mirror of https://github.com/ansible/ansible.git
Merge remote-tracking branch 'upstream/devel' into devel
Juho-Mikko Pellinen
9 years ago
commit
d85ad1087f
@ -0,0 +1,344 @@
|
|||||||
|
#!/usr/bin/python
|
||||||
|
# This file is part of Ansible
|
||||||
|
#
|
||||||
|
# Ansible is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# Ansible is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
DOCUMENTATION = '''
|
||||||
|
---
|
||||||
|
module: ec2_vpc_net
|
||||||
|
short_description: configure AWS virtual private clouds
|
||||||
|
description:
|
||||||
|
- Create or terminates AWS virtual private clouds. This module has a dependency on python-boto.
|
||||||
|
version_added: "2.0"
|
||||||
|
options:
|
||||||
|
name:
|
||||||
|
description:
|
||||||
|
- The name to give your VPC. This is used in combination with the cidr_block paramater to determine if a VPC already exists.
|
||||||
|
required: yes
|
||||||
|
cidr_block:
|
||||||
|
description:
|
||||||
|
- The CIDR of the VPC
|
||||||
|
required: yes
|
||||||
|
aliases: []
|
||||||
|
tenancy:
|
||||||
|
description:
|
||||||
|
- Whether to be default or dedicated tenancy. This cannot be changed after the VPC has been created.
|
||||||
|
required: false
|
||||||
|
default: default
|
||||||
|
dns_support:
|
||||||
|
description:
|
||||||
|
- Whether to enable AWS DNS support.
|
||||||
|
required: false
|
||||||
|
default: true
|
||||||
|
dns_hostnames:
|
||||||
|
description:
|
||||||
|
- Whether to enable AWS hostname support.
|
||||||
|
required: false
|
||||||
|
default: true
|
||||||
|
dhcp_id:
|
||||||
|
description:
|
||||||
|
- the id of the DHCP options to use for this vpc
|
||||||
|
default: null
|
||||||
|
required: false
|
||||||
|
tags:
|
||||||
|
description:
|
||||||
|
- The tags you want attached to the VPC. This is independent of the name value, note if you pass a 'Name' key it would override the Name of the VPC if it's different.
|
||||||
|
default: None
|
||||||
|
required: false
|
||||||
|
state:
|
||||||
|
description:
|
||||||
|
- The state of the VPC. Either absent or present.
|
||||||
|
default: present
|
||||||
|
required: false
|
||||||
|
multi_ok:
|
||||||
|
description:
|
||||||
|
- By default the module will not create another VPC if there is another VPC with the same name and CIDR block. Specify this as true if you want duplicate VPCs created.
|
||||||
|
default: false
|
||||||
|
required: false
|
||||||
|
author: Jonathan Davila
|
||||||
|
extends_documentation_fragment: aws
|
||||||
|
'''
|
||||||
|
|
||||||
|
EXAMPLES = '''
|
||||||
|
# Create a VPC with dedicate tenancy and a couple of tags
|
||||||
|
|
||||||
|
- ec2_vpc:
|
||||||
|
name: Module_dev2
|
||||||
|
cidr_block: 170.10.0.0/16
|
||||||
|
region: us-east-1
|
||||||
|
tags:
|
||||||
|
new_vpc: ec2_vpc_module
|
||||||
|
this: works22
|
||||||
|
tenancy: dedicated
|
||||||
|
|
||||||
|
'''
|
||||||
|
|
||||||
|
|
||||||
|
import time
|
||||||
|
import sys
|
||||||
|
|
||||||
|
try:
|
||||||
|
import boto
|
||||||
|
import boto.ec2
|
||||||
|
import boto.vpc
|
||||||
|
from boto.exception import EC2ResponseError
|
||||||
|
|
||||||
|
HAS_BOTO=True
|
||||||
|
except ImportError:
|
||||||
|
HAS_BOTO=False
|
||||||
|
|
||||||
|
def boto_exception(err):
|
||||||
|
'''generic error message handler'''
|
||||||
|
if hasattr(err, 'error_message'):
|
||||||
|
error = err.error_message
|
||||||
|
elif hasattr(err, 'message'):
|
||||||
|
error = err.message
|
||||||
|
else:
|
||||||
|
error = '%s: %s' % (Exception, err)
|
||||||
|
|
||||||
|
return error
|
||||||
|
|
||||||
|
def vpc_exists(module, vpc, name, cidr_block, multi):
|
||||||
|
"""Returns True or False in regards to the existance of a VPC. When supplied
|
||||||
|
with a CIDR, it will check for matching tags to determine if it is a match
|
||||||
|
otherwise it will assume the VPC does not exist and thus return false.
|
||||||
|
"""
|
||||||
|
exists=False
|
||||||
|
matched_vpc=None
|
||||||
|
|
||||||
|
try:
|
||||||
|
matching_vpcs=vpc.get_all_vpcs(filters={'tag:Name' : name, 'cidr-block' : cidr_block})
|
||||||
|
except Exception, e:
|
||||||
|
e_msg=boto_exception(e)
|
||||||
|
module.fail_json(msg=e_msg)
|
||||||
|
|
||||||
|
if len(matching_vpcs) == 1 and not multi:
|
||||||
|
exists=True
|
||||||
|
matched_vpc=str(matching_vpcs).split(':')[1].split(']')[0]
|
||||||
|
elif len(matching_vpcs) > 1 and not multi:
|
||||||
|
module.fail_json(msg='Currently there are %d VPCs that have the same name and '
|
||||||
|
'CIDR block you specified. If you would like to create '
|
||||||
|
'the VPC anyways please pass True to the multi_ok param.' % len(matching_vpcs))
|
||||||
|
|
||||||
|
return exists, matched_vpc
|
||||||
|
|
||||||
|
def vpc_needs_update(module, vpc, vpc_id, dns_support, dns_hostnames, dhcp_id, tags):
|
||||||
|
"""This returns True or False. Intended to run after vpc_exists.
|
||||||
|
It will check all the characteristics of the parameters passed and compare them
|
||||||
|
to the active VPC. If any discrepancy is found, it will report true, meaning that
|
||||||
|
the VPC needs to be update in order to match the specified state in the params.
|
||||||
|
"""
|
||||||
|
|
||||||
|
update_dhcp=False
|
||||||
|
update_tags=False
|
||||||
|
dhcp_match=False
|
||||||
|
|
||||||
|
try:
|
||||||
|
dhcp_list=vpc.get_all_dhcp_options()
|
||||||
|
|
||||||
|
if dhcp_id is not None:
|
||||||
|
has_default=vpc.get_all_vpcs(filters={'dhcp-options-id' : 'default', 'vpc-id' : vpc_id})
|
||||||
|
for opts in dhcp_list:
|
||||||
|
if (str(opts).split(':')[1] == dhcp_id) or has_default:
|
||||||
|
dhcp_match=True
|
||||||
|
break
|
||||||
|
else:
|
||||||
|
pass
|
||||||
|
except Exception, e:
|
||||||
|
e_msg=boto_exception(e)
|
||||||
|
module.fail_json(msg=e_msg)
|
||||||
|
|
||||||
|
if not dhcp_match or (has_default and dhcp_id != 'default'):
|
||||||
|
update_dhcp=True
|
||||||
|
|
||||||
|
if dns_hostnames and dns_support == False:
|
||||||
|
module.fail_json('In order to enable DNS Hostnames you must have DNS support enabled')
|
||||||
|
else:
|
||||||
|
|
||||||
|
# Note: Boto currently doesn't currently provide an interface to ec2-describe-vpc-attribute
|
||||||
|
# which is needed in order to detect the current status of DNS options. For now we just update
|
||||||
|
# the attribute each time and is not used as a changed-factor.
|
||||||
|
try:
|
||||||
|
vpc.modify_vpc_attribute(vpc_id, enable_dns_support=dns_support)
|
||||||
|
vpc.modify_vpc_attribute(vpc_id, enable_dns_hostnames=dns_hostnames)
|
||||||
|
except Exception, e:
|
||||||
|
e_msg=boto_exception(e)
|
||||||
|
module.fail_json(msg=e_msg)
|
||||||
|
|
||||||
|
if tags:
|
||||||
|
try:
|
||||||
|
current_tags = dict((t.name, t.value) for t in vpc.get_all_tags(filters={'resource-id': vpc_id}))
|
||||||
|
if not set(tags.items()).issubset(set(current_tags.items())):
|
||||||
|
update_tags=True
|
||||||
|
except Exception, e:
|
||||||
|
e_msg=boto_exception(e)
|
||||||
|
module.fail_json(msg=e_msg)
|
||||||
|
|
||||||
|
return update_dhcp, update_tags
|
||||||
|
|
||||||
|
|
||||||
|
def update_vpc_tags(module, vpc, vpc_id, tags, name):
|
||||||
|
tags.update({'Name': name})
|
||||||
|
try:
|
||||||
|
vpc.create_tags(vpc_id, tags)
|
||||||
|
updated_tags=dict((t.name, t.value) for t in vpc.get_all_tags(filters={'resource-id': vpc_id}))
|
||||||
|
except Exception, e:
|
||||||
|
e_msg=boto_exception(e)
|
||||||
|
module.fail_json(msg=e_msg)
|
||||||
|
|
||||||
|
return updated_tags
|
||||||
|
|
||||||
|
|
||||||
|
def update_dhcp_opts(module, vpc, vpc_id, dhcp_id):
|
||||||
|
try:
|
||||||
|
vpc.associate_dhcp_options(dhcp_id, vpc_id)
|
||||||
|
dhcp_list=vpc.get_all_dhcp_options()
|
||||||
|
except Exception, e:
|
||||||
|
e_msg=boto_exception(e)
|
||||||
|
module.fail_json(msg=e_msg)
|
||||||
|
|
||||||
|
for opts in dhcp_list:
|
||||||
|
vpc_dhcp=vpc.get_all_vpcs(filters={'dhcp-options-id' : opts, 'vpc-id' : vpc_id})
|
||||||
|
matched=False
|
||||||
|
if opts == dhcp_id:
|
||||||
|
matched=True
|
||||||
|
return opts
|
||||||
|
|
||||||
|
if matched == False:
|
||||||
|
return dhcp_id
|
||||||
|
|
||||||
|
def main():
|
||||||
|
argument_spec=ec2_argument_spec()
|
||||||
|
argument_spec.update(dict(
|
||||||
|
name=dict(type='str', default=None, required=True),
|
||||||
|
cidr_block=dict(type='str', default=None, required=True),
|
||||||
|
tenancy=dict(choices=['default', 'dedicated'], default='default'),
|
||||||
|
dns_support=dict(type='bool', default=True),
|
||||||
|
dns_hostnames=dict(type='bool', default=True),
|
||||||
|
dhcp_opts_id=dict(type='str', default=None, required=False),
|
||||||
|
tags=dict(type='dict', required=False, default=None),
|
||||||
|
state=dict(choices=['present', 'absent'], default='present'),
|
||||||
|
region=dict(type='str', required=True),
|
||||||
|
multi_ok=dict(type='bool', default=False)
|
||||||
|
)
|
||||||
|
)
|
||||||
|
|
||||||
|
module = AnsibleModule(
|
||||||
|
argument_spec=argument_spec,
|
||||||
|
)
|
||||||
|
|
||||||
|
if not HAS_BOTO:
|
||||||
|
module.fail_json(msg='Boto is required for this module')
|
||||||
|
|
||||||
|
name=module.params.get('name')
|
||||||
|
cidr_block=module.params.get('cidr_block')
|
||||||
|
tenancy=module.params.get('tenancy')
|
||||||
|
dns_support=module.params.get('dns_support')
|
||||||
|
dns_hostnames=module.params.get('dns_hostnames')
|
||||||
|
dhcp_id=module.params.get('dhcp_opts_id')
|
||||||
|
tags=module.params.get('tags')
|
||||||
|
state=module.params.get('state')
|
||||||
|
multi=module.params.get('multi_ok')
|
||||||
|
|
||||||
|
changed=False
|
||||||
|
new_dhcp_opts=None
|
||||||
|
new_tags=None
|
||||||
|
update_dhcp=False
|
||||||
|
update_tags=False
|
||||||
|
|
||||||
|
region, ec2_url, aws_connect_kwargs=get_aws_connection_info(module)
|
||||||
|
|
||||||
|
try:
|
||||||
|
vpc=boto.vpc.connect_to_region(
|
||||||
|
region,
|
||||||
|
**aws_connect_kwargs
|
||||||
|
)
|
||||||
|
except boto.exception.NoAuthHandlerFound, e:
|
||||||
|
module.fail_json(msg=str(e))
|
||||||
|
|
||||||
|
already_exists, vpc_id=vpc_exists(module, vpc, name, cidr_block, multi)
|
||||||
|
|
||||||
|
if already_exists:
|
||||||
|
update_dhcp, update_tags=vpc_needs_update(module, vpc, vpc_id, dns_support, dns_hostnames, dhcp_id, tags)
|
||||||
|
if update_dhcp or update_tags:
|
||||||
|
changed=True
|
||||||
|
|
||||||
|
try:
|
||||||
|
e_tags=dict((t.name, t.value) for t in vpc.get_all_tags(filters={'resource-id': vpc_id}))
|
||||||
|
dhcp_list=vpc.get_all_dhcp_options()
|
||||||
|
has_default=vpc.get_all_vpcs(filters={'dhcp-options-id' : 'default', 'vpc-id' : vpc_id})
|
||||||
|
except Exception, e:
|
||||||
|
e_msg=boto_exception(e)
|
||||||
|
module.fail_json(msg=e_msg)
|
||||||
|
|
||||||
|
dhcp_opts=None
|
||||||
|
|
||||||
|
try:
|
||||||
|
for opts in dhcp_list:
|
||||||
|
if vpc.get_all_vpcs(filters={'dhcp-options-id' : opts, 'vpc-id' : vpc_id}):
|
||||||
|
dhcp_opts=opts
|
||||||
|
break
|
||||||
|
else:
|
||||||
|
pass
|
||||||
|
except Exception, e:
|
||||||
|
e_msg=boto_exception(e)
|
||||||
|
module.fail_json(msg=e_msg)
|
||||||
|
|
||||||
|
if not dhcp_opts and has_default:
|
||||||
|
dhcp_opts='default'
|
||||||
|
|
||||||
|
if state == 'present':
|
||||||
|
|
||||||
|
if not changed and already_exists:
|
||||||
|
module.exit_json(changed=changed, vpc_id=vpc_id)
|
||||||
|
elif changed:
|
||||||
|
if update_dhcp:
|
||||||
|
dhcp_opts=update_dhcp_opts(module, vpc, vpc_id, dhcp_id)
|
||||||
|
if update_tags:
|
||||||
|
e_tags=update_vpc_tags(module, vpc, vpc_id, tags, name)
|
||||||
|
|
||||||
|
module.exit_json(changed=changed, name=name, dhcp_options_id=dhcp_opts, tags=e_tags)
|
||||||
|
|
||||||
|
if not already_exists:
|
||||||
|
try:
|
||||||
|
vpc_id=str(vpc.create_vpc(cidr_block, instance_tenancy=tenancy)).split(':')[1]
|
||||||
|
vpc.create_tags(vpc_id, dict(Name=name))
|
||||||
|
except Exception, e:
|
||||||
|
e_msg=boto_exception(e)
|
||||||
|
module.fail_json(msg=e_msg)
|
||||||
|
|
||||||
|
update_dhcp, update_tags=vpc_needs_update(module, vpc, vpc_id, dns_support, dns_hostnames, dhcp_id, tags)
|
||||||
|
|
||||||
|
if update_dhcp:
|
||||||
|
new_dhcp_opts=update_dhcp_opts(module, vpc, vpc_id, dhcp_id)
|
||||||
|
if update_tags:
|
||||||
|
new_tags=update_vpc_tags(module, vpc, vpc_id, tags, name)
|
||||||
|
module.exit_json(changed=True, name=name, vpc_id=vpc_id, dhcp_options=new_dhcp_opts, tags=new_tags)
|
||||||
|
elif state == 'absent':
|
||||||
|
if already_exists:
|
||||||
|
changed=True
|
||||||
|
try:
|
||||||
|
vpc.delete_vpc(vpc_id)
|
||||||
|
module.exit_json(changed=changed, vpc_id=vpc_id)
|
||||||
|
except Exception, e:
|
||||||
|
e_msg=boto_exception(e)
|
||||||
|
module.fail_json(msg="%s. You may want to use the ec2_vpc_subnet, ec2_vpc_igw, "
|
||||||
|
"and/or ec2_vpc_rt modules to ensure the other components are absent." % e_msg)
|
||||||
|
else:
|
||||||
|
module.exit_json(msg="VPC is absent")
|
||||||
|
# import module snippets
|
||||||
|
from ansible.module_utils.basic import *
|
||||||
|
from ansible.module_utils.ec2 import *
|
||||||
|
|
||||||
|
main()
|
||||||
@ -0,0 +1,294 @@
|
|||||||
|
#!/usr/bin/python
|
||||||
|
# This file is part of Ansible
|
||||||
|
#
|
||||||
|
# Ansible is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# Ansible is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
DOCUMENTATION = '''
|
||||||
|
---
|
||||||
|
module: iam_cert
|
||||||
|
short_description: Manage server certificates for use on ELBs and CloudFront
|
||||||
|
description:
|
||||||
|
- Allows for the management of server certificates
|
||||||
|
version_added: "2.0"
|
||||||
|
options:
|
||||||
|
name:
|
||||||
|
description:
|
||||||
|
- Name of certificate to add, update or remove.
|
||||||
|
required: true
|
||||||
|
aliases: []
|
||||||
|
new_name:
|
||||||
|
description:
|
||||||
|
- When present, this will update the name of the cert with the value passed here.
|
||||||
|
required: false
|
||||||
|
aliases: []
|
||||||
|
new_path:
|
||||||
|
description:
|
||||||
|
- When present, this will update the path of the cert with the value passed here.
|
||||||
|
required: false
|
||||||
|
aliases: []
|
||||||
|
state:
|
||||||
|
description:
|
||||||
|
- Whether to create, delete certificate. When present is specified it will attempt to make an update if new_path or new_name is specified.
|
||||||
|
required: true
|
||||||
|
default: null
|
||||||
|
choices: [ "present", "absent" ]
|
||||||
|
aliases: []
|
||||||
|
path:
|
||||||
|
description:
|
||||||
|
- When creating or updating, specify the desired path of the certificate
|
||||||
|
required: false
|
||||||
|
default: "/"
|
||||||
|
aliases: []
|
||||||
|
cert_chain:
|
||||||
|
description:
|
||||||
|
- The path to the CA certificate chain in PEM encoded format.
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
aliases: []
|
||||||
|
cert:
|
||||||
|
description:
|
||||||
|
- The path to the certificate body in PEM encoded format.
|
||||||
|
required: false
|
||||||
|
aliases: []
|
||||||
|
key:
|
||||||
|
description:
|
||||||
|
- The path to the private key of the certificate in PEM encoded format.
|
||||||
|
dup_ok:
|
||||||
|
description:
|
||||||
|
- By default the module will not upload a certifcate that is already uploaded into AWS. If set to True, it will upload the certifcate as long as the name is unique.
|
||||||
|
required: false
|
||||||
|
default: False
|
||||||
|
aliases: []
|
||||||
|
aws_secret_key:
|
||||||
|
description:
|
||||||
|
- AWS secret key. If not set then the value of the AWS_SECRET_KEY environment variable is used.
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
aliases: [ 'ec2_secret_key', 'secret_key' ]
|
||||||
|
aws_access_key:
|
||||||
|
description:
|
||||||
|
- AWS access key. If not set then the value of the AWS_ACCESS_KEY environment variable is used.
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
aliases: [ 'ec2_access_key', 'access_key' ]
|
||||||
|
|
||||||
|
|
||||||
|
requirements: [ "boto" ]
|
||||||
|
author: Jonathan I. Davila
|
||||||
|
extends_documentation_fragment: aws
|
||||||
|
'''
|
||||||
|
|
||||||
|
EXAMPLES = '''
|
||||||
|
# Basic server certificate upload
|
||||||
|
tasks:
|
||||||
|
- name: Upload Certifcate
|
||||||
|
iam_cert:
|
||||||
|
name: very_ssl
|
||||||
|
state: present
|
||||||
|
cert: somecert.pem
|
||||||
|
key: privcertkey
|
||||||
|
cert_chain: myverytrustedchain
|
||||||
|
|
||||||
|
'''
|
||||||
|
import json
|
||||||
|
import sys
|
||||||
|
try:
|
||||||
|
import boto
|
||||||
|
import boto.iam
|
||||||
|
HAS_BOTO = True
|
||||||
|
except ImportError:
|
||||||
|
HAS_BOTO = False
|
||||||
|
|
||||||
|
def boto_exception(err):
|
||||||
|
'''generic error message handler'''
|
||||||
|
if hasattr(err, 'error_message'):
|
||||||
|
error = err.error_message
|
||||||
|
elif hasattr(err, 'message'):
|
||||||
|
error = err.message
|
||||||
|
else:
|
||||||
|
error = '%s: %s' % (Exception, err)
|
||||||
|
|
||||||
|
return error
|
||||||
|
|
||||||
|
def cert_meta(iam, name):
|
||||||
|
opath = iam.get_server_certificate(name).get_server_certificate_result.\
|
||||||
|
server_certificate.\
|
||||||
|
server_certificate_metadata.\
|
||||||
|
path
|
||||||
|
ocert = iam.get_server_certificate(name).get_server_certificate_result.\
|
||||||
|
server_certificate.\
|
||||||
|
certificate_body
|
||||||
|
ocert_id = iam.get_server_certificate(name).get_server_certificate_result.\
|
||||||
|
server_certificate.\
|
||||||
|
server_certificate_metadata.\
|
||||||
|
server_certificate_id
|
||||||
|
upload_date = iam.get_server_certificate(name).get_server_certificate_result.\
|
||||||
|
server_certificate.\
|
||||||
|
server_certificate_metadata.\
|
||||||
|
upload_date
|
||||||
|
exp = iam.get_server_certificate(name).get_server_certificate_result.\
|
||||||
|
server_certificate.\
|
||||||
|
server_certificate_metadata.\
|
||||||
|
expiration
|
||||||
|
return opath, ocert, ocert_id, upload_date, exp
|
||||||
|
|
||||||
|
def dup_check(module, iam, name, new_name, cert, orig_cert_names, orig_cert_bodies, dup_ok):
|
||||||
|
update=False
|
||||||
|
if any(ct in orig_cert_names for ct in [name, new_name]):
|
||||||
|
for i_name in [name, new_name]:
|
||||||
|
if i_name is None:
|
||||||
|
continue
|
||||||
|
|
||||||
|
if cert is not None:
|
||||||
|
try:
|
||||||
|
c_index=orig_cert_names.index(i_name)
|
||||||
|
except NameError:
|
||||||
|
continue
|
||||||
|
else:
|
||||||
|
if orig_cert_bodies[c_index] == cert:
|
||||||
|
update=True
|
||||||
|
break
|
||||||
|
elif orig_cert_bodies[c_index] != cert:
|
||||||
|
module.fail_json(changed=False, msg='A cert with the name %s already exists and'
|
||||||
|
' has a different certificate body associated'
|
||||||
|
' with it. Certifcates cannot have the same name')
|
||||||
|
else:
|
||||||
|
update=True
|
||||||
|
break
|
||||||
|
elif cert in orig_cert_bodies and not dup_ok:
|
||||||
|
for crt_name, crt_body in zip(orig_cert_names, orig_cert_bodies):
|
||||||
|
if crt_body == cert:
|
||||||
|
module.fail_json(changed=False, msg='This certificate already'
|
||||||
|
' exists under the name %s' % crt_name)
|
||||||
|
|
||||||
|
return update
|
||||||
|
|
||||||
|
|
||||||
|
def cert_action(module, iam, name, cpath, new_name, new_path, state,
|
||||||
|
cert, key, chain, orig_cert_names, orig_cert_bodies, dup_ok):
|
||||||
|
if state == 'present':
|
||||||
|
update = dup_check(module, iam, name, new_name, cert, orig_cert_names,
|
||||||
|
orig_cert_bodies, dup_ok)
|
||||||
|
if update:
|
||||||
|
opath, ocert, ocert_id, upload_date, exp = cert_meta(iam, name)
|
||||||
|
changed=True
|
||||||
|
if new_name and new_path:
|
||||||
|
iam.update_server_cert(name, new_cert_name=new_name, new_path=new_path)
|
||||||
|
module.exit_json(changed=changed, original_name=name, new_name=new_name,
|
||||||
|
original_path=opath, new_path=new_path, cert_body=ocert,
|
||||||
|
upload_date=upload_date, expiration_date=exp)
|
||||||
|
elif new_name and not new_path:
|
||||||
|
iam.update_server_cert(name, new_cert_name=new_name)
|
||||||
|
module.exit_json(changed=changed, original_name=name, new_name=new_name,
|
||||||
|
cert_path=opath, cert_body=ocert,
|
||||||
|
upload_date=upload_date, expiration_date=exp)
|
||||||
|
elif not new_name and new_path:
|
||||||
|
iam.update_server_cert(name, new_path=new_path)
|
||||||
|
module.exit_json(changed=changed, name=new_name,
|
||||||
|
original_path=opath, new_path=new_path, cert_body=ocert,
|
||||||
|
upload_date=upload_date, expiration_date=exp)
|
||||||
|
else:
|
||||||
|
changed=False
|
||||||
|
module.exit_json(changed=changed, name=name, cert_path=opath, cert_body=ocert,
|
||||||
|
upload_date=upload_date, expiration_date=exp,
|
||||||
|
msg='No new path or name specified. No changes made')
|
||||||
|
else:
|
||||||
|
changed=True
|
||||||
|
iam.upload_server_cert(name, cert, key, cert_chain=chain, path=cpath)
|
||||||
|
opath, ocert, ocert_id, upload_date, exp = cert_meta(iam, name)
|
||||||
|
module.exit_json(changed=changed, name=name, cert_path=opath, cert_body=ocert,
|
||||||
|
upload_date=upload_date, expiration_date=exp)
|
||||||
|
elif state == 'absent':
|
||||||
|
if name in orig_cert_names:
|
||||||
|
changed=True
|
||||||
|
iam.delete_server_cert(name)
|
||||||
|
module.exit_json(changed=changed, deleted_cert=name)
|
||||||
|
else:
|
||||||
|
changed=False
|
||||||
|
module.exit_json(changed=changed, msg='Certifcate with the name %s already absent' % name)
|
||||||
|
|
||||||
|
def main():
|
||||||
|
argument_spec = ec2_argument_spec()
|
||||||
|
argument_spec.update(dict(
|
||||||
|
state=dict(
|
||||||
|
default=None, required=True, choices=['present', 'absent']),
|
||||||
|
name=dict(default=None, required=False),
|
||||||
|
cert=dict(default=None, required=False),
|
||||||
|
key=dict(default=None, required=False),
|
||||||
|
cert_chain=dict(default=None, required=False),
|
||||||
|
new_name=dict(default=None, required=False),
|
||||||
|
path=dict(default='/', required=False),
|
||||||
|
new_path=dict(default=None, required=False),
|
||||||
|
dup_ok=dict(default=False, required=False, choices=[False, True])
|
||||||
|
)
|
||||||
|
)
|
||||||
|
|
||||||
|
module = AnsibleModule(
|
||||||
|
argument_spec=argument_spec,
|
||||||
|
mutually_exclusive=[],
|
||||||
|
)
|
||||||
|
|
||||||
|
if not HAS_BOTO:
|
||||||
|
module.fail_json(msg="Boto is required for this module")
|
||||||
|
|
||||||
|
ec2_url, aws_access_key, aws_secret_key, region = get_ec2_creds(module)
|
||||||
|
|
||||||
|
try:
|
||||||
|
iam = boto.iam.connection.IAMConnection(
|
||||||
|
aws_access_key_id=aws_access_key,
|
||||||
|
aws_secret_access_key=aws_secret_key,
|
||||||
|
)
|
||||||
|
except boto.exception.NoAuthHandlerFound, e:
|
||||||
|
module.fail_json(msg=str(e))
|
||||||
|
|
||||||
|
state = module.params.get('state')
|
||||||
|
name = module.params.get('name')
|
||||||
|
path = module.params.get('path')
|
||||||
|
new_name = module.params.get('new_name')
|
||||||
|
new_path = module.params.get('new_path')
|
||||||
|
cert_chain = module.params.get('cert_chain')
|
||||||
|
dup_ok = module.params.get('dup_ok')
|
||||||
|
if state == 'present':
|
||||||
|
cert = open(module.params.get('cert'), 'r').read().rstrip()
|
||||||
|
key = open(module.params.get('key'), 'r').read().rstrip()
|
||||||
|
if cert_chain is not None:
|
||||||
|
cert_chain = open(module.params.get('cert_chain'), 'r').read()
|
||||||
|
else:
|
||||||
|
key=cert=chain=None
|
||||||
|
|
||||||
|
orig_certs = [ctb['server_certificate_name'] for ctb in \
|
||||||
|
iam.get_all_server_certs().\
|
||||||
|
list_server_certificates_result.\
|
||||||
|
server_certificate_metadata_list]
|
||||||
|
orig_bodies = [iam.get_server_certificate(thing).\
|
||||||
|
get_server_certificate_result.\
|
||||||
|
certificate_body \
|
||||||
|
for thing in orig_certs]
|
||||||
|
if new_name == name:
|
||||||
|
new_name = None
|
||||||
|
if new_path == path:
|
||||||
|
new_path = None
|
||||||
|
|
||||||
|
changed = False
|
||||||
|
try:
|
||||||
|
cert_action(module, iam, name, path, new_name, new_path, state,
|
||||||
|
cert, key, cert_chain, orig_certs, orig_bodies, dup_ok)
|
||||||
|
except boto.exception.BotoServerError, err:
|
||||||
|
module.fail_json(changed=changed, msg=str(err), debug=[cert,key])
|
||||||
|
|
||||||
|
|
||||||
|
from ansible.module_utils.basic import *
|
||||||
|
from ansible.module_utils.ec2 import *
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
main()
|
||||||
@ -0,0 +1,167 @@
|
|||||||
|
#!/usr/bin/python
|
||||||
|
|
||||||
|
# Copyright (c) 2014 Hewlett-Packard Development Company, L.P.
|
||||||
|
# Copyright (c) 2013, Benno Joy <benno@ansible.com>
|
||||||
|
# Copyright (c) 2013, John Dewey <john@dewey.ws>
|
||||||
|
#
|
||||||
|
# This module is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This software is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this software. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
|
||||||
|
try:
|
||||||
|
import shade
|
||||||
|
HAS_SHADE = True
|
||||||
|
except ImportError:
|
||||||
|
HAS_SHADE = False
|
||||||
|
|
||||||
|
|
||||||
|
DOCUMENTATION = '''
|
||||||
|
---
|
||||||
|
module: os_keypair
|
||||||
|
short_description: Add/Delete a keypair from OpenStack
|
||||||
|
extends_documentation_fragment: openstack
|
||||||
|
version_added: "2.0"
|
||||||
|
description:
|
||||||
|
- Add or Remove key pair from OpenStack
|
||||||
|
options:
|
||||||
|
name:
|
||||||
|
description:
|
||||||
|
- Name that has to be given to the key pair
|
||||||
|
required: true
|
||||||
|
default: None
|
||||||
|
public_key:
|
||||||
|
description:
|
||||||
|
- The public key that would be uploaded to nova and injected into VMs
|
||||||
|
upon creation.
|
||||||
|
required: false
|
||||||
|
default: None
|
||||||
|
public_key_file:
|
||||||
|
description:
|
||||||
|
- Path to local file containing ssh public key. Mutually exclusive
|
||||||
|
with public_key.
|
||||||
|
required: false
|
||||||
|
default: None
|
||||||
|
state:
|
||||||
|
description:
|
||||||
|
- Should the resource be present or absent.
|
||||||
|
choices: [present, absent]
|
||||||
|
default: present
|
||||||
|
requirements: []
|
||||||
|
'''
|
||||||
|
|
||||||
|
EXAMPLES = '''
|
||||||
|
# Creates a key pair with the running users public key
|
||||||
|
- os_keypair:
|
||||||
|
cloud: mordred
|
||||||
|
state: present
|
||||||
|
name: ansible_key
|
||||||
|
public_key_file: /home/me/.ssh/id_rsa.pub
|
||||||
|
|
||||||
|
# Creates a new key pair and the private key returned after the run.
|
||||||
|
- os_keypair:
|
||||||
|
cloud: rax-dfw
|
||||||
|
state: present
|
||||||
|
name: ansible_key
|
||||||
|
'''
|
||||||
|
|
||||||
|
RETURN = '''
|
||||||
|
id:
|
||||||
|
description: Unique UUID.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: Name given to the keypair.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
public_key:
|
||||||
|
description: The public key value for the keypair.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
private_key:
|
||||||
|
description: The private key value for the keypair.
|
||||||
|
returned: Only when a keypair is generated for the user (e.g., when creating one
|
||||||
|
and a public key is not specified).
|
||||||
|
type: string
|
||||||
|
'''
|
||||||
|
|
||||||
|
|
||||||
|
def _system_state_change(module, keypair):
|
||||||
|
state = module.params['state']
|
||||||
|
if state == 'present' and not keypair:
|
||||||
|
return True
|
||||||
|
if state == 'absent' and keypair:
|
||||||
|
return True
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
argument_spec = openstack_full_argument_spec(
|
||||||
|
name = dict(required=True),
|
||||||
|
public_key = dict(default=None),
|
||||||
|
public_key_file = dict(default=None),
|
||||||
|
state = dict(default='present',
|
||||||
|
choices=['absent', 'present']),
|
||||||
|
)
|
||||||
|
|
||||||
|
module_kwargs = openstack_module_kwargs(
|
||||||
|
mutually_exclusive=[['public_key', 'public_key_file']])
|
||||||
|
|
||||||
|
module = AnsibleModule(argument_spec,
|
||||||
|
supports_check_mode=True,
|
||||||
|
**module_kwargs)
|
||||||
|
|
||||||
|
if not HAS_SHADE:
|
||||||
|
module.fail_json(msg='shade is required for this module')
|
||||||
|
|
||||||
|
state = module.params['state']
|
||||||
|
name = module.params['name']
|
||||||
|
public_key = module.params['public_key']
|
||||||
|
|
||||||
|
if module.params['public_key_file']:
|
||||||
|
public_key = open(module.params['public_key_file']).read()
|
||||||
|
public_key = public_key.rstrip()
|
||||||
|
|
||||||
|
try:
|
||||||
|
cloud = shade.openstack_cloud(**module.params)
|
||||||
|
keypair = cloud.get_keypair(name)
|
||||||
|
|
||||||
|
if module.check_mode:
|
||||||
|
module.exit_json(changed=_system_state_change(module, keypair))
|
||||||
|
|
||||||
|
if state == 'present':
|
||||||
|
if keypair and keypair['name'] == name:
|
||||||
|
if public_key and (public_key != keypair['public_key']):
|
||||||
|
module.fail_json(
|
||||||
|
msg="Key name %s present but key hash not the same"
|
||||||
|
" as offered. Delete key first." % name
|
||||||
|
)
|
||||||
|
else:
|
||||||
|
module.exit_json(changed=False, key=keypair)
|
||||||
|
|
||||||
|
new_key = cloud.create_keypair(name, public_key)
|
||||||
|
module.exit_json(changed=True, key=new_key)
|
||||||
|
|
||||||
|
elif state == 'absent':
|
||||||
|
if keypair:
|
||||||
|
cloud.delete_keypair(name)
|
||||||
|
module.exit_json(changed=True)
|
||||||
|
module.exit_json(changed=False)
|
||||||
|
|
||||||
|
except shade.OpenStackCloudException as e:
|
||||||
|
module.fail_json(msg=e.message)
|
||||||
|
|
||||||
|
# this is magic, see lib/ansible/module_common.py
|
||||||
|
from ansible.module_utils.basic import *
|
||||||
|
from ansible.module_utils.openstack import *
|
||||||
|
if __name__ == '__main__':
|
||||||
|
main()
|
||||||
@ -0,0 +1,21 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
set -x
|
||||||
|
|
||||||
|
CHECKOUT_DIR=".ansible-checkout"
|
||||||
|
MOD_REPO="$1"
|
||||||
|
|
||||||
|
# Hidden file to avoid the module_formatter recursing into the checkout
|
||||||
|
git clone https://github.com/ansible/ansible "$CHECKOUT_DIR"
|
||||||
|
cd "$CHECKOUT_DIR"
|
||||||
|
git submodule update --init
|
||||||
|
rm -rf "lib/ansible/modules/$MOD_REPO"
|
||||||
|
ln -s "$TRAVIS_BUILD_DIR/" "lib/ansible/modules/$MOD_REPO"
|
||||||
|
|
||||||
|
pip install -U Jinja2 PyYAML setuptools six pycrypto sphinx
|
||||||
|
|
||||||
|
. ./hacking/env-setup
|
||||||
|
PAGER=/bin/cat bin/ansible-doc -l
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
exit $?
|
||||||
|
fi
|
||||||
|
make -C docsite
|
||||||
Loading…
Reference in New Issue