archive
/
ansible
mirror of https://github.com/ansible/ansible.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

postgresql_user: fix doc formatting, added return value, aliases, misc code changes (#54768)

Browse Source 
* postgresql_user: refactoring

* postgresql_user: removed line from ignore.txt

* postgresql_user: removed lines from ignore.txt

* postgresql_user: removed lines from ignore.txt, fixes

* postgresql_user: removed lines from ignore.txt, fixes

* postgresql_user: removed lines from ignore.txt, fixes
pull/54899/head
Andrey Klychkov 6 years ago committed by John R Barker
parent d16452bc8f
commit 3eff72e886
6 changed files with 195 additions and 160 deletions
Show Stats Download Patch File Download Diff File

16
lib/ansible/modules/database/postgresql/postgresql_ext.py
Unescape Escape View File

@ -24,6 +24,8 @@ options:
- Name of the extension to add or remove.
required: true
type: str
aliases:
- ext
db:
description:
- Name of the database to add or remove the extension to/from.
@ -40,6 +42,7 @@ options:
description:
- The username used to authenticate with.
type: str
default: postgres
login_password:
description:
- The password used to authenticate with.
@ -48,7 +51,6 @@ options:
description:
- Host running the database.
type: str
default: localhost
login_unix_socket:
description:
- Path to a Unix domain socket for local connections.
@ -70,7 +72,7 @@ options:
- Specifies the name of a file containing SSL certificate authority (CA)
certificate(s). If the file exists, the server's certificate will be
verified to be signed by one of these authorities.
type: path
type: str
version_added: '2.8'
aliases: [ ssl_rootcert ]
port:
@ -78,6 +80,8 @@ options:
- Database port to connect to.
default: 5432
type: int
aliases:
- login_port
session_role:
description:
- Switch to session_role after connecting.
@ -219,14 +223,10 @@ def main():
argument_spec = postgres_common_argument_spec()
argument_spec.update(
db=dict(type="str", required=True, aliases=["login_db"]),
port=dict(type="int", default=5432, aliases=["login_port"]),
ext=dict(type="str", required=True, aliases=['name']),
ext=dict(type="str", required=True, aliases=["name"]),
schema=dict(type="str"),
state=dict(type="str", default="present", choices=["absent", "present"]),
cascade=dict(type='bool', default=False),
ssl_mode=dict(type='str', default='prefer', choices=[
'disable', 'allow', 'prefer', 'require', 'verify-ca', 'verify-full']),
ca_cert=dict(type="path", default=None, aliases=['ssl_rootcert']),
cascade=dict(type="bool", default=False),
session_role=dict(type="str"),
)

5
lib/ansible/modules/database/postgresql/postgresql_lang.py
Unescape Escape View File

@ -93,7 +93,6 @@ options:
description:
- Host running PostgreSQL where you want to execute the actions.
type: str
default: localhost
session_role:
version_added: '2.8'
description:
@ -267,16 +266,12 @@ def main():
argument_spec = postgres_common_argument_spec()
argument_spec.update(
db=dict(type="str", required=True, aliases=["login_db"]),
port=dict(type="int", default=5432, aliases=["login_port"]),
lang=dict(type="str", required=True, aliases=["name"]),
state=dict(type="str", default="present", choices=["absent", "present"]),
trust=dict(type="bool", default="no"),
force_trust=dict(type="bool", default="no"),
cascade=dict(type="bool", default="no"),
fail_on_drop=dict(type="bool", default="yes"),
ssl_mode=dict(default='prefer', choices=[
'allow', 'disable', 'prefer', 'require', 'verify-ca', 'verify-full']),
ca_cert=dict(default=None, aliases=["ssl_rootcert"]),
session_role=dict(type="str"),
)

4
lib/ansible/modules/database/postgresql/postgresql_schema.py
Unescape Escape View File

@ -24,6 +24,8 @@ options:
- Name of the schema to add or remove.
required: true
type: str
aliases:
- schema
database:
description:
- Name of the database to connect to and add or remove the schema.
@ -36,6 +38,7 @@ options:
description:
- The username used to authenticate with.
type: str
default: postgres
login_password:
description:
- The password used to authenticate with.
@ -44,7 +47,6 @@ options:
description:
- Host running the database.
type: str
default: localhost
login_unix_socket:
description:
- Path to a Unix domain socket for local connections.

187
lib/ansible/modules/database/postgresql/postgresql_user.py
Unescape Escape View File

@ -1,28 +1,28 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Copyright: Ansible Project
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
from __future__ import absolute_import, division, print_function
__metaclass__ = type
ANSIBLE_METADATA = {
'metadata_version': '1.1',
'status': ['stableinterface'],
'supported_by': 'community'
}
DOCUMENTATION = '''
DOCUMENTATION = r'''
---
module: postgresql_user
short_description: Adds or removes a user (role) from a remote PostgreSQL server instance.
short_description: Add or remove a user (role) from a PostgreSQL server instance
description:
- Adds or removes a user (role) from a remote PostgreSQL server instance
- Adds or removes a user (role) from a PostgreSQL server instance
("cluster" in PostgreSQL terminology) and, optionally,
grants the user access to an existing database or tables.
A user is a role with login privilege (see U(https://www.postgresql.org/docs/11/role-attributes.html) for more information).
A user is a role with login privilege
(see U(https://www.postgresql.org/docs/11/role-attributes.html) for more information).
- The fundamental function of the module is to create, or delete, users from
a PostgreSQL instances. Privilege assignment, or removal, is an optional
step, which works on one database at a time. This allows for the module to
@ -34,12 +34,15 @@ description:
the module to try to remove the user, but if not possible keep going; the
module will report if changes happened and separately if the user was
removed or not.
version_added: "0.6"
version_added: '0.6'
options:
name:
description:
- Name of the user (role) to add or remove.
type: str
required: true
aliases:
- user
password:
description:
- Set the user's password, before 1.4 this was required.
@ -53,33 +56,44 @@ options:
'verysecretpasswordJOE' | md5sum | awk '{print $1}')").
- Note that if the provided password string is already in MD5-hashed
format, then it is used as-is, regardless of C(encrypted) parameter.
type: str
db:
description:
- Name of database to connect to and where user's permissions will be granted.
type: str
aliases:
- login_db
fail_on_user:
description:
- If C(yes), fail when user (role) can't be removed. Otherwise just log and
continue.
- If C(yes), fail when user (role) can't be removed. Otherwise just log and continue.
default: 'yes'
type: bool
aliases:
- fail_on_role
port:
description:
- Database port to connect to.
type: int
default: 5432
aliases:
- login_port
login_user:
description:
- User (role) used to authenticate with PostgreSQL.
type: str
default: postgres
login_password:
description:
- Password used to authenticate with PostgreSQL.
- Password for U(login_user) used to authenticate with PostgreSQL.
type: str
login_host:
description:
- Host running PostgreSQL.
default: localhost
type: str
login_unix_socket:
description:
- Path to a Unix domain socket for local connections.
type: str
priv:
description:
- "Slash-separated PostgreSQL privileges string: C(priv1/priv2), where
@ -89,26 +103,33 @@ options:
'TRUNCATE', 'REFERENCES', 'TRIGGER', 'ALL'. For example
C(table:SELECT) ). Mixed example of this string:
C(CONNECT/CREATE/table1:SELECT/table2:INSERT)."
type: str
role_attr_flags:
description:
- "PostgreSQL user attributes string in the format: CREATEDB,CREATEROLE,SUPERUSER."
- Note that '[NO]CREATEUSER' is deprecated.
choices: ["[NO]SUPERUSER", "[NO]CREATEROLE", "[NO]CREATEDB", "[NO]INHERIT", "[NO]LOGIN", "[NO]REPLICATION", "[NO]BYPASSRLS"]
- To create a simple role for using it like a group, use C(NOLOGIN) flag.
type: str
choices: [ '[NO]SUPERUSER', '[NO]CREATEROLE', '[NO]CREATEDB',
'[NO]INHERIT', '[NO]LOGIN', '[NO]REPLICATION', '[NO]BYPASSRLS' ]
session_role:
version_added: "2.8"
description: |
Switch to session_role after connecting. The specified session_role must be a role that the current login_user is a member of.
Permissions checking for SQL commands is carried out as though the session_role were the one that had logged in originally.
version_added: '2.8'
description:
- Switch to session_role after connecting.
- The specified session_role must be a role that the current login_user is a member of.
- Permissions checking for SQL commands is carried out as though the session_role were the one that had logged in originally.
type: str
state:
description:
- The user (role) state.
type: str
default: present
choices: ["present", "absent"]
choices: [ absent, present ]
encrypted:
description:
- Whether the password is stored hashed in the database. Passwords can be
passed already hashed or unhashed, and postgresql ensures the stored
password is hashed when C(encrypted) is set.
- Whether the password is stored hashed in the database.
- Passwords can be passed already hashed or unhashed, and postgresql
ensures the stored password is hashed when C(encrypted) is set.
- "Note: Postgresql 10 and newer doesn't support unhashed passwords."
- Previous to Ansible 2.6, this was C(no) by default.
default: 'yes'
@ -119,6 +140,7 @@ options:
- The date at which the user's password is to expire.
- If set to C('infinity'), user's password never expire.
- Note that this value should be a valid SQL date and time type.
type: str
version_added: '1.4'
no_password_changes:
description:
@ -136,20 +158,22 @@ options:
more information on the modes.
- Default of C(prefer) matches libpq default.
default: prefer
choices: ["disable", "allow", "prefer", "require", "verify-ca", "verify-full"]
choices: [ allow, disable, prefer, require, verify-ca, verify-full ]
version_added: '2.3'
ca_cert:
description:
- Specifies the name of a file containing SSL certificate authority (CA)
certificate(s). If the file exists, the server's certificate will be
verified to be signed by one of these authorities.
type: str
version_added: '2.3'
aliases: [ ssl_rootcert ]
conn_limit:
description:
- Specifies the user (role) connection limit.
version_added: '2.4'
type: int
version_added: '2.4'
notes:
- The module creates a user (role) with login privilege by default.
Use NOLOGIN role_attr_flags to change this behaviour.
@ -161,48 +185,51 @@ notes:
PostgreSQL must also be installed on the remote host. For Ubuntu-based
systems, install the postgresql, libpq-dev, and python-psycopg2 packages
on the remote host before using this module.
- If you specify PUBLIC as the user (role), then the privilege changes will apply
to all users (roles). You may not specify password or role_attr_flags when the
PUBLIC user is specified.
- The ca_cert parameter requires at least Postgres version 8.4 and
I(psycopg2) version 2.4.3.
requirements: [ psycopg2 ]
author: "Ansible Core Team"
- If you specify PUBLIC as the user (role), then the privilege changes will apply to all users (roles).
You may not specify password or role_attr_flags when the PUBLIC user is specified.
- The ca_cert parameter requires at least Postgres version 8.4 and I(psycopg2) version 2.4.3.
requirements:
- psycopg2
author:
- Ansible Core Team
'''
EXAMPLES = '''
# Connect to acme database, create django user, and grant access to database and products table
- postgresql_user:
EXAMPLES = r'''
- name: Connect to acme database, create django user, and grant access to database and products table
postgresql_user:
db: acme
name: django
password: ceec4eif7ya
priv: "CONNECT/products:ALL"
expires: "Jan 31 2020"
# Connect to default database, create rails user, set its password (MD5-hashed), and grant privilege to create other
# databases and demote rails from super user status if user exists
- postgresql_user:
# Connect to default database, create rails user, set its password (MD5-hashed),
# and grant privilege to create other databases and demote rails from super user status if user exists
- name: Create rails user, set MD5-hashed password, grant privs
postgresql_user:
name: rails
password: md59543f1d82624df2b31672ec0f7050460
role_attr_flags: CREATEDB,NOSUPERUSER
# Connect to acme database and remove test user privileges from there
- postgresql_user:
- name: Connect to acme database and remove test user privileges from there
postgresql_user:
db: acme
name: test
priv: "ALL/products:ALL"
state: absent
fail_on_user: no
# Connect to test database, remove test user from cluster
- postgresql_user:
- name: Connect to test database, remove test user from cluster
postgresql_user:
db: test
name: test
priv: ALL
state: absent
# Connect to acme database and set user's password with no expire date
- postgresql_user:
- name: Connect to acme database and set user's password with no expire date
postgresql_user:
db: acme
name: django
password: mysupersecretword
@ -212,13 +239,22 @@ EXAMPLES = '''
# Example privileges string format
# INSERT,UPDATE/table:SELECT/anothertable:ALL
# Connect to test database and remove an existing user's password
- postgresql_user:
- name: Connect to test database and remove an existing user's password
postgresql_user:
db: test
user: test
password: ""
'''
RETURN = r'''
queries:
description: List of executed queries.
returned: always
type: list
sample: ['CREATE USER "alice"', 'GRANT CONNECT ON DATABASE "acme" TO "alice"']
version_added: '2.8'
'''
import itertools
import re
import traceback
@ -228,15 +264,14 @@ PSYCOPG2_IMP_ERR = None
try:
import psycopg2
import psycopg2.extras
HAS_PSYCOPG2 = True
except ImportError:
PSYCOPG2_IMP_ERR = traceback.format_exc()
postgresqldb_found = False
else:
postgresqldb_found = True
HAS_PSYCOPG2 = False
import ansible.module_utils.postgres as pgutils
from ansible.module_utils.basic import AnsibleModule, missing_required_lib
from ansible.module_utils.database import pg_quote_identifier, SQLParseError
from ansible.module_utils.postgres import postgres_common_argument_spec
from ansible.module_utils._text import to_bytes, to_native
from ansible.module_utils.six import iteritems
@ -254,6 +289,8 @@ PRIV_TO_AUTHID_COLUMN = dict(SUPERUSER='rolsuper', CREATEROLE='rolcreaterole',
CREATEDB='rolcreatedb', INHERIT='rolinherit', LOGIN='rolcanlogin',
REPLICATION='rolreplication', BYPASSRLS='rolbypassrls')
executed_queries = []
class InvalidFlagsError(Exception):
pass
@ -292,6 +329,7 @@ def user_add(cursor, user, password, role_attr_flags, encrypted, expires, conn_l
query.append("CONNECTION LIMIT %(conn_limit)s" % {"conn_limit": conn_limit})
query.append(role_attr_flags)
query = ' '.join(query)
executed_queries.append(query)
cursor.execute(query, query_password_data)
return True
@ -484,7 +522,9 @@ def user_delete(cursor, user):
"""Try to remove a user. Returns True if successful otherwise False"""
cursor.execute("SAVEPOINT ansible_pgsql_user_delete")
try:
cursor.execute("DROP USER %s" % pg_quote_identifier(user, 'role'))
query = "DROP USER %s" % pg_quote_identifier(user, 'role')
executed_queries.append(query)
cursor.execute(query)
except Exception:
cursor.execute("ROLLBACK TO SAVEPOINT ansible_pgsql_user_delete")
cursor.execute("RELEASE SAVEPOINT ansible_pgsql_user_delete")
@ -516,9 +556,9 @@ def get_table_privileges(cursor, user, table):
schema, table = table.split('.', 1)
else:
schema = 'public'
query = '''SELECT privilege_type FROM information_schema.role_table_grants
WHERE grantee=%s AND table_name=%s AND table_schema=%s'''
cursor.execute(query, (user, table, schema))
query = ("SELECT privilege_type FROM information_schema.role_table_grants "
"WHERE grantee='%s' AND table_name='%s' AND table_schema='%s'" % (user, table, schema))
cursor.execute(query)
return frozenset([x[0] for x in cursor.fetchall()])
@ -527,6 +567,7 @@ def grant_table_privileges(cursor, user, table, privs):
privs = ', '.join(privs)
query = 'GRANT %s ON TABLE %s TO %s' % (
privs, pg_quote_identifier(table, 'table'), pg_quote_identifier(user, 'role'))
executed_queries.append(query)
cursor.execute(query)
@ -535,6 +576,7 @@ def revoke_table_privileges(cursor, user, table, privs):
privs = ', '.join(privs)
query = 'REVOKE %s ON TABLE %s FROM %s' % (
privs, pg_quote_identifier(table, 'table'), pg_quote_identifier(user, 'role'))
executed_queries.append(query)
cursor.execute(query)
@ -585,6 +627,8 @@ def grant_database_privileges(cursor, user, db, privs):
query = 'GRANT %s ON DATABASE %s TO %s' % (
privs, pg_quote_identifier(db, 'database'),
pg_quote_identifier(user, 'role'))
executed_queries.append(query)
cursor.execute(query)
@ -598,6 +642,8 @@ def revoke_database_privileges(cursor, user, db, privs):
query = 'REVOKE %s ON DATABASE %s FROM %s' % (
privs, pg_quote_identifier(db, 'database'),
pg_quote_identifier(user, 'role'))
executed_queries.append(query)
cursor.execute(query)
@ -746,24 +792,21 @@ def get_valid_flags_by_version(cursor):
def main():
argument_spec = pgutils.postgres_common_argument_spec()
argument_spec.update(dict(
user=dict(required=True, aliases=['name']),
password=dict(default=None, no_log=True),
state=dict(default="present", choices=["absent", "present"]),
priv=dict(default=None),
db=dict(default=''),
fail_on_user=dict(type='bool', default='yes'),
role_attr_flags=dict(default=''),
argument_spec = postgres_common_argument_spec()
argument_spec.update(
user=dict(type='str', required=True, aliases=['name']),
password=dict(type='str', default=None, no_log=True),
state=dict(type='str', default='present', choices=['absent', 'present']),
priv=dict(type='str', default=None),
db=dict(type='str', default='', aliases=['login_db']),
fail_on_user=dict(type='bool', default='yes', aliases=['fail_on_role']),
role_attr_flags=dict(type='str', default=''),
encrypted=dict(type='bool', default='yes'),
no_password_changes=dict(type='bool', default='no'),
expires=dict(default=None),
ssl_mode=dict(default='prefer', choices=[
'disable', 'allow', 'prefer', 'require', 'verify-ca', 'verify-full']),
ca_cert=dict(default=None, aliases=['ssl_rootcert']),
expires=dict(type='str', default=None),
conn_limit=dict(type='int', default=None),
session_role=dict(),
))
session_role=dict(type='str'),
)
module = AnsibleModule(
argument_spec=argument_spec,
supports_check_mode=True
@ -786,8 +829,9 @@ def main():
expires = module.params["expires"]
sslrootcert = module.params["ca_cert"]
conn_limit = module.params["conn_limit"]
role_attr_flags = module.params["role_attr_flags"]
if not postgresqldb_found:
if not HAS_PSYCOPG2:
module.fail_json(msg=missing_required_lib('psycopg2'), exception=PSYCOPG2_IMP_ERR)
# To use defaults values, keyword arguments must be absent, so
@ -823,10 +867,10 @@ def main():
if 'sslrootcert' in e.args[0]:
module.fail_json(
msg='Postgresql server must be at least version 8.4 to support sslrootcert')
module.fail_json(msg="unable to connect to database: %s" % to_native(e), exception=traceback.format_exc())
module.fail_json(msg="Unable to connect to database: %s" % to_native(e), exception=traceback.format_exc())
except Exception as e:
module.fail_json(msg="unable to connect to database: %s" % to_native(e), exception=traceback.format_exc())
module.fail_json(msg="Unable to connect to database: %s" % to_native(e), exception=traceback.format_exc())
if session_role:
try:
@ -835,7 +879,7 @@ def main():
module.fail_json(msg="Could not switch role: %s" % to_native(e), exception=traceback.format_exc())
try:
role_attr_flags = parse_role_attrs(cursor, module.params["role_attr_flags"])
role_attr_flags = parse_role_attrs(cursor, role_attr_flags)
except InvalidFlagsError as e:
module.fail_json(msg=to_native(e), exception=traceback.format_exc())
@ -877,7 +921,7 @@ def main():
module.fail_json(msg=to_native(e), exception=traceback.format_exc())
changed = changed or user_removed
if fail_on_user and not user_removed:
msg = "unable to remove user"
msg = "Unable to remove user"
module.fail_json(msg=msg)
kw['user_removed'] = user_removed
@ -888,6 +932,7 @@ def main():
db_connection.commit()
kw['changed'] = changed
kw['queries'] = executed_queries
module.exit_json(**kw)

2
test/integration/targets/postgresql/tasks/test_no_password_change.yml
Unescape Escape View File

@ -15,7 +15,7 @@
postgresql_user:
<<: *parameters
state: "present"
role_attr_flags: "SUPERUSER,CREATEROLE,CREATEDB,INHERIT,login{{ bypassrls_supported | ternary(',BYPASSRLS', '') }}"
role_attr_flags: "SUPERUSER,CREATEROLE,CREATEDB,INHERIT,LOGIN{{ bypassrls_supported | ternary(',BYPASSRLS', '') }}"
no_password_changes: '{{ no_password_changes }}' # no_password_changes is ignored when user doesn't already exist
- name: Check that the user has the requested role attributes

7
test/sanity/validate-modules/ignore.txt
Unescape Escape View File

@ -334,13 +334,6 @@ lib/ansible/modules/database/mongodb/mongodb_user.py E322
lib/ansible/modules/database/mysql/mysql_db.py E210
lib/ansible/modules/database/mysql/mysql_user.py E322
lib/ansible/modules/database/postgresql/postgresql_db.py E210
lib/ansible/modules/database/postgresql/postgresql_ext.py E322
lib/ansible/modules/database/postgresql/postgresql_ext.py E324
lib/ansible/modules/database/postgresql/postgresql_lang.py E324
lib/ansible/modules/database/postgresql/postgresql_schema.py E322
lib/ansible/modules/database/postgresql/postgresql_schema.py E324
lib/ansible/modules/database/postgresql/postgresql_user.py E322
lib/ansible/modules/database/postgresql/postgresql_user.py E324
lib/ansible/modules/database/postgresql/postgresql_user.py E326
lib/ansible/modules/database/proxysql/proxysql_backend_servers.py E322
lib/ansible/modules/database/proxysql/proxysql_global_variables.py E322

Write Preview
Loading…
Cancel
Save