mirror of https://github.com/ansible/ansible.git
NX-OS ACL interfaces module (#67505)
* Rebase * Completed integration tests * Added unit tests * Added warning detection * Updated tests * Completed tests * Linting Linting II YAML Lint Linting * Updated review changes * Updated examples, fixed reviews * Added failure condition * Resolved merge conflictpull/67915/head
Adharsh Srivats R
5 years ago
committed by
GitHub
parent
42eba3ce25
commit
f3ddf1bc95
@ -0,0 +1,91 @@
|
||||
#
|
||||
# -*- coding: utf-8 -*-
|
||||
# Copyright 2019 Red Hat
|
||||
# GNU General Public License v3.0+
|
||||
# (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
|
||||
#############################################
|
||||
# WARNING #
|
||||
#############################################
|
||||
#
|
||||
# This file is auto generated by the resource
|
||||
# module builder playbook.
|
||||
#
|
||||
# Do not edit this file manually.
|
||||
#
|
||||
# Changes to this file will be over written
|
||||
# by the resource module builder.
|
||||
#
|
||||
# Changes should be made in the model used to
|
||||
# generate this file or in the resource module
|
||||
# builder template.
|
||||
#
|
||||
#############################################
|
||||
"""
|
||||
The arg spec for the nxos_acl_interfaces module
|
||||
"""
|
||||
from __future__ import absolute_import, division, print_function
|
||||
__metaclass__ = type
|
||||
|
||||
|
||||
class Acl_interfacesArgs(object): # pylint: disable=R0903
|
||||
"""The arg spec for the nxos_acl_interfaces module
|
||||
"""
|
||||
|
||||
def __init__(self, **kwargs):
|
||||
pass
|
||||
|
||||
argument_spec = {
|
||||
'config': {
|
||||
'elements': 'dict',
|
||||
'options': {
|
||||
'access_groups': {
|
||||
'elements': 'dict',
|
||||
'options': {
|
||||
'acls': {
|
||||
'elements': 'dict',
|
||||
'options': {
|
||||
'direction': {
|
||||
'choices': ['in', 'out'],
|
||||
'required': True,
|
||||
'type': 'str'
|
||||
},
|
||||
'name': {
|
||||
'required': True,
|
||||
'type': 'str'
|
||||
},
|
||||
'port': {
|
||||
'type': 'bool'
|
||||
}
|
||||
},
|
||||
'type': 'list'
|
||||
},
|
||||
'afi': {
|
||||
'choices': ['ipv4', 'ipv6'],
|
||||
'required': True,
|
||||
'type': 'str'
|
||||
}
|
||||
},
|
||||
'type': 'list'
|
||||
},
|
||||
'name': {
|
||||
'required': True,
|
||||
'type': 'str'
|
||||
}
|
||||
},
|
||||
'type': 'list'
|
||||
},
|
||||
'running_config': {
|
||||
'type': 'str'
|
||||
},
|
||||
'state': {
|
||||
'choices': [
|
||||
'deleted', 'gathered', 'merged', 'overridden', 'rendered',
|
||||
'replaced', 'parsed'
|
||||
],
|
||||
'default':
|
||||
'merged',
|
||||
'type':
|
||||
'str'
|
||||
}
|
||||
} # pylint: disable=C0301
|
||||
@ -0,0 +1,303 @@
|
||||
#
|
||||
# -*- coding: utf-8 -*-
|
||||
# Copyright 2019 Red Hat
|
||||
# GNU General Public License v3.0+
|
||||
# (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
"""
|
||||
The nxos_acl_interfaces class
|
||||
It is in this file where the current configuration (as dict)
|
||||
is compared to the provided configuration (as dict) and the command set
|
||||
necessary to bring the current configuration to it's desired end-state is
|
||||
created
|
||||
"""
|
||||
from __future__ import absolute_import, division, print_function
|
||||
__metaclass__ = type
|
||||
|
||||
from ansible.module_utils.network.common.cfg.base import ConfigBase
|
||||
from ansible.module_utils.network.common.utils import to_list, remove_empties, dict_diff
|
||||
from ansible.module_utils.network.nxos.facts.facts import Facts
|
||||
from ansible.module_utils.network.nxos.utils.utils import flatten_dict, search_obj_in_list, get_interface_type, normalize_interface
|
||||
|
||||
|
||||
class Acl_interfaces(ConfigBase):
|
||||
"""
|
||||
The nxos_acl_interfaces class
|
||||
"""
|
||||
|
||||
gather_subset = [
|
||||
'!all',
|
||||
'!min',
|
||||
]
|
||||
|
||||
gather_network_resources = [
|
||||
'acl_interfaces',
|
||||
]
|
||||
|
||||
def __init__(self, module):
|
||||
super(Acl_interfaces, self).__init__(module)
|
||||
|
||||
def get_acl_interfaces_facts(self, data=None):
|
||||
""" Get the 'facts' (the current configuration)
|
||||
|
||||
:rtype: A dictionary
|
||||
:returns: The current configuration as a dictionary
|
||||
"""
|
||||
facts, _warnings = Facts(self._module).get_facts(
|
||||
self.gather_subset, self.gather_network_resources, data=data)
|
||||
acl_interfaces_facts = facts['ansible_network_resources'].get(
|
||||
'acl_interfaces')
|
||||
if not acl_interfaces_facts:
|
||||
return []
|
||||
return acl_interfaces_facts
|
||||
|
||||
def edit_config(self, commands):
|
||||
"""Wrapper method for `_connection.edit_config()`
|
||||
This exists solely to allow the unit test framework to mock device connection calls.
|
||||
"""
|
||||
return self._connection.edit_config(commands)
|
||||
|
||||
def execute_module(self):
|
||||
""" Execute the module
|
||||
|
||||
:rtype: A dictionary
|
||||
:returns: The result from module execution
|
||||
"""
|
||||
result = {'changed': False}
|
||||
warnings = list()
|
||||
commands = list()
|
||||
state = self._module.params['state']
|
||||
action_states = ['merged', 'replaced', 'deleted', 'overridden']
|
||||
|
||||
if state == 'gathered':
|
||||
result['gathered'] = self.get_acl_interfaces_facts()
|
||||
elif state == 'rendered':
|
||||
result['rendered'] = self.set_config({})
|
||||
# no need to fetch facts for rendered
|
||||
elif state == 'parsed':
|
||||
result['parsed'] = self.set_config({})
|
||||
# no need to fetch facts for parsed
|
||||
else:
|
||||
existing_acl_interfaces_facts = self.get_acl_interfaces_facts()
|
||||
commands.extend(self.set_config(existing_acl_interfaces_facts))
|
||||
if commands and state in action_states:
|
||||
if not self._module.check_mode:
|
||||
self._connection.edit_config(commands)
|
||||
result['changed'] = True
|
||||
result['before'] = existing_acl_interfaces_facts
|
||||
result['commands'] = commands
|
||||
|
||||
changed_acl_interfaces_facts = self.get_acl_interfaces_facts()
|
||||
if result['changed']:
|
||||
result['after'] = changed_acl_interfaces_facts
|
||||
result['warnings'] = warnings
|
||||
return result
|
||||
|
||||
def set_config(self, existing_acl_interfaces_facts):
|
||||
""" Collect the configuration from the args passed to the module,
|
||||
collect the current configuration (as a dict from facts)
|
||||
|
||||
:rtype: A list
|
||||
:returns: the commands necessary to migrate the current configuration
|
||||
to the desired configuration
|
||||
"""
|
||||
config = self._module.params['config']
|
||||
want = []
|
||||
if config:
|
||||
for w in config:
|
||||
if get_interface_type(w['name']) == 'loopback':
|
||||
self._module.fail_json(
|
||||
msg='This module works with ethernet, management or port-channe')
|
||||
w.update({'name': normalize_interface(w['name'])})
|
||||
want.append(remove_empties(w))
|
||||
have = existing_acl_interfaces_facts
|
||||
resp = self.set_state(want, have)
|
||||
return to_list(resp)
|
||||
|
||||
def set_state(self, want, have):
|
||||
""" Select the appropriate function based on the state provided
|
||||
|
||||
:param want: the desired configuration as a dictionary
|
||||
:param have: the current configuration as a dictionary
|
||||
:rtype: A list
|
||||
:returns: the commands necessary to migrate the current configuration
|
||||
to the desired configuration
|
||||
"""
|
||||
state = self._module.params['state']
|
||||
commands = []
|
||||
if state == 'overridden':
|
||||
commands = (self._state_overridden(want, have))
|
||||
elif state == 'deleted':
|
||||
commands = (self._state_deleted(want, have))
|
||||
elif state == 'rendered':
|
||||
commands = self._state_rendered(want)
|
||||
elif state == 'parsed':
|
||||
want = self._module.params['running_config']
|
||||
commands = self._state_parsed(want)
|
||||
else:
|
||||
for w in want:
|
||||
if state == 'merged':
|
||||
commands.extend(self._state_merged(w, have))
|
||||
elif state == 'replaced':
|
||||
commands.extend(self._state_replaced(w, have))
|
||||
return commands
|
||||
|
||||
def _state_parsed(self, want):
|
||||
return self.get_acl_interfaces_facts(want)
|
||||
|
||||
def _state_rendered(self, want):
|
||||
commands = []
|
||||
for w in want:
|
||||
commands.extend(self.set_commands(w, {}))
|
||||
return commands
|
||||
|
||||
def _state_replaced(self, want, have):
|
||||
""" The command generator when state is replaced
|
||||
|
||||
:rtype: A list
|
||||
:returns: the commands necessary to migrate the current configuration
|
||||
to the desired configuration
|
||||
"""
|
||||
new_commands = []
|
||||
del_dict = {'name': want['name'], 'access_groups': []}
|
||||
obj_in_have = search_obj_in_list(want['name'], have, 'name')
|
||||
if obj_in_have != want:
|
||||
commands = []
|
||||
if obj_in_have and 'access_groups' in obj_in_have.keys():
|
||||
for ag in obj_in_have['access_groups']:
|
||||
want_afi = []
|
||||
if want.get('access_groups'):
|
||||
want_afi = search_obj_in_list(
|
||||
ag['afi'], want['access_groups'], 'afi')
|
||||
if not want_afi:
|
||||
# whatever in have is not in want
|
||||
del_dict['access_groups'].append(ag)
|
||||
else:
|
||||
del_acl = []
|
||||
for acl in ag['acls']:
|
||||
if want_afi.get('acls'):
|
||||
if acl not in want_afi['acls']:
|
||||
del_acl.append(acl)
|
||||
else:
|
||||
del_acl.append(acl)
|
||||
afi = want_afi['afi']
|
||||
del_dict['access_groups'].append(
|
||||
{'afi': afi, 'acls': del_acl})
|
||||
|
||||
commands.extend(self._state_deleted([del_dict], have))
|
||||
commands.extend(self._state_merged(want, have))
|
||||
new_commands.append(commands[0])
|
||||
commands = [commands[i]
|
||||
for i in range(1, len(commands)) if commands[i] != commands[0]]
|
||||
new_commands.extend(commands)
|
||||
return new_commands
|
||||
|
||||
def _state_overridden(self, want, have):
|
||||
""" The command generator when state is overridden
|
||||
|
||||
:rtype: A list
|
||||
:returns: the commands necessary to migrate the current configuration
|
||||
to the desired configuration
|
||||
"""
|
||||
commands = []
|
||||
want_intf = [w['name'] for w in want]
|
||||
for h in have:
|
||||
if h['name'] not in want_intf:
|
||||
commands.extend(self._state_deleted([h], have))
|
||||
for w in want:
|
||||
commands.extend(self._state_replaced(w, have))
|
||||
return commands
|
||||
|
||||
def _state_merged(self, want, have):
|
||||
""" The command generator when state is merged
|
||||
|
||||
:rtype: A list
|
||||
:returns: the commands necessary to merge the provided into
|
||||
the current configuration
|
||||
"""
|
||||
return self.set_commands(want, have)
|
||||
|
||||
def set_commands(self, want, have, deleted=False):
|
||||
commands = []
|
||||
have_name = search_obj_in_list(want['name'], have, 'name')
|
||||
if have_name and have_name.get('access_groups'):
|
||||
if want.get('access_groups'):
|
||||
for w_afi in want['access_groups']:
|
||||
ip = 'ipv6'
|
||||
if w_afi['afi'] == 'ipv4':
|
||||
ip = 'ip'
|
||||
have_afi = search_obj_in_list(
|
||||
w_afi['afi'], have_name['access_groups'], 'afi')
|
||||
if have_afi:
|
||||
new_acls = []
|
||||
if deleted:
|
||||
if w_afi.get('acls') and have_afi.get('acls'):
|
||||
new_acls = [
|
||||
acl for acl in w_afi.get('acls') if acl in have_afi.get('acls')]
|
||||
elif 'acls' not in w_afi.keys():
|
||||
new_acls = have_afi.get('acls')
|
||||
else:
|
||||
if w_afi.get('acls'):
|
||||
new_acls = [
|
||||
acl for acl in w_afi['acls'] if acl not in have_afi['acls']]
|
||||
commands.extend(self.process_acl(
|
||||
new_acls, ip, deleted))
|
||||
else:
|
||||
if not deleted:
|
||||
if w_afi.get('acls'):
|
||||
commands.extend(
|
||||
self.process_acl(w_afi['acls'], ip))
|
||||
else:
|
||||
# only name is given to delete
|
||||
if deleted and 'access_groups' in have_name.keys():
|
||||
commands.extend(self.process_access_group(have_name, True))
|
||||
else:
|
||||
if not deleted: # and 'access_groups' in have_name.keys():
|
||||
commands.extend(self.process_access_group(want))
|
||||
|
||||
if len(commands) > 0:
|
||||
commands.insert(0, 'interface ' + want['name'])
|
||||
return commands
|
||||
|
||||
def process_access_group(self, item, deleted=False):
|
||||
commands = []
|
||||
for ag in item['access_groups']:
|
||||
ip = 'ipv6'
|
||||
if ag['afi'] == 'ipv4':
|
||||
ip = 'ip'
|
||||
if ag.get('acls'):
|
||||
commands.extend(self.process_acl(
|
||||
ag['acls'], ip, deleted))
|
||||
return commands
|
||||
|
||||
def process_acl(self, acls, ip, deleted=False):
|
||||
commands = []
|
||||
no = ''
|
||||
if deleted:
|
||||
no = 'no '
|
||||
for acl in acls:
|
||||
port = ''
|
||||
if acl.get('port'):
|
||||
port = ' port'
|
||||
ag = ' access-group '
|
||||
if ip == 'ipv6':
|
||||
ag = ' traffic-filter '
|
||||
commands.append(no + ip + port + ag +
|
||||
acl['name'] + ' ' + acl['direction'])
|
||||
return commands
|
||||
|
||||
def _state_deleted(self, main_want, have):
|
||||
""" The command generator when state is deleted
|
||||
|
||||
:rtype: A list
|
||||
:returns: the commands necessary to remove the current configuration
|
||||
of the provided objects
|
||||
"""
|
||||
commands = []
|
||||
if main_want:
|
||||
for want in main_want:
|
||||
commands.extend(self.set_commands(want, have, deleted=True))
|
||||
else:
|
||||
for h in have:
|
||||
commands.extend(self.set_commands(h, have, deleted=True))
|
||||
|
||||
return commands
|
||||
@ -0,0 +1,119 @@
|
||||
#
|
||||
# -*- coding: utf-8 -*-
|
||||
# Copyright 2019 Red Hat
|
||||
# GNU General Public License v3.0+
|
||||
# (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
"""
|
||||
The nxos acl_interfaces fact class
|
||||
It is in this file the configuration is collected from the device
|
||||
for a given resource, parsed, and the facts tree is populated
|
||||
based on the configuration.
|
||||
"""
|
||||
from __future__ import absolute_import, division, print_function
|
||||
__metaclass__ = type
|
||||
|
||||
import re
|
||||
from copy import deepcopy
|
||||
from ansible.module_utils.network.common import utils
|
||||
from ansible.module_utils.network.nxos.argspec.acl_interfaces.acl_interfaces import Acl_interfacesArgs
|
||||
from ansible.module_utils.network.nxos.utils.utils import normalize_interface
|
||||
|
||||
|
||||
class Acl_interfacesFacts(object):
|
||||
""" The nxos acl_interfaces fact class
|
||||
"""
|
||||
|
||||
def __init__(self, module, subspec='config', options='options'):
|
||||
self._module = module
|
||||
self.argument_spec = Acl_interfacesArgs.argument_spec
|
||||
spec = deepcopy(self.argument_spec)
|
||||
if subspec:
|
||||
if options:
|
||||
facts_argument_spec = spec[subspec][options]
|
||||
else:
|
||||
facts_argument_spec = spec[subspec]
|
||||
else:
|
||||
facts_argument_spec = spec
|
||||
|
||||
self.generated_spec = utils.generate_dict(facts_argument_spec)
|
||||
|
||||
def get_device_data(self, connection):
|
||||
return connection.get('show running-config | section interface')
|
||||
|
||||
def populate_facts(self, connection, ansible_facts, data=None):
|
||||
""" Populate the facts for acl_interfaces
|
||||
:param connection: the device connection
|
||||
:param ansible_facts: Facts dictionary
|
||||
:param data: previously collected conf
|
||||
:rtype: dictionary
|
||||
:returns: facts
|
||||
"""
|
||||
if not data:
|
||||
data = self.get_device_data(connection)
|
||||
data = data.split('interface')
|
||||
|
||||
resources = []
|
||||
for i in range(len(data)):
|
||||
intf = data[i].split('\n')
|
||||
for l in range(1, len(intf)):
|
||||
if not re.search('ip(v6)?( port)? (access-group|traffic-filter)', intf[l]):
|
||||
intf[l] = ''
|
||||
intf = list(filter(None, intf))
|
||||
resources.append(intf)
|
||||
|
||||
objs = []
|
||||
for resource in resources:
|
||||
if resource:
|
||||
obj = self.render_config(self.generated_spec, resource)
|
||||
if obj:
|
||||
objs.append(obj)
|
||||
|
||||
ansible_facts['ansible_network_resources'].pop('acl_interfaces', None)
|
||||
facts = {}
|
||||
if objs:
|
||||
params = utils.validate_config(
|
||||
self.argument_spec, {'config': objs})
|
||||
params = utils.remove_empties(params)
|
||||
facts['acl_interfaces'] = params['config']
|
||||
|
||||
ansible_facts['ansible_network_resources'].update(facts)
|
||||
return ansible_facts
|
||||
|
||||
def render_config(self, spec, conf):
|
||||
"""
|
||||
Render config as dictionary structure and delete keys
|
||||
from spec for null values
|
||||
|
||||
:param spec: The facts tree, generated from the argspec
|
||||
:param conf: The configuration
|
||||
:rtype: dictionary
|
||||
:returns: The generated config
|
||||
"""
|
||||
config = deepcopy(spec)
|
||||
name = conf[0].strip()
|
||||
config['name'] = normalize_interface(name)
|
||||
config['access_groups'] = []
|
||||
v4 = {'afi': 'ipv4', 'acls': []}
|
||||
v6 = {'afi': 'ipv6', 'acls': []}
|
||||
for c in conf[1:]:
|
||||
if c:
|
||||
acl4 = re.search(r'ip( port)? access-group (\w*) (\w*)', c)
|
||||
acl6 = re.search(r'ipv6( port)? traffic-filter (\w*) (\w*)', c)
|
||||
if acl4:
|
||||
acl = {'name': acl4.group(2).strip(
|
||||
), 'direction': acl4.group(3).strip()}
|
||||
if acl4.group(1):
|
||||
acl.update({'port': True})
|
||||
v4['acls'].append(acl)
|
||||
elif acl6:
|
||||
acl = {'name': acl6.group(2), 'direction': acl6.group(3)}
|
||||
if acl6.group(1):
|
||||
acl.update({'port': True})
|
||||
v6['acls'].append(acl)
|
||||
|
||||
if len(v4['acls']) > 0:
|
||||
config['access_groups'].append(v4)
|
||||
if len(v6['acls']) > 0:
|
||||
config['access_groups'].append(v6)
|
||||
|
||||
return utils.remove_empties(config)
|
||||
@ -0,0 +1,408 @@
|
||||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
# Copyright 2019 Red Hat
|
||||
# GNU General Public License v3.0+
|
||||
# (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
|
||||
#############################################
|
||||
# WARNING #
|
||||
#############################################
|
||||
#
|
||||
# This file is auto generated by the resource
|
||||
# module builder playbook.
|
||||
#
|
||||
# Do not edit this file manually.
|
||||
#
|
||||
# Changes to this file will be over written
|
||||
# by the resource module builder.
|
||||
#
|
||||
# Changes should be made in the model used to
|
||||
# generate this file or in the resource module
|
||||
# builder template.
|
||||
#
|
||||
#############################################
|
||||
|
||||
"""
|
||||
The module file for nxos_acl_interfaces
|
||||
"""
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
__metaclass__ = type
|
||||
|
||||
ANSIBLE_METADATA = {
|
||||
'metadata_version': '1.1',
|
||||
'status': ['preview'],
|
||||
'supported_by': 'network'
|
||||
}
|
||||
|
||||
DOCUMENTATION = """
|
||||
---
|
||||
module: nxos_acl_interfaces
|
||||
version_added: '2.10'
|
||||
short_description: Add and remove Access Control Lists on interfaces in NX-OS platform
|
||||
description: Add and remove Access Control Lists on interfaces in NX-OS platform
|
||||
author: Adharsh Srivats Rangarajan (@adharshsrivatsr)
|
||||
notes:
|
||||
- Tested against NX-OS 7.3.(0)D1(1) on VIRL
|
||||
options:
|
||||
running_config:
|
||||
description:
|
||||
- Used to parse given commands into structured format, only in parsed state
|
||||
type: str
|
||||
config:
|
||||
description: A list of interfaces to be configured with ACLs
|
||||
type: list
|
||||
elements: dict
|
||||
suboptions:
|
||||
name:
|
||||
description: Name of the interface
|
||||
type: str
|
||||
required: true
|
||||
access_groups:
|
||||
description: List of address family indicators with ACLs to be configured on the interface
|
||||
type: list
|
||||
elements: dict
|
||||
suboptions:
|
||||
afi:
|
||||
description: Address Family Indicator of the ACLs to be configured
|
||||
type: str
|
||||
required: true
|
||||
choices: ['ipv4','ipv6']
|
||||
acls:
|
||||
description: List of Access Control Lists for the interface
|
||||
type: list
|
||||
elements: dict
|
||||
suboptions:
|
||||
name:
|
||||
description: Name of the ACL to be added/removed
|
||||
type: str
|
||||
required: true
|
||||
direction:
|
||||
description: Direction to be applied for the ACL
|
||||
type: str
|
||||
required: true
|
||||
choices: ['in','out']
|
||||
port:
|
||||
description: Use ACL as port policy.
|
||||
type: bool
|
||||
state:
|
||||
description: The state the configuration should be left in
|
||||
type: str
|
||||
choices:
|
||||
- deleted
|
||||
- gathered
|
||||
- merged
|
||||
- overridden
|
||||
- rendered
|
||||
- replaced
|
||||
- parsed
|
||||
default: merged
|
||||
"""
|
||||
EXAMPLES = """# Using merged
|
||||
|
||||
# Before state:
|
||||
# ------------
|
||||
#
|
||||
|
||||
- name: Merge ACL interfaces configuration
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
- name: Ethernet1/2
|
||||
access_groups:
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
|
||||
- name: Eth1/5
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: PortACL
|
||||
direction: in
|
||||
port: true
|
||||
|
||||
- name: ACL1v4
|
||||
direction: out
|
||||
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
state: merged
|
||||
|
||||
# After state:
|
||||
# ------------
|
||||
# interface Ethernet1/2
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
# interface Ethernet1/5
|
||||
# ip port access-group PortACL in
|
||||
# ip access-group ACL1v4 out
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
|
||||
# Using replaced
|
||||
|
||||
# Before state:
|
||||
# ------------
|
||||
# interface Ethernet1/2
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
# interface Ethernet1/5
|
||||
# ip port access-group PortACL in
|
||||
# ip access-group ACL1v4 out
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
|
||||
- name: Replace interface configuration with given configuration
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
- name: Eth1/5
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: NewACLv4
|
||||
direction: out
|
||||
|
||||
- name: Ethernet1/3
|
||||
access_groups:
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: NewACLv6
|
||||
direction: in
|
||||
port: true
|
||||
state: replaced
|
||||
|
||||
# After state:
|
||||
# ------------
|
||||
# interface Ethernet1/2
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
# interface Ethernet1/3
|
||||
# ipv6 port traffic-filter NewACLv6 in
|
||||
# interface Ethernet1/5
|
||||
# ip access-group NewACLv4 out
|
||||
|
||||
# Using overridden
|
||||
|
||||
# Before state:
|
||||
# ------------
|
||||
# interface Ethernet1/2
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
# interface Ethernet1/5
|
||||
# ip port access-group PortACL in
|
||||
# ip access-group ACL1v4 out
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
|
||||
- name: Override interface configuration with given configuration
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
- name: Ethernet1/3
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: ACL1v4
|
||||
direction: out
|
||||
|
||||
- name: PortACL
|
||||
port: true
|
||||
direction: in
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: NewACLv6
|
||||
direction: in
|
||||
port: true
|
||||
state: overridden
|
||||
|
||||
# After state:
|
||||
# ------------
|
||||
# interface Ethernet1/3
|
||||
# ip access-group ACL1v4 out
|
||||
# ip port access-group PortACL in
|
||||
# ipv6 port traffic-filter NewACLv6 in
|
||||
|
||||
# Using deleted
|
||||
|
||||
# Before state:
|
||||
# -------------
|
||||
# interface Ethernet1/2
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
# interface Ethernet1/5
|
||||
# ip port access-group PortACL in
|
||||
# ip access-group ACL1v4 out
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
|
||||
- name: Delete ACL configuration on interfaces
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
- name: Ethernet1/5
|
||||
access_groups:
|
||||
- afi: ipv6
|
||||
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: ACL1v4
|
||||
direction: out
|
||||
|
||||
- name: Ethernet1/2
|
||||
state: deleted
|
||||
|
||||
# After state:
|
||||
# -------------
|
||||
# interface Ethernet1/2
|
||||
# interface Ethernet1/5
|
||||
# ip port access-group PortACL in
|
||||
# ip access-group ACL1v4 out
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
|
||||
# Using parsed
|
||||
|
||||
- name: Parse given configuration into structured format
|
||||
nxos_acl_interfaces:
|
||||
running_config: |
|
||||
interface Ethernet1/2
|
||||
ipv6 traffic-filter ACL1v6 in
|
||||
interface Ethernet1/5
|
||||
ipv6 traffic-filter ACL1v6 in
|
||||
ip access-group ACL1v4 out
|
||||
ip port access-group PortACL in
|
||||
state: parsed
|
||||
|
||||
# returns
|
||||
# parsed:
|
||||
# - name: Ethernet1/2
|
||||
# access_groups:
|
||||
# - afi: ipv6
|
||||
# acls:
|
||||
# - name: ACL1v6
|
||||
# direction: in
|
||||
# - name: Ethernet1/5
|
||||
# access_groups:
|
||||
# - afi: ipv4
|
||||
# acls:
|
||||
# - name: PortACL
|
||||
# direction: in
|
||||
# port: True
|
||||
# - name: ACL1v4
|
||||
# direction: out
|
||||
# - afi: ipv6
|
||||
# acls:
|
||||
# - name: ACL1v6
|
||||
# direction: in
|
||||
|
||||
|
||||
# Using gathered:
|
||||
|
||||
# Before state:
|
||||
# ------------
|
||||
# interface Ethernet1/2
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
# interface Ethernet1/5
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
# ip access-group ACL1v4 out
|
||||
# ip port access-group PortACL in
|
||||
|
||||
- name: Gather existing configuration from device
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
state: gathered
|
||||
|
||||
# returns
|
||||
# gathered:
|
||||
# - name: Ethernet1/2
|
||||
# access_groups:
|
||||
# - afi: ipv6
|
||||
# acls:
|
||||
# - name: ACL1v6
|
||||
# direction: in
|
||||
# - name: Ethernet1/5
|
||||
# access_groups:
|
||||
# - afi: ipv4
|
||||
# acls:
|
||||
# - name: PortACL
|
||||
# direction: in
|
||||
# port: True
|
||||
# - name: ACL1v4
|
||||
# direction: out
|
||||
# - afi: ipv6
|
||||
# acls:
|
||||
# - name: ACL1v6
|
||||
# direction: in
|
||||
|
||||
|
||||
# Using rendered
|
||||
|
||||
- name: Render required configuration to be pushed to the device
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
- name: Ethernet1/2
|
||||
access_groups:
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
|
||||
- name: Ethernet1/5
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: PortACL
|
||||
direction: in
|
||||
port: true
|
||||
- name: ACL1v4
|
||||
direction: out
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
state: rendered
|
||||
|
||||
# returns
|
||||
# rendered:
|
||||
# interface Ethernet1/2
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
# interface Ethernet1/5
|
||||
# ipv6 traffic-filter ACL1v6 in
|
||||
# ip access-group ACL1v4 out
|
||||
# ip port access-group PortACL in
|
||||
|
||||
"""
|
||||
RETURN = """
|
||||
before:
|
||||
description: The configuration prior to the model invocation.
|
||||
returned: always
|
||||
type: dict
|
||||
sample: >
|
||||
The configuration returned will always be in the same format
|
||||
of the parameters above.
|
||||
after:
|
||||
description: The resulting configuration model invocation.
|
||||
returned: when changed
|
||||
type: dict
|
||||
sample: >
|
||||
The configuration returned will always be in the same format
|
||||
of the parameters above.
|
||||
commands:
|
||||
description: The set of commands pushed to the remote device.
|
||||
returned: always
|
||||
type: list
|
||||
sample: ['interface Ethernet1/2', 'ipv6 traffic-filter ACL1v6 out', 'ip port access-group PortACL in']
|
||||
"""
|
||||
|
||||
|
||||
from ansible.module_utils.basic import AnsibleModule
|
||||
from ansible.module_utils.network.nxos.argspec.acl_interfaces.acl_interfaces import Acl_interfacesArgs
|
||||
from ansible.module_utils.network.nxos.config.acl_interfaces.acl_interfaces import Acl_interfaces
|
||||
|
||||
|
||||
def main():
|
||||
"""
|
||||
Main entry point for module execution
|
||||
|
||||
:returns: the result form module invocation
|
||||
"""
|
||||
module = AnsibleModule(argument_spec=Acl_interfacesArgs.argument_spec,
|
||||
supports_check_mode=True)
|
||||
|
||||
result = Acl_interfaces(module).execute_module()
|
||||
module.exit_json(**result)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
@ -0,0 +1,2 @@
|
||||
---
|
||||
testcase: "*"
|
||||
@ -0,0 +1,2 @@
|
||||
dependencies:
|
||||
- prepare_nxos_tests
|
||||
@ -0,0 +1,20 @@
|
||||
---
|
||||
- name: collect cli test cases
|
||||
find:
|
||||
paths: "{{ role_path }}/tests/cli"
|
||||
patterns: "{{ testcase }}.yml"
|
||||
connection: local
|
||||
register: test_cases
|
||||
|
||||
- set_fact:
|
||||
test_cases:
|
||||
files: "{{ test_cases.files }}"
|
||||
|
||||
- name: set test_items
|
||||
set_fact: test_items="{{ test_cases.files | map(attribute='path') | list }}"
|
||||
|
||||
- name: run test cases (connection=network_cli)
|
||||
include: "{{ test_case_to_run }} ansible_connection=network_cli connection={{ cli }}"
|
||||
with_items: "{{ test_items }}"
|
||||
loop_control:
|
||||
loop_var: test_case_to_run
|
||||
@ -0,0 +1,2 @@
|
||||
---
|
||||
- { include: cli.yaml, tags: ['cli'] }
|
||||
@ -0,0 +1,90 @@
|
||||
---
|
||||
- debug:
|
||||
msg: "Start nxos_acl_interfaces deleted integration tests connection = {{ansible_connection}}"
|
||||
|
||||
- include_tasks: populate_config.yaml
|
||||
|
||||
- block:
|
||||
- name: Delete single ACL from an interface
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
- name: Ethernet1/5
|
||||
access_groups:
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
state: deleted
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == true"
|
||||
- "'interface Ethernet1/5' in result.commands"
|
||||
- "'no ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
- "result.commands | length ==2"
|
||||
|
||||
- name: Delete all ACLs of given AFI from an interface
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
- name: Ethernet1/5
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
state: deleted
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == true"
|
||||
- "'interface Ethernet1/5' in result.commands"
|
||||
- "'no ip port access-group PortACL in' in result.commands"
|
||||
- "'no ip access-group ACL1v4 out' in result.commands"
|
||||
- "result.commands | length ==3"
|
||||
|
||||
- name: Delete all ACLs configuration from given interface
|
||||
nxos_acl_interfaces: &deleted
|
||||
config:
|
||||
- name: Ethernet1/2
|
||||
state: deleted
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == True"
|
||||
- "'interface Ethernet1/2' in result.commands"
|
||||
- "'no ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
- "result.commands | length == 2"
|
||||
|
||||
- include_tasks: populate_config.yaml
|
||||
|
||||
- name: Delete all ACLs from all interfaces (from all interfaces)
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
state: deleted
|
||||
register: result
|
||||
|
||||
- name: Gather acl interfaces facts
|
||||
nxos_facts: &facts
|
||||
gather_subset:
|
||||
- "!all"
|
||||
- "!min"
|
||||
gather_network_resources: acl_interfaces
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == True"
|
||||
- "ansible_facts.network_resources.acl_interfaces == result.after"
|
||||
|
||||
- name: Gather acls facts
|
||||
nxos_facts: *facts
|
||||
|
||||
- name: Idempotence - deleted
|
||||
nxos_acl_interfaces: *deleted
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == false"
|
||||
|
||||
always:
|
||||
- include_tasks: remove_config.yaml
|
||||
@ -0,0 +1,34 @@
|
||||
---
|
||||
- debug:
|
||||
msg: Start nxos_acl_interfaces gathered integration tests connection={{ansible_connection}}"
|
||||
|
||||
- include_tasks: populate_config.yaml
|
||||
|
||||
- block:
|
||||
- name: Gather acl interfaces facts
|
||||
nxos_facts: &facts
|
||||
gather_subset:
|
||||
- "!all"
|
||||
- "!min"
|
||||
gather_network_resources: acl_interfaces
|
||||
|
||||
- name: Gathered
|
||||
nxos_acl_interfaces: &gathered
|
||||
state: gathered
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == false"
|
||||
- "ansible_facts.network_resources.acl_interfaces == result.gathered"
|
||||
|
||||
- name: Idempotence - Gathered
|
||||
nxos_acl_interfaces: *gathered
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == false"
|
||||
|
||||
always:
|
||||
- include_tasks: remove_config.yaml
|
||||
@ -0,0 +1,63 @@
|
||||
---
|
||||
- debug:
|
||||
msg: "Start nxos_acl_interfaces merged integration tests connection = {{ansible_connection}}"
|
||||
|
||||
- include_tasks: populate_acl.yaml
|
||||
|
||||
- block:
|
||||
- name: Gather acl interfaces facts
|
||||
nxos_facts:
|
||||
gather_subset:
|
||||
- "!all"
|
||||
- "!min"
|
||||
gather_network_resources: acl_interfaces
|
||||
|
||||
- name: Merged
|
||||
nxos_acl_interfaces: &merged
|
||||
config:
|
||||
- name: Ethernet1/2
|
||||
access_groups:
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
|
||||
- name: Eth1/5
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: PortACL
|
||||
direction: in
|
||||
port: True
|
||||
|
||||
- name: ACL1v4
|
||||
direction: out
|
||||
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
state: merged
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == True"
|
||||
- "'interface Ethernet1/2' in result.commands"
|
||||
- "'ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
- "'interface Ethernet1/5' in result.commands"
|
||||
- "'ip port access-group PortACL in' in result.commands"
|
||||
- "'ip access-group ACL1v4 out' in result.commands"
|
||||
- "'ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
- "result.commands | length == 6 "
|
||||
|
||||
- name: Idempotence - Merged
|
||||
nxos_acl_interfaces: *merged
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == false"
|
||||
|
||||
always:
|
||||
- include_tasks: remove_config.yaml
|
||||
@ -0,0 +1,68 @@
|
||||
---
|
||||
- debug:
|
||||
msg: "Start nxos_acl_interfaces overridden integration tests connection = {{ansible_connection}}"
|
||||
|
||||
- include_tasks: populate_config.yaml
|
||||
|
||||
- block:
|
||||
- name: Overridden
|
||||
nxos_acl_interfaces: &overridden
|
||||
config:
|
||||
- name: Ethernet1/3
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: ACL1v4
|
||||
direction: out
|
||||
|
||||
- name: PortACL
|
||||
port: true
|
||||
direction: in
|
||||
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: NewACLv6
|
||||
direction: in
|
||||
port: true
|
||||
state: overridden
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == True"
|
||||
- "'interface Ethernet1/2' in result.commands"
|
||||
- "'no ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
- "'interface Ethernet1/5' in result.commands"
|
||||
- "'no ip access-group ACL1v4 out' in result.commands"
|
||||
- "'no ip port access-group PortACL in' in result.commands"
|
||||
- "'no ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
- "'interface Ethernet1/3' in result.commands"
|
||||
- "'ip access-group ACL1v4 out' in result.commands"
|
||||
- "'ip port access-group PortACL in' in result.commands"
|
||||
- "'ipv6 port traffic-filter NewACLv6 in' in result.commands"
|
||||
- "result.commands | length == 10"
|
||||
|
||||
- name: Gather acl_interfaces post facts
|
||||
nxos_facts: &facts
|
||||
gather_subset:
|
||||
- "!all"
|
||||
- "!min"
|
||||
gather_network_resources: acl_interfaces
|
||||
|
||||
- name: Gather acls post facts
|
||||
nxos_facts: *facts
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "ansible_facts.network_resources.acl_interfaces == result.after"
|
||||
|
||||
- name: Idempotence - overridden
|
||||
nxos_acl_interfaces: *overridden
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == false"
|
||||
|
||||
always:
|
||||
- include_tasks: remove_config.yaml
|
||||
@ -0,0 +1,40 @@
|
||||
---
|
||||
- debug:
|
||||
msg: Start nxos_acl_interfaces parsed integration tests connection={{ansible_connection}}"
|
||||
|
||||
- include_tasks: populate_config.yaml
|
||||
|
||||
- block:
|
||||
- name: Gather acl interfaces facts
|
||||
nxos_facts: &facts
|
||||
gather_subset:
|
||||
- "!all"
|
||||
- "!min"
|
||||
gather_network_resources: acl_interfaces
|
||||
|
||||
- name: Parsed
|
||||
nxos_acl_interfaces: &parsed
|
||||
running_config: |
|
||||
interface Ethernet1/2
|
||||
ipv6 traffic-filter ACL1v6 in
|
||||
interface Ethernet1/5
|
||||
ipv6 traffic-filter ACL1v6 in
|
||||
ip access-group ACL1v4 out
|
||||
ip port access-group PortACL in
|
||||
state: parsed
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == false"
|
||||
- "result.parsed == parsed"
|
||||
|
||||
- name: Idempotence - Parsed
|
||||
nxos_acl_interfaces: *parsed
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that: "result.changed == false"
|
||||
|
||||
always:
|
||||
- include_tasks: remove_config.yaml
|
||||
@ -0,0 +1,9 @@
|
||||
---
|
||||
- name: Adding base configuration
|
||||
cli_config:
|
||||
config: |
|
||||
ip access-list ACL1v4
|
||||
ip access-list NewACLv4
|
||||
ipv6 access-list ACL1v6
|
||||
ipv6 access-list NewACLv6
|
||||
ip access-list PortACL
|
||||
@ -0,0 +1,15 @@
|
||||
---
|
||||
- name: Adding base configuration
|
||||
cli_config:
|
||||
config: |
|
||||
ip access-list ACL1v4
|
||||
ip access-list NewACLv4
|
||||
ipv6 access-list ACL1v6
|
||||
ipv6 access-list NewACLv6
|
||||
ip access-list PortACL
|
||||
interface Ethernet1/2
|
||||
ipv6 traffic-filter ACL1v6 in
|
||||
interface Ethernet1/5
|
||||
ip port access-group PortACL in
|
||||
ip access-group ACL1v4 out
|
||||
ipv6 traffic-filter ACL1v6 in
|
||||
@ -0,0 +1,21 @@
|
||||
---
|
||||
- name: Remove config
|
||||
cli_config:
|
||||
config: |
|
||||
no ip access-list ACL1v4
|
||||
no ip access-list NewACLv4
|
||||
no ip access-list PortACL
|
||||
no ipv6 access-list ACL1v6
|
||||
no ipv6 access-list ACL1v6
|
||||
interface Ethernet1/2
|
||||
no ipv6 traffic-filter ACL1v6 in
|
||||
interface Ethernet1/5
|
||||
no ip access-group ACL1v4 out
|
||||
no ip port access-group PortACL in
|
||||
no ipv6 traffic-filter ACL1v6 in
|
||||
interface Ethernet1/3
|
||||
no ipv6 port traffic-filter NewACLv6 in
|
||||
no ip access-group ACL1v4 out
|
||||
no ip port access-group PortACL in
|
||||
interface Ethernet1/4
|
||||
no ip access-group NewACLv4 out
|
||||
@ -0,0 +1,48 @@
|
||||
---
|
||||
- debug:
|
||||
msg: "Start nxos_acl_interfaces rendered tests connection={{ ansible_connection }}"
|
||||
|
||||
- name: Rendered
|
||||
nxos_acl_interfaces: &rendered
|
||||
config:
|
||||
- name: Ethernet1/2
|
||||
access_groups:
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
|
||||
- name: Ethernet1/5
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: PortACL
|
||||
direction: in
|
||||
port: True
|
||||
- name: ACL1v4
|
||||
direction: out
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
state: rendered
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == false"
|
||||
- "'interface Ethernet1/2' in result.rendered"
|
||||
- "'ipv6 traffic-filter ACL1v6 in' in result.rendered"
|
||||
- "'interface Ethernet1/5' in result.rendered"
|
||||
- "'ipv6 traffic-filter ACL1v6 in' in result.rendered"
|
||||
- "'ip access-group ACL1v4 out' in result.rendered"
|
||||
- "'ip port access-group PortACL in' in result.rendered"
|
||||
- "result.rendered | length == 6"
|
||||
|
||||
- name: Idempotence - Rendered
|
||||
nxos_acl_interfaces: *rendered
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == false"
|
||||
@ -0,0 +1,60 @@
|
||||
---
|
||||
- debug:
|
||||
msg: "Start nxos_acl_interfaces replaced integration tests connection = {{ansible_connection}}"
|
||||
|
||||
- include_tasks: populate_config.yaml
|
||||
|
||||
- block:
|
||||
- name: Replaced
|
||||
nxos_acl_interfaces: &replaced
|
||||
config:
|
||||
- name: Eth1/5
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: NewACLv4
|
||||
direction: out
|
||||
|
||||
- name: Ethernet1/3
|
||||
access_groups:
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: NewACLv6
|
||||
direction: in
|
||||
port: true
|
||||
state: replaced
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed==True"
|
||||
- "'interface Ethernet1/5' in result.commands"
|
||||
- "'no ip access-group ACL1v4 out' in result.commands"
|
||||
- "'no ip port access-group PortACL in' in result.commands"
|
||||
- "'no ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
- "'ip access-group NewACLv4 out' in result.commands"
|
||||
- "'interface Ethernet1/3' in result.commands"
|
||||
- "'ipv6 port traffic-filter NewACLv6 in' in result.commands"
|
||||
- "result.commands|length==7"
|
||||
|
||||
- name: Gather acl_interfaces post facts
|
||||
nxos_facts:
|
||||
gather_subset:
|
||||
- "!all"
|
||||
- "!min"
|
||||
gather_network_resources: acl_interfaces
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "ansible_facts.network_resources.acl_interfaces == result.after"
|
||||
|
||||
- name: Idempotence - Replaced
|
||||
nxos_acl_interfaces: *replaced
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- "result.changed == false"
|
||||
|
||||
always:
|
||||
- include_tasks: remove_config.yaml
|
||||
@ -0,0 +1,99 @@
|
||||
---
|
||||
- debug:
|
||||
msg: "Start nxos_acl_interfaces round trip integration tests connection = {{ansible_connection}}"
|
||||
|
||||
- include_tasks: populate_config.yaml
|
||||
|
||||
- block:
|
||||
- name: RTT- Apply provided configuration
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
- name: Ethernet1/2
|
||||
access_groups:
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
|
||||
- name: Eth1/5
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: PortACL
|
||||
direction: in
|
||||
port: True
|
||||
|
||||
- name: ACL1v4
|
||||
direction: out
|
||||
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: ACL1v6
|
||||
direction: in
|
||||
state: merged
|
||||
|
||||
- name: Gather interfaces facts
|
||||
nxos_facts:
|
||||
gather_subset:
|
||||
- "!all"
|
||||
- "!min"
|
||||
gather_network_resources:
|
||||
- acl_interfaces
|
||||
|
||||
- name: Apply configuration to be reverted
|
||||
nxos_acl_interfaces:
|
||||
config:
|
||||
- name: Eth1/4
|
||||
access_groups:
|
||||
- afi: ipv4
|
||||
acls:
|
||||
- name: NewACLv4
|
||||
direction: out
|
||||
|
||||
- name: Ethernet1/3
|
||||
access_groups:
|
||||
- afi: ipv6
|
||||
acls:
|
||||
- name: NewACLv6
|
||||
direction: in
|
||||
port: true
|
||||
state: overridden
|
||||
register: result
|
||||
|
||||
- name: Assert that changes were applied
|
||||
assert:
|
||||
that:
|
||||
- "result.changed==True"
|
||||
- "'interface Ethernet1/2' in result.commands"
|
||||
- "'no ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
- "'interface Ethernet1/5' in result.commands"
|
||||
- "'no ip access-group ACL1v4 out' in result.commands"
|
||||
- "'no ip port access-group PortACL in' in result.commands"
|
||||
- "'no ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
- "'interface Ethernet1/4' in result.commands"
|
||||
- "'ip access-group NewACLv4 out' in result.commands"
|
||||
- "'interface Ethernet1/3' in result.commands"
|
||||
- "'ipv6 port traffic-filter NewACLv6 in' in result.commands"
|
||||
|
||||
- name: Revert back to base configuration using facts round trip
|
||||
nxos_acl_interfaces:
|
||||
config: "{{ ansible_facts['network_resources']['acl_interfaces'] }}"
|
||||
state: overridden
|
||||
register: result
|
||||
|
||||
- name: Assert that config was reverted
|
||||
assert:
|
||||
that:
|
||||
- "result.changed==True"
|
||||
- "'interface Ethernet1/2' in result.commands"
|
||||
- "'ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
- "'interface Ethernet1/3' in result.commands"
|
||||
- "'no ipv6 port traffic-filter NewACLv6 in' in result.commands"
|
||||
- "'interface Ethernet1/4' in result.commands"
|
||||
- "'no ip access-group NewACLv4 out' in result.commands"
|
||||
- "'interface Ethernet1/5' in result.commands"
|
||||
- "'ip access-group ACL1v4 out' in result.commands"
|
||||
- "'ip port access-group PortACL in' in result.commands"
|
||||
- "'ipv6 traffic-filter ACL1v6 in' in result.commands"
|
||||
always:
|
||||
- include_tasks: remove_config.yaml
|
||||
@ -0,0 +1,21 @@
|
||||
---
|
||||
parsed:
|
||||
- access_groups:
|
||||
- acls:
|
||||
- direction: in
|
||||
name: ACL1v6
|
||||
afi: ipv6
|
||||
name: Ethernet1/2
|
||||
- access_groups:
|
||||
- acls:
|
||||
- direction: out
|
||||
name: ACL1v4
|
||||
- direction: in
|
||||
name: PortACL
|
||||
port: true
|
||||
afi: ipv4
|
||||
- acls:
|
||||
- direction: in
|
||||
name: ACL1v6
|
||||
afi: ipv6
|
||||
name: Ethernet1/5
|
||||
@ -0,0 +1,2 @@
|
||||
interface Ethernet1/2
|
||||
ip access-group ACL1v4 out
|
||||
@ -0,0 +1,303 @@
|
||||
#
|
||||
# (c) 2019, Ansible by Red Hat, inc
|
||||
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
#
|
||||
|
||||
from __future__ import (absolute_import, division, print_function)
|
||||
__metaclass__ = type
|
||||
|
||||
from ansible.modules.network.nxos import nxos_acl_interfaces
|
||||
from units.compat.mock import patch, MagicMock
|
||||
from units.modules.utils import set_module_args
|
||||
from .nxos_module import TestNxosModule, load_fixture
|
||||
|
||||
|
||||
class TestNxosAclInterfacesModule(TestNxosModule):
|
||||
|
||||
module = nxos_acl_interfaces
|
||||
|
||||
def setUp(self):
|
||||
super(TestNxosAclInterfacesModule, self).setUp()
|
||||
|
||||
self.mock_get_config = patch(
|
||||
'ansible.module_utils.network.common.network.Config.get_config')
|
||||
self.get_config = self.mock_get_config.start()
|
||||
|
||||
self.mock_load_config = patch(
|
||||
'ansible.module_utils.network.common.network.Config.load_config')
|
||||
self.load_config = self.mock_load_config.start()
|
||||
|
||||
self.mock_get_resource_connection_config = patch(
|
||||
'ansible.module_utils.network.common.cfg.base.get_resource_connection'
|
||||
)
|
||||
self.get_resource_connection_config = self.mock_get_resource_connection_config.start(
|
||||
)
|
||||
|
||||
self.mock_get_resource_connection_facts = patch(
|
||||
'ansible.module_utils.network.common.facts.facts.get_resource_connection'
|
||||
)
|
||||
self.get_resource_connection_facts = self.mock_get_resource_connection_facts.start()
|
||||
|
||||
self.mock_edit_config = patch(
|
||||
'ansible.module_utils.network.nxos.config.acl_interfaces.acl_interfaces.Acl_interfaces.edit_config'
|
||||
)
|
||||
self.edit_config = self.mock_edit_config.start()
|
||||
|
||||
self.mock_execute_show_command = patch(
|
||||
'ansible.module_utils.network.nxos.facts.acl_interfaces.acl_interfaces.Acl_interfacesFacts.get_device_data'
|
||||
)
|
||||
self.execute_show_command = self.mock_execute_show_command.start()
|
||||
|
||||
def tearDown(self):
|
||||
super(TestNxosAclInterfacesModule, self).tearDown()
|
||||
self.mock_get_resource_connection_config.stop()
|
||||
self.mock_get_resource_connection_facts.stop()
|
||||
self.mock_edit_config.stop()
|
||||
self.mock_get_config.stop()
|
||||
self.mock_load_config.stop()
|
||||
self.mock_execute_show_command.stop()
|
||||
|
||||
def load_fixtures(self, commands=None, device=''):
|
||||
def load_from_file(*args, **kwargs):
|
||||
output = '''interface Ethernet1/2\n ip access-group ACL1v4 out\n interface Ethernet1/4\n ipv6 port traffic-filter ACL2v6 in\n'''
|
||||
return output
|
||||
|
||||
self.execute_show_command.side_effect = load_from_file
|
||||
|
||||
def test_nxos_acl_interfaces_merged(self):
|
||||
set_module_args(
|
||||
dict(config=[
|
||||
dict(name="Ethernet1/3",
|
||||
access_groups=[
|
||||
dict(afi="ipv4",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL1v4",
|
||||
direction="in",
|
||||
)
|
||||
]
|
||||
)
|
||||
]
|
||||
)
|
||||
], state="merged"))
|
||||
commands = ['interface Ethernet1/3',
|
||||
'ip access-group ACL1v4 in']
|
||||
self.execute_module(changed=True, commands=commands)
|
||||
|
||||
def test_nxos_acl_interfaces_merged_idempotent(self):
|
||||
set_module_args(
|
||||
dict(config=[
|
||||
dict(name="Ethernet1/2",
|
||||
access_groups=[
|
||||
dict(afi="ipv4",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL1v4",
|
||||
direction="out",
|
||||
)
|
||||
]
|
||||
)
|
||||
]
|
||||
),
|
||||
dict(name="Ethernet1/4",
|
||||
access_groups=[
|
||||
dict(afi="ipv6",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL2v6",
|
||||
direction="in",
|
||||
port=True
|
||||
)
|
||||
]
|
||||
)
|
||||
]
|
||||
),
|
||||
|
||||
], state="merged"))
|
||||
self.execute_module(changed=False, commands=[])
|
||||
|
||||
def test_nxos_acl_interfaces_replaced(self):
|
||||
set_module_args(
|
||||
dict(config=[
|
||||
dict(name="Ethernet1/2",
|
||||
access_groups=[
|
||||
dict(afi="ipv6",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL1v6",
|
||||
direction="in",
|
||||
port=True
|
||||
)
|
||||
]
|
||||
)
|
||||
]
|
||||
),
|
||||
dict(name="Ethernet1/5",
|
||||
access_groups=[
|
||||
dict(afi="ipv4",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL2v4",
|
||||
direction="in",
|
||||
port=True
|
||||
)
|
||||
]
|
||||
)
|
||||
]
|
||||
)
|
||||
], state="replaced"))
|
||||
commands = ['interface Ethernet1/2', 'no ip access-group ACL1v4 out',
|
||||
'ipv6 port traffic-filter ACL1v6 in', 'interface Ethernet1/5', 'ip port access-group ACL2v4 in']
|
||||
self.execute_module(changed=True, commands=commands)
|
||||
|
||||
def test_nxos_acl_interfaces_replaced_idempotent(self):
|
||||
set_module_args(
|
||||
dict(config=[
|
||||
dict(name="Ethernet1/2",
|
||||
access_groups=[
|
||||
dict(afi="ipv4",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL1v4",
|
||||
direction="out",
|
||||
)
|
||||
]
|
||||
)
|
||||
]
|
||||
)], state="replaced"))
|
||||
self.execute_module(changed=False, commands=[])
|
||||
|
||||
def test_nxos_acl_interfaces_overridden(self):
|
||||
set_module_args(
|
||||
dict(config=[
|
||||
dict(name="Ethernet1/3",
|
||||
access_groups=[
|
||||
dict(afi="ipv4",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL2v4",
|
||||
direction="out"
|
||||
),
|
||||
dict(
|
||||
name="PortACL",
|
||||
direction="in",
|
||||
port=True
|
||||
),
|
||||
]
|
||||
)
|
||||
]
|
||||
)], state="overridden"))
|
||||
commands = ['interface Ethernet1/2', 'no ip access-group ACL1v4 out', 'interface Ethernet1/4',
|
||||
'no ipv6 port traffic-filter ACL2v6 in', 'interface Ethernet1/3', 'ip access-group ACL2v4 out', 'ip port access-group PortACL in']
|
||||
self.execute_module(changed=True, commands=commands)
|
||||
|
||||
def test_nxos_acl_interfaces_overridden_idempotent(self):
|
||||
set_module_args(
|
||||
dict(config=[
|
||||
dict(name="Ethernet1/2",
|
||||
access_groups=[
|
||||
dict(afi="ipv4",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL1v4",
|
||||
direction="out",
|
||||
)
|
||||
]
|
||||
)
|
||||
]
|
||||
),
|
||||
dict(name="Ethernet1/4",
|
||||
access_groups=[
|
||||
dict(afi="ipv6",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL2v6",
|
||||
direction="in",
|
||||
port=True
|
||||
)
|
||||
]
|
||||
)
|
||||
]
|
||||
),
|
||||
], state="overridden"))
|
||||
self.execute_module(changed=False, commands=[])
|
||||
|
||||
def test_nxos_acl_interfaces_deletedname(self):
|
||||
set_module_args(
|
||||
dict(config=[dict(name="Ethernet1/2")], state="deleted"))
|
||||
commands = ['interface Ethernet1/2', 'no ip access-group ACL1v4 out']
|
||||
self.execute_module(changed=True, commands=commands)
|
||||
|
||||
def test_nxos_acl_interfaces_deletedafi(self):
|
||||
set_module_args(
|
||||
dict(config=[dict(name="Ethernet1/2", access_groups=[
|
||||
dict(afi="ipv4")
|
||||
])], state="deleted"))
|
||||
commands = ['interface Ethernet1/2', 'no ip access-group ACL1v4 out']
|
||||
self.execute_module(changed=True, commands=commands)
|
||||
|
||||
def test_nxos_acl_interfaces_deletedacl(self):
|
||||
set_module_args(
|
||||
dict(config=[dict(name="Ethernet1/2", access_groups=[
|
||||
dict(afi="ipv4", acls=[
|
||||
dict(
|
||||
name="ACL1v4",
|
||||
direction="out"
|
||||
)
|
||||
])
|
||||
])], state="deleted"))
|
||||
commands = ['interface Ethernet1/2', 'no ip access-group ACL1v4 out']
|
||||
self.execute_module(changed=True, commands=commands)
|
||||
|
||||
def test_nxos_acl_interfaces_rendered(self):
|
||||
set_module_args(
|
||||
dict(config=[
|
||||
dict(name="Ethernet1/2",
|
||||
access_groups=[
|
||||
dict(afi="ipv4",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL1v4",
|
||||
direction="out",
|
||||
)
|
||||
]
|
||||
)
|
||||
]
|
||||
),
|
||||
dict(name="Ethernet1/4",
|
||||
access_groups=[
|
||||
dict(afi="ipv6",
|
||||
acls=[
|
||||
dict(
|
||||
name="ACL2v6",
|
||||
direction="in",
|
||||
port=True
|
||||
)
|
||||
]
|
||||
)
|
||||
]
|
||||
),
|
||||
], state="rendered"))
|
||||
commands = ['interface Ethernet1/2', 'ip access-group ACL1v4 out',
|
||||
'interface Ethernet1/4', 'ipv6 port traffic-filter ACL2v6 in']
|
||||
result = self.execute_module(changed=False)
|
||||
self.assertEqual(sorted(result['rendered']), sorted(
|
||||
commands), result['rendered'])
|
||||
|
||||
def test_nxos_acl_interfaces_parsed(self):
|
||||
set_module_args(dict(running_config='''interface Ethernet1/2\n ip access-group ACL1v4 out\n interface Ethernet1/4\n \
|
||||
ipv6 port traffic-filter ACL2v6 in''',
|
||||
state="parsed"))
|
||||
result = self.execute_module(changed=False)
|
||||
compare_list = [{'access_groups': [{'acls': [{'direction': 'out', 'name': 'ACL1v4'}], 'afi': 'ipv4'}], 'name': 'Ethernet1/2'},
|
||||
{'access_groups': [{'acls': [{'direction': 'in', 'name': 'ACL2v6', 'port': True}], 'afi': 'ipv6'}], 'name': 'Ethernet1/4'}]
|
||||
self.assertEqual(result['parsed'],
|
||||
compare_list, result['parsed'])
|
||||
|
||||
def test_nxos_acl_interfaces_gathered(self):
|
||||
set_module_args(dict(config=[], state="gathered"))
|
||||
result = self.execute_module(changed=False)
|
||||
compare_list = [{'access_groups': [{'acls': [{'direction': 'out', 'name': 'ACL1v4'}], 'afi': 'ipv4'}], 'name': 'Ethernet1/2'},
|
||||
{'access_groups': [{'acls': [{'direction': 'in', 'name': 'ACL2v6', 'port': True}], 'afi': 'ipv6'}], 'name': 'Ethernet1/4'}]
|
||||
self.assertEqual(result['gathered'],
|
||||
compare_list, result['gathered'])
|
||||
Loading…
Reference in New Issue