mirror of https://github.com/ansible/ansible.git
New module: platform agnostic way to manage local users on network devices (network/net_user.) (#25259)
* Add net_user platform agnostic module Signed-off-by: Trishna Guha <trishnaguha17@gmail.com> * Integration test for net_user Signed-off-by: Trishna Guha <trishnaguha17@gmail.com> * modify eos_user module to support name param as alias to username Signed-off-by: Trishna Guha <trishnaguha17@gmail.com> * Test collection of users Signed-off-by: Trishna Guha <trishnaguha17@gmail.com>pull/25392/head
Trishna Guha
7 years ago
committed by
GitHub
parent
15104acc00
commit
f6a4803669
@ -0,0 +1,138 @@
|
||||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
# (c) 2017, Ansible by Red Hat, inc
|
||||
#
|
||||
# This file is part of Ansible by Red Hat
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
ANSIBLE_METADATA = {'metadata_version': '1.0',
|
||||
'status': ['preview'],
|
||||
'supported_by': 'core'}
|
||||
|
||||
DOCUMENTATION = """
|
||||
---
|
||||
module: net_user
|
||||
version_added: "2.4"
|
||||
author: "Trishna Guha (@trishnag)"
|
||||
short_description: Manage the collection of local users on network device
|
||||
description:
|
||||
- This module provides declarative management of the local usernames
|
||||
configured on network devices. It allows playbooks to manage
|
||||
either individual usernames or the collection of usernames in the
|
||||
current running config. It also supports purging usernames from the
|
||||
configuration that are not explicitly defined.
|
||||
options:
|
||||
collection:
|
||||
description:
|
||||
- The set of username objects to be configured on the remote
|
||||
network device. The list entries can either be the username
|
||||
or a hash of username and properties. This argument is mutually
|
||||
exclusive with the C(name) argument.
|
||||
name:
|
||||
description:
|
||||
- The username to be configured on the remote network device.
|
||||
This argument accepts a string value and is mutually exclusive
|
||||
with the C(collection) argument.
|
||||
Please note that this option is not same as C(provider username).
|
||||
password:
|
||||
description:
|
||||
- The password to be configured on the remote network device. The
|
||||
password needs to be provided in clear and it will be encrypted
|
||||
on the device.
|
||||
Please note that this option is not same as C(provider password).
|
||||
update_password:
|
||||
description:
|
||||
- Since passwords are encrypted in the device running config, this
|
||||
argument will instruct the module when to change the password. When
|
||||
set to C(always), the password will always be updated in the device
|
||||
and when set to C(on_create) the password will be updated only if
|
||||
the username is created.
|
||||
default: always
|
||||
choices: ['on_create', 'always']
|
||||
privilege:
|
||||
description:
|
||||
- The C(privilege) argument configures the privilege level of the
|
||||
user when logged into the system. This argument accepts integer
|
||||
values in the range of 1 to 15.
|
||||
role:
|
||||
description:
|
||||
- Configures the role for the username in the
|
||||
device running configuration. The argument accepts a string value
|
||||
defining the role name. This argument does not check if the role
|
||||
has been configured on the device.
|
||||
sshkey:
|
||||
description:
|
||||
- Specifies the SSH public key to configure
|
||||
for the given username. This argument accepts a valid SSH key value.
|
||||
nopassword:
|
||||
description:
|
||||
- Defines the username without assigning
|
||||
a password. This will allow the user to login to the system
|
||||
without being authenticated by a password.
|
||||
type: bool
|
||||
purge:
|
||||
description:
|
||||
- Instructs the module to consider the
|
||||
resource definition absolute. It will remove any previously
|
||||
configured usernames on the device with the exception of the
|
||||
`admin` user (the current defined set of users).
|
||||
type: bool
|
||||
default: false
|
||||
state:
|
||||
description:
|
||||
- Configures the state of the username definition
|
||||
as it relates to the device operational configuration. When set
|
||||
to I(present), the username(s) should be configured in the device active
|
||||
configuration and when set to I(absent) the username(s) should not be
|
||||
in the device active configuration
|
||||
default: present
|
||||
choices: ['present', 'absent']
|
||||
"""
|
||||
|
||||
EXAMPLES = """
|
||||
- name: create a new user
|
||||
net_user:
|
||||
name: ansible
|
||||
sshkey: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
|
||||
state: present
|
||||
- name: remove all users except admin
|
||||
net_user:
|
||||
purge: yes
|
||||
- name: set multiple users to privilege level 15
|
||||
net_user:
|
||||
collection:
|
||||
- name: netop
|
||||
- name: netend
|
||||
privilege: 15
|
||||
state: present
|
||||
- name: Change Password for User netop
|
||||
net_user:
|
||||
name: netop
|
||||
password: "{{ new_password }}"
|
||||
update_password: always
|
||||
state: present
|
||||
"""
|
||||
|
||||
RETURN = """
|
||||
commands:
|
||||
description: The list of configuration mode commands to send to the device
|
||||
returned: always
|
||||
type: list
|
||||
sample:
|
||||
- username ansible secret password
|
||||
- username admin secret admin
|
||||
"""
|
||||
@ -0,0 +1,26 @@
|
||||
# (c) 2017, Ansible Inc,
|
||||
#
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
from __future__ import (absolute_import, division, print_function)
|
||||
__metaclass__ = type
|
||||
|
||||
from ansible.plugins.action.net_base import ActionModule as _ActionModule
|
||||
|
||||
|
||||
class ActionModule(_ActionModule):
|
||||
def run(self, tmp=None, task_vars=None):
|
||||
result = super(ActionModule, self).run(tmp, task_vars)
|
||||
return result
|
||||
@ -0,0 +1 @@
|
||||
network/ci
|
||||
@ -0,0 +1,2 @@
|
||||
---
|
||||
testcase: "*"
|
||||
@ -0,0 +1,16 @@
|
||||
---
|
||||
- name: collect all cli test cases
|
||||
find:
|
||||
paths: "{{ role_path }}/tests/cli"
|
||||
patterns: "{{ testcase }}.yaml"
|
||||
register: test_cases
|
||||
delegate_to: localhost
|
||||
|
||||
- name: set test_items
|
||||
set_fact: test_items="{{ test_cases.files | map(attribute='path') | list }}"
|
||||
|
||||
- name: run test case
|
||||
include: "{{ test_case_to_run }}"
|
||||
with_items: "{{ test_items }}"
|
||||
loop_control:
|
||||
loop_var: test_case_to_run
|
||||
@ -0,0 +1,2 @@
|
||||
---
|
||||
- { include: cli.yaml, tags: ['cli'] }
|
||||
@ -0,0 +1,3 @@
|
||||
---
|
||||
- include: "{{ role_path }}/tests/eos/userprivilege.yaml"
|
||||
when: hostvars[inventory_hostname]['ansible_network_os'] == 'eos'
|
||||
@ -0,0 +1,6 @@
|
||||
---
|
||||
- include: "{{ role_path }}/tests/nxos/userrole.yaml"
|
||||
when: hostvars[inventory_hostname]['ansible_network_os'] == 'nxos'
|
||||
|
||||
- include: "{{ role_path }}/tests/eos/userrole.yaml"
|
||||
when: hostvars[inventory_hostname]['ansible_network_os'] == 'eos'
|
||||
@ -0,0 +1,6 @@
|
||||
---
|
||||
- include: "{{ role_path }}/tests/nxos/users.yaml"
|
||||
when: hostvars[inventory_hostname]['ansible_network_os'] == 'nxos'
|
||||
|
||||
- include: "{{ role_path }}/tests/eos/users.yaml"
|
||||
when: hostvars[inventory_hostname]['ansible_network_os'] == 'eos'
|
||||
@ -0,0 +1,19 @@
|
||||
---
|
||||
- name: Set user to privilege level 15
|
||||
net_user:
|
||||
name: netop
|
||||
privilege: 15
|
||||
state: present
|
||||
authorize: yes
|
||||
provider: "{{ cli }}"
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- 'result.changed == true'
|
||||
- 'result.commands == ["username netop privilege 15"]'
|
||||
|
||||
- name: tearDown
|
||||
net_user:
|
||||
purge: yes
|
||||
provider: "{{ cli }}"
|
||||
@ -0,0 +1,22 @@
|
||||
---
|
||||
- name: Set multiple users role
|
||||
net_user:
|
||||
collection:
|
||||
- name: netop
|
||||
- name: netend
|
||||
role: network-operator
|
||||
state: present
|
||||
authorize: yes
|
||||
provider: "{{ cli }}"
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- 'result.changed == true'
|
||||
- 'result.commands == ["username netop role network-operator", "username netend role network-operator"]'
|
||||
|
||||
- name: tearDown
|
||||
net_user:
|
||||
purge: yes
|
||||
authorize: yes
|
||||
provider: "{{ cli }}"
|
||||
@ -0,0 +1,23 @@
|
||||
---
|
||||
- name: Create user
|
||||
net_user:
|
||||
name: netop
|
||||
state: present
|
||||
provider: "{{ cli }}"
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- 'result.changed == true'
|
||||
- 'result.commands == ["username netop"]'
|
||||
|
||||
- name: Purge users
|
||||
net_user:
|
||||
purge: yes
|
||||
provider: "{{ cli }}"
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- 'result.changed == true'
|
||||
- 'result.commands == ["no username netop"]'
|
||||
@ -0,0 +1,20 @@
|
||||
---
|
||||
- name: Set multiple users role
|
||||
net_user:
|
||||
collection:
|
||||
- name: netop
|
||||
- name: netend
|
||||
role: network-operator
|
||||
state: present
|
||||
provider: "{{ cli }}"
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- 'result.changed == true'
|
||||
- '"role network-operator" in result.commands'
|
||||
|
||||
- name: tearDown
|
||||
net_user:
|
||||
purge: yes
|
||||
provider: "{{ cli }}"
|
||||
@ -0,0 +1,23 @@
|
||||
---
|
||||
- name: Create user
|
||||
net_user:
|
||||
name: netop
|
||||
state: present
|
||||
provider: "{{ cli }}"
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- 'result.changed == true'
|
||||
- 'result.commands == ["username netop"]'
|
||||
|
||||
- name: Purge users
|
||||
net_user:
|
||||
purge: yes
|
||||
provider: "{{ cli }}"
|
||||
register: result
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- 'result.changed == true'
|
||||
- 'result.commands == ["no username netop"]'
|
||||
Loading…
Reference in New Issue