private_key, certificate,
|
||||||
|
intermediate_certificate, secure_port, secure_traffic_only,
|
||||||
|
https_redirect, wait, wait_timeout
|
||||||
|
)
|
||||||
|
|
||||||
|
main()
|
||||||
Loading…
Reference in a new issue