VMware: add new module vmware_host_firewall_facts (#35467)

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
This commit is contained in:
Abhijeet Kasurde 2018-02-05 22:24:28 +05:30 committed by GitHub
parent 68de5791a3
commit 8428f13bc1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 255 additions and 0 deletions

View file

@ -0,0 +1,164 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Copyright: (c) 2018, Abhijeet Kasurde <akasurde@redhat.com>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
from __future__ import absolute_import, division, print_function
__metaclass__ = type
ANSIBLE_METADATA = {
'metadata_version': '1.1',
'status': ['preview'],
'supported_by': 'community'
}
DOCUMENTATION = r'''
---
module: vmware_host_firewall_facts
short_description: Gathers facts about an ESXi host's firewall configuration information
description:
- This module can be used to gather facts about an ESXi host's firewall configuration information when ESXi hostname or Cluster name is given.
version_added: '2.5'
author:
- Abhijeet Kasurde (@akasurde)
notes:
- Tested on vSphere 6.5
requirements:
- python >= 2.6
- PyVmomi
options:
cluster_name:
description:
- Name of the cluster from which the ESXi host belong to.
- If C(esxi_hostname) is not given, this parameter is required.
esxi_hostname:
description:
- ESXi hostname to gather facts from.
- If C(cluster_name) is not given, this parameter is required.
extends_documentation_fragment: vmware.documentation
'''
EXAMPLES = r'''
- name: Gather firewall facts about all ESXi Host in given Cluster
vmware_host_firewall_facts:
hostname: '{{ vcenter_hostname }}'
username: '{{ vcenter_username }}'
password: '{{ vcenter_password }}'
cluster_name: cluster_name
- name: Gather firewall facts about ESXi Host
vmware_host_firewall_facts:
hostname: '{{ vcenter_hostname }}'
username: '{{ vcenter_username }}'
password: '{{ vcenter_password }}'
esxi_hostname: '{{ esxi_hostname }}'
'''
RETURN = r'''
hosts_firewall_facts:
description: metadata about host's firewall configuration
returned: on success
type: dict
sample: {
"esxi_hostname_0001": [
{
"allowed_hosts": {
"all_ip": true,
"ip_address": []
},
"enabled": true,
"key": "CIMHttpServer",
"rule": [
{
"direction": "inbound",
"end_port": null,
"port": 5988,
"port_type": "dst",
"protocol": "tcp"
}
],
"service": "sfcbd-watchdog"
},
]
}
'''
from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.vmware import vmware_argument_spec, PyVmomi
class FirewallFactsManager(PyVmomi):
def __init__(self, module):
super(FirewallFactsManager, self).__init__(module)
cluster_name = self.params.get('cluster_name', None)
esxi_host_name = self.params.get('esxi_hostname', None)
self.hosts = []
if cluster_name:
cluster_obj = self.find_cluster_by_name(cluster_name=cluster_name)
if cluster_obj:
self.hosts = [host for host in cluster_obj.host]
else:
module.fail_json(changed=False, msg="Cluster '%s' not found" % cluster_name)
elif esxi_host_name:
esxi_host_obj = self.find_hostsystem_by_name(host_name=esxi_host_name)
if esxi_host_obj:
self.hosts = [esxi_host_obj]
else:
module.fail_json(changed=False, msg="ESXi '%s' not found" % esxi_host_name)
@staticmethod
def normalize_rule_set(rule_obj):
rule_dict = dict()
rule_dict['key'] = rule_obj.key
rule_dict['service'] = rule_obj.service
rule_dict['enabled'] = rule_obj.enabled
rule_dict['rule'] = []
for rule in rule_obj.rule:
rule_set_dict = dict()
rule_set_dict['port'] = rule.port
rule_set_dict['end_port'] = rule.endPort
rule_set_dict['direction'] = rule.direction
rule_set_dict['port_type'] = rule.portType
rule_set_dict['protocol'] = rule.protocol
rule_dict['rule'].append(rule_set_dict)
allowed_host = rule_obj.allowedHosts
rule_allow_host = dict()
rule_allow_host['ip_address'] = [ip for ip in allowed_host.ipAddress]
rule_allow_host['all_ip'] = allowed_host.allIp
rule_dict['allowed_hosts'] = rule_allow_host
return rule_dict
def gather_host_firewall_facts(self):
hosts_firewall_facts = dict()
for host in self.hosts:
firewall_system = host.configManager.firewallSystem
if firewall_system:
hosts_firewall_facts[host.name] = []
for rule_set_obj in firewall_system.firewallInfo.ruleset:
hosts_firewall_facts[host.name].append(self.normalize_rule_set(rule_obj=rule_set_obj))
return hosts_firewall_facts
def main():
argument_spec = vmware_argument_spec()
argument_spec.update(
cluster_name=dict(type='str', required=False),
esxi_hostname=dict(type='str', required=False),
)
module = AnsibleModule(
argument_spec=argument_spec,
required_one_of=[
['cluster_name', 'esxi_hostname'],
]
)
vmware_host_firewall = FirewallFactsManager(module)
module.exit_json(changed=False, hosts_firewall_facts=vmware_host_firewall.gather_host_firewall_facts())
if __name__ == "__main__":
main()

View file

@ -0,0 +1,3 @@
posix/ci/cloud/group4/vcenter
cloud/vcenter

View file

@ -0,0 +1,88 @@
# Test code for the vmware_host_firewall_facts module.
# Copyright: (c) 2018, Abhijeet Kasurde <akasurde@redhat.com>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
- name: make sure pyvmomi is installed
pip:
name: pyvmomi
state: latest
when: "{{ ansible_user_id == 'root' }}"
- name: store the vcenter container ip
set_fact:
vcsim: "{{ lookup('env', 'vcenter_host') }}"
- debug: var=vcsim
- name: Wait for Flask controller to come up online
wait_for:
host: "{{ vcsim }}"
port: 5000
state: started
- name: kill vcsim
uri:
url: http://{{ vcsim }}:5000/killall
- name: start vcsim
uri:
url: http://{{ vcsim }}:5000/spawn?cluster=2
register: vcsim_instance
- debug:
var: vcsim_instance
- name: Wait for vcsim server to come up online
wait_for:
host: "{{ vcsim }}"
port: 443
state: started
- name: get a list of Cluster from vcsim
uri:
url: http://{{ vcsim }}:5000/govc_find?filter=CCR
register: clusters
- name: get a cluster
set_fact:
ccr1: "{{ clusters.json[0] | basename }}"
- name: get a list of hosts from vcsim
uri:
url: http://{{ vcsim }}:5000/govc_find?filter=H
register: hosts
- name: get a host
set_fact:
host1: "{{ hosts.json[0] | basename }}"
- debug: var=ccr1
- debug: var=host1
- name: Gather firewall facts for all ESXi host from given cluster
vmware_host_firewall_facts:
hostname: "{{ vcsim }}"
username: "{{ vcsim_instance.json.username }}"
password: "{{ vcsim_instance.json.password }}"
validate_certs: no
cluster_name: "{{ ccr1 }}"
register: firewall_0001_results
- assert:
that:
- "not firewall_0001_results.changed"
- "firewall_0001_results.hosts_firewall_facts is defined"
- name: Gather firewall facts for ESXi host
vmware_host_firewall_facts:
hostname: "{{ vcsim }}"
username: "{{ vcsim_instance.json.username }}"
password: "{{ vcsim_instance.json.password }}"
validate_certs: no
esxi_hostname: "{{ host1 }}"
register: firewall_0002_results
- assert:
that:
- "not firewall_0002_results.changed"
- "firewall_0002_results.hosts_firewall_facts is defined"