VMware: Add new module : vmware_host_firewall_manager (#35596)

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>

lib/ansible/modules/cloud/vmware/vmware_host_firewall_manager.py

@@ -0,0 +1,225 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+# Copyright: (c) 2018, Abhijeet Kasurde <akasurde@redhat.com>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.1',
+    'status': ['preview'],
+    'supported_by': 'community'
+}
+
+DOCUMENTATION = r'''
+---
+module: vmware_host_firewall_manager
+short_description: Manage firewall configurations about an ESXi host
+description:
+- This module can be used to manage firewall configurations about an ESXi host when ESXi hostname or Cluster name is given.
+version_added: '2.5'
+author:
+- Abhijeet Kasurde (@akasurde)
+notes:
+- Tested on vSphere 6.5
+requirements:
+- python >= 2.6
+- PyVmomi
+options:
+  cluster_name:
+    description:
+    - Name of the cluster.
+    - Firewall settings are applied to every ESXi host system in given cluster.
+    - If C(esxi_hostname) is not given, this parameter is required.
+  esxi_hostname:
+    description:
+    - ESXi hostname.
+    - Firewall settings are applied to this ESXi host system.
+    - If C(cluster_name) is not given, this parameter is required.
+  rules:
+    description:
+    - A list of Rule set which needs to be managed.
+    - Each member of list is rule set name and state to be set the rule.
+    - Both rule name and rule state are required parameters.
+    - Please see examples for more information.
+extends_documentation_fragment: vmware.documentation
+'''
+
+EXAMPLES = r'''
+- name: Enable vvold rule set for all ESXi Host in given Cluster
+  vmware_host_firewall_manager:
+    hostname: '{{ vcenter_hostname }}'
+    username: '{{ vcenter_username }}'
+    password: '{{ vcenter_password }}'
+    cluster_name: cluster_name
+    rules:
+        - name: vvold
+          enabled: True
+
+- name: Enable vvold rule set for an ESXi Host
+  vmware_host_firewall_manager:
+    hostname: '{{ vcenter_hostname }}'
+    username: '{{ vcenter_username }}'
+    password: '{{ vcenter_password }}'
+    esxi_hostname: '{{ esxi_hostname }}'
+    rules:
+        - name: vvold
+          enabled: True
+
+- name: Manage multiple rule set for an ESXi Host
+  vmware_host_firewall_manager:
+    hostname: '{{ vcenter_hostname }}'
+    username: '{{ vcenter_username }}'
+    password: '{{ vcenter_password }}'
+    esxi_hostname: '{{ esxi_hostname }}'
+    rules:
+        - name: vvold
+          enabled: True
+        - name: CIMHttpServer
+          enabled: False
+'''
+
+RETURN = r'''
+rule_set_state:
+    description:
+    - dict with hostname as key and dict with firewall rule set facts as value
+    returned: success
+    type: dict
+    sample: {
+                "rule_set_state": {
+                    "localhost.localdomain": {
+                        "CIMHttpServer": {
+                            "current_state": true,
+                            "desired_state": true,
+                            "previous_state": true
+                        },
+                        "vvold": {
+                            "current_state": true,
+                            "desired_state": true,
+                            "previous_state": true
+                        }
+                    }
+                }
+            }
+'''
+
+try:
+    from pyVmomi import vim, vmodl
+except ImportError:
+    pass
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.vmware import vmware_argument_spec, PyVmomi
+from ansible.module_utils._text import to_native
+
+
+class VmwareFirewallManager(PyVmomi):
+    def __init__(self, module):
+        super(VmwareFirewallManager, self).__init__(module)
+        cluster_name = self.params.get('cluster_name', None)
+        esxi_host_name = self.params.get('esxi_hostname', None)
+        self.options = self.params.get('options', dict())
+        self.hosts = []
+        if cluster_name:
+            cluster_obj = self.find_cluster_by_name(cluster_name=cluster_name)
+            if cluster_obj:
+                self.hosts = [host for host in cluster_obj.host]
+            else:
+                module.fail_json(changed=False, msg="Cluster '%s' not found" % cluster_name)
+        elif esxi_host_name:
+            esxi_host_obj = self.find_hostsystem_by_name(host_name=esxi_host_name)
+            if esxi_host_obj:
+                self.hosts = [esxi_host_obj]
+            else:
+                module.fail_json(changed=False, msg="ESXi '%s' not found" % esxi_host_name)
+        self.firewall_facts = dict()
+        self.rule_options = self.module.params.get("rules")
+        self.gather_rule_set()
+
+    def gather_rule_set(self):
+        for host in self.hosts:
+            self.firewall_facts[host.name] = {}
+            firewall_system = host.configManager.firewallSystem
+            if firewall_system:
+                for rule_set_obj in firewall_system.firewallInfo.ruleset:
+                    temp_rule_dict = dict()
+                    temp_rule_dict['enabled'] = rule_set_obj.enabled
+                    self.firewall_facts[host.name][rule_set_obj.key] = temp_rule_dict
+
+    def ensure(self):
+        """
+        Function to ensure rule set configuration
+
+        """
+        fw_change_list = []
+        results = dict(changed=False, rule_set_state=dict())
+        for host in self.hosts:
+            firewall_system = host.configManager.firewallSystem
+            if firewall_system is None:
+                continue
+
+            results['rule_set_state'][host.name] = dict()
+
+            for rule_option in self.rule_options:
+                rule_name = rule_option.get('name', None)
+                if rule_name is None:
+                    self.module.fail_json(msg="Please specify rule.name for rule set"
+                                              " as it is required parameter.")
+                if rule_name not in self.firewall_facts[host.name]:
+                    self.module.fail_json(msg="rule named '%s' wasn't found." % rule_name)
+
+                rule_enabled = rule_option.get('enabled', None)
+                if rule_enabled is None:
+                    self.module.fail_json(msg="Please specify rules.enabled for rule set"
+                                              " %s as it is required parameter." % rule_name)
+
+                current_rule_state = self.firewall_facts[host.name][rule_name]['enabled']
+                if current_rule_state != rule_enabled:
+                    try:
+                        if rule_enabled:
+                            firewall_system.EnableRuleset(id=rule_name)
+                        else:
+                            firewall_system.DisableRuleset(id=rule_name)
+                        fw_change_list.append(True)
+                    except vim.fault.NotFound as not_found:
+                        self.module.fail_json(msg="Failed to enable rule set %s as"
+                                                  " rule set id is unknown : %s" % (rule_name,
+                                                                                    to_native(not_found.msg)))
+                    except vim.fault.HostConfigFault as host_config_fault:
+                        self.module.fail_json(msg="Failed to enabled rule set %s as an internal"
+                                                  " error happened while reconfiguring"
+                                                  " rule set : %s" % (rule_name,
+                                                                      to_native(host_config_fault.msg)))
+                results['rule_set_state'][host.name][rule_name] = dict(current_state=rule_enabled,
+                                                                       previous_state=current_rule_state,
+                                                                       desired_state=rule_enabled,
+                                                                       )
+
+        if any(fw_change_list):
+            results['changed'] = True
+        self.module.exit_json(**results)
+
+
+def main():
+    argument_spec = vmware_argument_spec()
+    argument_spec.update(
+        cluster_name=dict(type='str', required=False),
+        esxi_hostname=dict(type='str', required=False),
+        rules=dict(type='list', default=list(), required=False),
+    )
+
+    module = AnsibleModule(
+        argument_spec=argument_spec,
+        required_one_of=[
+            ['cluster_name', 'esxi_hostname'],
+        ]
+    )
+
+    vmware_firewall_manager = VmwareFirewallManager(module)
+    vmware_firewall_manager.ensure()
+
+
+if __name__ == "__main__":
+    main()

test/integration/targets/vmware_host_firewall_manager/aliases

@@ -0,0 +1,3 @@
+posix/ci/cloud/group4/vcenter
+cloud/vcenter
+destructive

test/integration/targets/vmware_host_firewall_manager/tasks/main.yml

@@ -0,0 +1,121 @@
+# Test code for the vmware_host_firewall_manager module.
+# Copyright: (c) 2018, Abhijeet Kasurde <akasurde@redhat.com>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+- name: make sure pyvmomi is installed
+  pip:
+    name: pyvmomi
+    state: latest
+  when: "{{ ansible_user_id == 'root' }}"
+
+- name: store the vcenter container ip
+  set_fact:
+    vcsim: "{{ lookup('env', 'vcenter_host') }}"
+
+- debug: var=vcsim
+
+- name: Wait for Flask controller to come up online
+  wait_for:
+    host: "{{ vcsim }}"
+    port: 5000
+    state: started
+
+- name: kill vcsim
+  uri:
+    url: http://{{ vcsim }}:5000/killall
+
+- name: start vcsim
+  uri:
+    url: http://{{ vcsim }}:5000/spawn?cluster=2
+  register: vcsim_instance
+
+- debug:
+    var: vcsim_instance
+
+- name: Wait for vcsim server to come up online
+  wait_for:
+    host: "{{ vcsim }}"
+    port: 443
+    state: started
+
+- name: get a list of Cluster from vcsim
+  uri:
+    url: http://{{ vcsim }}:5000/govc_find?filter=CCR
+  register: clusters
+
+- name: get a cluster
+  set_fact:
+    ccr1: "{{ clusters.json[0] | basename }}"
+
+- name: get a list of hosts from vcsim
+  uri:
+    url: http://{{ vcsim }}:5000/govc_find?filter=H
+  register: hosts
+
+- name: get a cluster
+  set_fact:
+    host1: "{{ hosts.json[0] | basename }}"
+
+- debug: var=ccr1
+- debug: var=host1
+
+- name: Enable vvold rule set on all hosts of {{ ccr1 }}
+  vmware_host_firewall_manager:
+    hostname: "{{ vcsim }}"
+    username: "{{ vcsim_instance.json.username }}"
+    password: "{{ vcsim_instance.json.password }}"
+    validate_certs: no
+    cluster_name: "{{ ccr1 }}"
+    rules:
+      - name: vvold
+        enabled: True
+  register: all_hosts_result
+
+- debug: msg="{{ all_hosts_result }}"
+
+- name: ensure everything is changed for all hosts of {{ ccr1 }}
+  assert:
+    that:
+        - all_hosts_result.changed
+        - all_hosts_result.rule_set_state is defined
+
+- name: ensure facts are gathered for all hosts of {{ ccr1 }}
+  assert:
+    that:
+        - all_hosts_result.rule_set_state[item]['vvold']['current_state'] == True
+        - all_hosts_result.rule_set_state[item]['vvold']['desired_state'] == True
+        - all_hosts_result.rule_set_state[item]['vvold']['previous_state'] == False
+  with_items:
+    - DC0_C0_H0
+    - DC0_C0_H1
+    - DC0_C0_H2
+
+
+- name: Disable vvold for {{ host1 }}
+  vmware_host_firewall_manager:
+    hostname: "{{ vcsim }}"
+    username: "{{ vcsim_instance.json.username }}"
+    password: "{{ vcsim_instance.json.password }}"
+    validate_certs: no
+    esxi_hostname: "{{ host1 }}"
+    rules:
+      - name: vvold
+        enabled: False
+  register: host_result
+
+- debug: msg="{{ host_result }}"
+
+- name: ensure vvold is disabled for {{ host1 }}
+  assert:
+    that:
+        - host_result.changed
+        - host_result.rule_set_state is defined
+
+- name: ensure facts are gathered for {{ host1 }}
+  assert:
+    that:
+        - host_result.rule_set_state[item]['vvold']['current_state'] == False
+        - host_result.rule_set_state[item]['vvold']['desired_state'] == False
+        - host_result.rule_set_state[item]['vvold']['previous_state'] == True
+  with_items:
+    - "{{ host1 }}"