VMware: add new module vmware_host_firewall_facts (#35467)
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
This commit is contained in:
parent
68de5791a3
commit
8428f13bc1
3 changed files with 255 additions and 0 deletions
lib/ansible/modules/cloud/vmware
test/integration/targets/vmware_host_firewall_facts
164
lib/ansible/modules/cloud/vmware/vmware_host_firewall_facts.py
Normal file
164
lib/ansible/modules/cloud/vmware/vmware_host_firewall_facts.py
Normal file
|
@ -0,0 +1,164 @@
|
|||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
# Copyright: (c) 2018, Abhijeet Kasurde <akasurde@redhat.com>
|
||||
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
__metaclass__ = type
|
||||
|
||||
|
||||
ANSIBLE_METADATA = {
|
||||
'metadata_version': '1.1',
|
||||
'status': ['preview'],
|
||||
'supported_by': 'community'
|
||||
}
|
||||
|
||||
DOCUMENTATION = r'''
|
||||
---
|
||||
module: vmware_host_firewall_facts
|
||||
short_description: Gathers facts about an ESXi host's firewall configuration information
|
||||
description:
|
||||
- This module can be used to gather facts about an ESXi host's firewall configuration information when ESXi hostname or Cluster name is given.
|
||||
version_added: '2.5'
|
||||
author:
|
||||
- Abhijeet Kasurde (@akasurde)
|
||||
notes:
|
||||
- Tested on vSphere 6.5
|
||||
requirements:
|
||||
- python >= 2.6
|
||||
- PyVmomi
|
||||
options:
|
||||
cluster_name:
|
||||
description:
|
||||
- Name of the cluster from which the ESXi host belong to.
|
||||
- If C(esxi_hostname) is not given, this parameter is required.
|
||||
esxi_hostname:
|
||||
description:
|
||||
- ESXi hostname to gather facts from.
|
||||
- If C(cluster_name) is not given, this parameter is required.
|
||||
extends_documentation_fragment: vmware.documentation
|
||||
'''
|
||||
|
||||
EXAMPLES = r'''
|
||||
- name: Gather firewall facts about all ESXi Host in given Cluster
|
||||
vmware_host_firewall_facts:
|
||||
hostname: '{{ vcenter_hostname }}'
|
||||
username: '{{ vcenter_username }}'
|
||||
password: '{{ vcenter_password }}'
|
||||
cluster_name: cluster_name
|
||||
|
||||
- name: Gather firewall facts about ESXi Host
|
||||
vmware_host_firewall_facts:
|
||||
hostname: '{{ vcenter_hostname }}'
|
||||
username: '{{ vcenter_username }}'
|
||||
password: '{{ vcenter_password }}'
|
||||
esxi_hostname: '{{ esxi_hostname }}'
|
||||
'''
|
||||
|
||||
RETURN = r'''
|
||||
hosts_firewall_facts:
|
||||
description: metadata about host's firewall configuration
|
||||
returned: on success
|
||||
type: dict
|
||||
sample: {
|
||||
"esxi_hostname_0001": [
|
||||
{
|
||||
"allowed_hosts": {
|
||||
"all_ip": true,
|
||||
"ip_address": []
|
||||
},
|
||||
"enabled": true,
|
||||
"key": "CIMHttpServer",
|
||||
"rule": [
|
||||
{
|
||||
"direction": "inbound",
|
||||
"end_port": null,
|
||||
"port": 5988,
|
||||
"port_type": "dst",
|
||||
"protocol": "tcp"
|
||||
}
|
||||
],
|
||||
"service": "sfcbd-watchdog"
|
||||
},
|
||||
]
|
||||
}
|
||||
'''
|
||||
|
||||
from ansible.module_utils.basic import AnsibleModule
|
||||
from ansible.module_utils.vmware import vmware_argument_spec, PyVmomi
|
||||
|
||||
|
||||
class FirewallFactsManager(PyVmomi):
|
||||
def __init__(self, module):
|
||||
super(FirewallFactsManager, self).__init__(module)
|
||||
cluster_name = self.params.get('cluster_name', None)
|
||||
esxi_host_name = self.params.get('esxi_hostname', None)
|
||||
self.hosts = []
|
||||
if cluster_name:
|
||||
cluster_obj = self.find_cluster_by_name(cluster_name=cluster_name)
|
||||
if cluster_obj:
|
||||
self.hosts = [host for host in cluster_obj.host]
|
||||
else:
|
||||
module.fail_json(changed=False, msg="Cluster '%s' not found" % cluster_name)
|
||||
elif esxi_host_name:
|
||||
esxi_host_obj = self.find_hostsystem_by_name(host_name=esxi_host_name)
|
||||
if esxi_host_obj:
|
||||
self.hosts = [esxi_host_obj]
|
||||
else:
|
||||
module.fail_json(changed=False, msg="ESXi '%s' not found" % esxi_host_name)
|
||||
|
||||
@staticmethod
|
||||
def normalize_rule_set(rule_obj):
|
||||
rule_dict = dict()
|
||||
rule_dict['key'] = rule_obj.key
|
||||
rule_dict['service'] = rule_obj.service
|
||||
rule_dict['enabled'] = rule_obj.enabled
|
||||
rule_dict['rule'] = []
|
||||
|
||||
for rule in rule_obj.rule:
|
||||
rule_set_dict = dict()
|
||||
rule_set_dict['port'] = rule.port
|
||||
rule_set_dict['end_port'] = rule.endPort
|
||||
rule_set_dict['direction'] = rule.direction
|
||||
rule_set_dict['port_type'] = rule.portType
|
||||
rule_set_dict['protocol'] = rule.protocol
|
||||
rule_dict['rule'].append(rule_set_dict)
|
||||
|
||||
allowed_host = rule_obj.allowedHosts
|
||||
rule_allow_host = dict()
|
||||
rule_allow_host['ip_address'] = [ip for ip in allowed_host.ipAddress]
|
||||
rule_allow_host['all_ip'] = allowed_host.allIp
|
||||
rule_dict['allowed_hosts'] = rule_allow_host
|
||||
return rule_dict
|
||||
|
||||
def gather_host_firewall_facts(self):
|
||||
hosts_firewall_facts = dict()
|
||||
for host in self.hosts:
|
||||
firewall_system = host.configManager.firewallSystem
|
||||
if firewall_system:
|
||||
hosts_firewall_facts[host.name] = []
|
||||
for rule_set_obj in firewall_system.firewallInfo.ruleset:
|
||||
hosts_firewall_facts[host.name].append(self.normalize_rule_set(rule_obj=rule_set_obj))
|
||||
return hosts_firewall_facts
|
||||
|
||||
|
||||
def main():
|
||||
argument_spec = vmware_argument_spec()
|
||||
argument_spec.update(
|
||||
cluster_name=dict(type='str', required=False),
|
||||
esxi_hostname=dict(type='str', required=False),
|
||||
)
|
||||
|
||||
module = AnsibleModule(
|
||||
argument_spec=argument_spec,
|
||||
required_one_of=[
|
||||
['cluster_name', 'esxi_hostname'],
|
||||
]
|
||||
)
|
||||
|
||||
vmware_host_firewall = FirewallFactsManager(module)
|
||||
module.exit_json(changed=False, hosts_firewall_facts=vmware_host_firewall.gather_host_firewall_facts())
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
|
@ -0,0 +1,3 @@
|
|||
posix/ci/cloud/group4/vcenter
|
||||
cloud/vcenter
|
||||
|
|
@ -0,0 +1,88 @@
|
|||
# Test code for the vmware_host_firewall_facts module.
|
||||
# Copyright: (c) 2018, Abhijeet Kasurde <akasurde@redhat.com>
|
||||
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
|
||||
- name: make sure pyvmomi is installed
|
||||
pip:
|
||||
name: pyvmomi
|
||||
state: latest
|
||||
when: "{{ ansible_user_id == 'root' }}"
|
||||
|
||||
- name: store the vcenter container ip
|
||||
set_fact:
|
||||
vcsim: "{{ lookup('env', 'vcenter_host') }}"
|
||||
|
||||
- debug: var=vcsim
|
||||
|
||||
- name: Wait for Flask controller to come up online
|
||||
wait_for:
|
||||
host: "{{ vcsim }}"
|
||||
port: 5000
|
||||
state: started
|
||||
|
||||
- name: kill vcsim
|
||||
uri:
|
||||
url: http://{{ vcsim }}:5000/killall
|
||||
|
||||
- name: start vcsim
|
||||
uri:
|
||||
url: http://{{ vcsim }}:5000/spawn?cluster=2
|
||||
register: vcsim_instance
|
||||
|
||||
- debug:
|
||||
var: vcsim_instance
|
||||
|
||||
- name: Wait for vcsim server to come up online
|
||||
wait_for:
|
||||
host: "{{ vcsim }}"
|
||||
port: 443
|
||||
state: started
|
||||
|
||||
- name: get a list of Cluster from vcsim
|
||||
uri:
|
||||
url: http://{{ vcsim }}:5000/govc_find?filter=CCR
|
||||
register: clusters
|
||||
|
||||
- name: get a cluster
|
||||
set_fact:
|
||||
ccr1: "{{ clusters.json[0] | basename }}"
|
||||
|
||||
- name: get a list of hosts from vcsim
|
||||
uri:
|
||||
url: http://{{ vcsim }}:5000/govc_find?filter=H
|
||||
register: hosts
|
||||
|
||||
- name: get a host
|
||||
set_fact:
|
||||
host1: "{{ hosts.json[0] | basename }}"
|
||||
|
||||
- debug: var=ccr1
|
||||
- debug: var=host1
|
||||
|
||||
- name: Gather firewall facts for all ESXi host from given cluster
|
||||
vmware_host_firewall_facts:
|
||||
hostname: "{{ vcsim }}"
|
||||
username: "{{ vcsim_instance.json.username }}"
|
||||
password: "{{ vcsim_instance.json.password }}"
|
||||
validate_certs: no
|
||||
cluster_name: "{{ ccr1 }}"
|
||||
register: firewall_0001_results
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "not firewall_0001_results.changed"
|
||||
- "firewall_0001_results.hosts_firewall_facts is defined"
|
||||
|
||||
- name: Gather firewall facts for ESXi host
|
||||
vmware_host_firewall_facts:
|
||||
hostname: "{{ vcsim }}"
|
||||
username: "{{ vcsim_instance.json.username }}"
|
||||
password: "{{ vcsim_instance.json.password }}"
|
||||
validate_certs: no
|
||||
esxi_hostname: "{{ host1 }}"
|
||||
register: firewall_0002_results
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "not firewall_0002_results.changed"
|
||||
- "firewall_0002_results.hosts_firewall_facts is defined"
|
Loading…
Reference in a new issue