mirror of https://github.com/ansible/ansible.git
Reverting recent commits back to initial PR and will move the new profitbricks_firewall_rule module and other recent changes to a new branch.
Revert "Added support for firewall rules, consolidated resource UUID retrieval methods for server and NIC modules, and set LAN type to int."
This reverts commit 464cbb89f2.
pull/18777/head
Ethan Devenport
8 years ago
committed by
Matt Clay
parent
e1960d2488
commit
f9e0830b44
@ -1,399 +0,0 @@
|
|||||||
#!/usr/bin/python
|
|
||||||
# This file is part of Ansible
|
|
||||||
#
|
|
||||||
# Ansible is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, either version 3 of the License, or
|
|
||||||
# (at your option) any later version.
|
|
||||||
#
|
|
||||||
# Ansible is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
DOCUMENTATION = '''
|
|
||||||
---
|
|
||||||
module: profitbricks_firewall_rule
|
|
||||||
short_description: Create or remove a firewall rule.
|
|
||||||
description:
|
|
||||||
- This module allows you to create or remove a firewlal rule. This module has a dependency on profitbricks >= 1.0.0
|
|
||||||
version_added: "2.2"
|
|
||||||
options:
|
|
||||||
datacenter:
|
|
||||||
description:
|
|
||||||
- The datacenter name or UUID in which to operate.
|
|
||||||
required: true
|
|
||||||
server:
|
|
||||||
description:
|
|
||||||
- The server name or UUID.
|
|
||||||
required: true
|
|
||||||
nic:
|
|
||||||
description:
|
|
||||||
- The NIC name or UUID.
|
|
||||||
required: true
|
|
||||||
name:
|
|
||||||
description:
|
|
||||||
- The name or UUID of the firewall rule.
|
|
||||||
required: false
|
|
||||||
protocol:
|
|
||||||
description:
|
|
||||||
- The protocol for the firewall rule.
|
|
||||||
choices: [ "TCP", "UDP", "ICMP" ]
|
|
||||||
required: true
|
|
||||||
source_mac:
|
|
||||||
description:
|
|
||||||
- Only traffic originating from the respective MAC address is allowed. No value allows all source MAC addresses.
|
|
||||||
required: false
|
|
||||||
source_ip:
|
|
||||||
description:
|
|
||||||
- Only traffic originating from the respective IPv4 address is allowed. No value allows all source IPs.
|
|
||||||
required: false
|
|
||||||
target_ip:
|
|
||||||
description:
|
|
||||||
- In case the target NIC has multiple IP addresses, only traffic directed to the respective IP address of the NIC is allowed. No value allows all target IPs.
|
|
||||||
required: false
|
|
||||||
port_range_start:
|
|
||||||
description:
|
|
||||||
- Defines the start range of the allowed port (from 1 to 65534) if protocol TCP or UDP is chosen. Leave value empty to allow all ports.
|
|
||||||
required: false
|
|
||||||
port_range_end:
|
|
||||||
description:
|
|
||||||
- Defines the end range of the allowed port (from 1 to 65534) if the protocol TCP or UDP is chosen. Leave value empty to allow all ports.
|
|
||||||
required: false
|
|
||||||
icmp_type:
|
|
||||||
description:
|
|
||||||
- Defines the allowed type (from 0 to 254) if the protocol ICMP is chosen. No value allows all types.
|
|
||||||
required: false
|
|
||||||
icmp_code:
|
|
||||||
description:
|
|
||||||
- Defines the allowed code (from 0 to 254) if protocol ICMP is chosen. No value allows all codes.
|
|
||||||
required: false
|
|
||||||
subscription_user:
|
|
||||||
description:
|
|
||||||
- The ProfitBricks username. Overrides the PB_SUBSCRIPTION_ID environement variable.
|
|
||||||
required: false
|
|
||||||
subscription_password:
|
|
||||||
description:
|
|
||||||
- THe ProfitBricks password. Overrides the PB_PASSWORD environement variable.
|
|
||||||
required: false
|
|
||||||
wait:
|
|
||||||
description:
|
|
||||||
- wait for the operation to complete before returning
|
|
||||||
required: false
|
|
||||||
default: "yes"
|
|
||||||
choices: [ "yes", "no" ]
|
|
||||||
wait_timeout:
|
|
||||||
description:
|
|
||||||
- how long before wait gives up, in seconds
|
|
||||||
default: 600
|
|
||||||
state:
|
|
||||||
description:
|
|
||||||
- Indicate desired state of the resource
|
|
||||||
required: false
|
|
||||||
default: 'present'
|
|
||||||
choices: ["present", "absent"]
|
|
||||||
|
|
||||||
requirements: [ "profitbricks" ]
|
|
||||||
author: Ethan Devenport (ethand@stackpointcloud.com)
|
|
||||||
'''
|
|
||||||
|
|
||||||
EXAMPLES = '''
|
|
||||||
# Create a firewall rule
|
|
||||||
- name: Create SSH firewall rule
|
|
||||||
profitbricks_firewall_rule:
|
|
||||||
datacenter: Virtual Datacenter
|
|
||||||
server: node001
|
|
||||||
nic: 7341c2454f
|
|
||||||
name: Allow SSH
|
|
||||||
protocol: TCP
|
|
||||||
source_ip: 0.0.0.0
|
|
||||||
port_range_start: 22
|
|
||||||
port_range_end: 22
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Create ping firewall rule
|
|
||||||
profitbricks_firewall_rule:
|
|
||||||
datacenter: Virtual Datacenter
|
|
||||||
server: node001
|
|
||||||
nic: 7341c2454f
|
|
||||||
name: Allow Ping
|
|
||||||
protocol: ICMP
|
|
||||||
source_ip: 0.0.0.0
|
|
||||||
icmp_type: 8
|
|
||||||
icmp_code: 0
|
|
||||||
state: present
|
|
||||||
|
|
||||||
# Remove a firewall rule
|
|
||||||
- name: Remove public ping firewall rule
|
|
||||||
profitbricks_firewall_rule:
|
|
||||||
datacenter: Virtual Datacenter
|
|
||||||
server: node001
|
|
||||||
nic: aa6c261b9c
|
|
||||||
name: Allow Ping
|
|
||||||
state: absent
|
|
||||||
'''
|
|
||||||
|
|
||||||
RETURN = '''
|
|
||||||
---
|
|
||||||
id:
|
|
||||||
description: UUID of the firewall rule.
|
|
||||||
returned: success
|
|
||||||
type: string
|
|
||||||
sample: be60aa97-d9c7-4c22-bebe-f5df7d6b675d
|
|
||||||
name:
|
|
||||||
description: Name of the firwall rule.
|
|
||||||
returned: success
|
|
||||||
type: string
|
|
||||||
sample: Allow SSH
|
|
||||||
protocol:
|
|
||||||
description: Protocol of the firewall rule.
|
|
||||||
returned: success
|
|
||||||
type: string
|
|
||||||
sample: TCP
|
|
||||||
source_mac:
|
|
||||||
description: MAC address of the firewall rule.
|
|
||||||
returned: success
|
|
||||||
type: string
|
|
||||||
sample: 02:01:97:d7:ed:49
|
|
||||||
source_ip:
|
|
||||||
description: Source IP of the firewall rule.
|
|
||||||
returned: success
|
|
||||||
type: string
|
|
||||||
sample: tcp
|
|
||||||
target_ip:
|
|
||||||
description: Target IP of the firewal rule.
|
|
||||||
returned: success
|
|
||||||
type: string
|
|
||||||
sample: 10.0.0.1
|
|
||||||
port_range_start:
|
|
||||||
description: Start port of the firewall rule.
|
|
||||||
returned: success
|
|
||||||
type: int
|
|
||||||
sample: 80
|
|
||||||
port_range_end:
|
|
||||||
description: End port of the firewall rule.
|
|
||||||
returned: success
|
|
||||||
type: int
|
|
||||||
sample: 80
|
|
||||||
icmp_type:
|
|
||||||
description: ICMP type of the firewall rule.
|
|
||||||
returned: success
|
|
||||||
type: int
|
|
||||||
sample: 8
|
|
||||||
icmp_code:
|
|
||||||
description: ICMP code of the firewall rule.
|
|
||||||
returned: success
|
|
||||||
type: int
|
|
||||||
sample: 0
|
|
||||||
'''
|
|
||||||
|
|
||||||
# import uuid
|
|
||||||
import time
|
|
||||||
|
|
||||||
HAS_PB_SDK = True
|
|
||||||
|
|
||||||
try:
|
|
||||||
from profitbricks.client import ProfitBricksService, FirewallRule
|
|
||||||
except ImportError:
|
|
||||||
HAS_PB_SDK = False
|
|
||||||
|
|
||||||
|
|
||||||
def _wait_for_completion(profitbricks, promise, wait_timeout, msg):
|
|
||||||
if not promise: return
|
|
||||||
wait_timeout = time.time() + wait_timeout
|
|
||||||
while wait_timeout > time.time():
|
|
||||||
time.sleep(5)
|
|
||||||
operation_result = profitbricks.get_request(
|
|
||||||
request_id=promise['requestId'],
|
|
||||||
status=True)
|
|
||||||
|
|
||||||
if operation_result['metadata']['status'] == 'DONE':
|
|
||||||
return
|
|
||||||
elif operation_result['metadata']['status'] == 'FAILED':
|
|
||||||
raise Exception(
|
|
||||||
'Request failed to complete ' + msg + ' "' + str(
|
|
||||||
promise['requestId']) + '" to complete.')
|
|
||||||
|
|
||||||
raise Exception(
|
|
||||||
'Timed out waiting for async operation ' + msg + ' "' + str(
|
|
||||||
promise['requestId']
|
|
||||||
) + '" to complete.')
|
|
||||||
|
|
||||||
|
|
||||||
def create_firewall_rule(module, profitbricks):
|
|
||||||
"""
|
|
||||||
Creates a firewall rule.
|
|
||||||
|
|
||||||
module : AnsibleModule object
|
|
||||||
profitbricks: authenticated profitbricks object.
|
|
||||||
|
|
||||||
Returns:
|
|
||||||
True if the firewal rule creates, false otherwise
|
|
||||||
"""
|
|
||||||
datacenter = module.params.get('datacenter')
|
|
||||||
server = module.params.get('server')
|
|
||||||
nic = module.params.get('nic')
|
|
||||||
name = module.params.get('name')
|
|
||||||
protocol = module.params.get('protocol')
|
|
||||||
source_mac = module.params.get('source_mac')
|
|
||||||
source_ip = module.params.get('source_ip')
|
|
||||||
target_ip = module.params.get('target_ip')
|
|
||||||
port_range_start = module.params.get('port_range_start')
|
|
||||||
port_range_end = module.params.get('port_range_end')
|
|
||||||
icmp_type = module.params.get('icmp_type')
|
|
||||||
icmp_code = module.params.get('icmp_code')
|
|
||||||
wait = module.params.get('wait')
|
|
||||||
wait_timeout = module.params.get('wait_timeout')
|
|
||||||
|
|
||||||
# Locate UUID for virtual datacenter
|
|
||||||
datacenter_list = profitbricks.list_datacenters()
|
|
||||||
datacenter_id = _get_resource_id(datacenter_list, datacenter)
|
|
||||||
if not datacenter_id:
|
|
||||||
module.fail_json(msg='Virtual data center \'%s\' not found.' % str(datacenter))
|
|
||||||
|
|
||||||
# Locate UUID for server
|
|
||||||
server_list = profitbricks.list_servers(datacenter_id)
|
|
||||||
server_id = _get_resource_id(server_list, server)
|
|
||||||
|
|
||||||
# Locate UUID for NIC
|
|
||||||
nic_list = profitbricks.list_nics(datacenter_id, server_id)
|
|
||||||
nic_id = _get_resource_id(nic_list, nic)
|
|
||||||
|
|
||||||
try:
|
|
||||||
profitbricks.update_nic(datacenter_id, server_id, nic_id,
|
|
||||||
firewall_active=True)
|
|
||||||
except Exception as e:
|
|
||||||
module.fail_json(msg='Unable to activate the NIC firewall.' % str(e))
|
|
||||||
|
|
||||||
f = FirewallRule(
|
|
||||||
name=name,
|
|
||||||
protocol=protocol,
|
|
||||||
source_mac=source_mac,
|
|
||||||
source_ip=source_ip,
|
|
||||||
target_ip=target_ip,
|
|
||||||
port_range_start=port_range_start,
|
|
||||||
port_range_end=port_range_end,
|
|
||||||
icmp_type=icmp_type,
|
|
||||||
icmp_code=icmp_code
|
|
||||||
)
|
|
||||||
|
|
||||||
try:
|
|
||||||
firewall_rule_response = profitbricks.create_firewall_rule(
|
|
||||||
datacenter_id, server_id, nic_id, f
|
|
||||||
)
|
|
||||||
|
|
||||||
if wait:
|
|
||||||
_wait_for_completion(profitbricks, firewall_rule_response,
|
|
||||||
wait_timeout, "create_firewall_rule")
|
|
||||||
return firewall_rule_response
|
|
||||||
|
|
||||||
except Exception as e:
|
|
||||||
module.fail_json(msg="failed to create the firewall rule: %s" % str(e))
|
|
||||||
|
|
||||||
|
|
||||||
def delete_firewall_rule(module, profitbricks):
|
|
||||||
"""
|
|
||||||
Removes a firewall rule
|
|
||||||
|
|
||||||
module : AnsibleModule object
|
|
||||||
profitbricks: authenticated profitbricks object.
|
|
||||||
|
|
||||||
Returns:
|
|
||||||
True if the firewall rule was removed, false otherwise
|
|
||||||
"""
|
|
||||||
datacenter = module.params.get('datacenter')
|
|
||||||
server = module.params.get('server')
|
|
||||||
nic = module.params.get('nic')
|
|
||||||
name = module.params.get('name')
|
|
||||||
|
|
||||||
# Locate UUID for virtual datacenter
|
|
||||||
datacenter_list = profitbricks.list_datacenters()
|
|
||||||
datacenter_id = _get_resource_id(datacenter_list, datacenter)
|
|
||||||
|
|
||||||
# Locate UUID for server
|
|
||||||
server_list = profitbricks.list_servers(datacenter_id)
|
|
||||||
server_id = _get_resource_id(server_list, server)
|
|
||||||
|
|
||||||
# Locate UUID for NIC
|
|
||||||
nic_list = profitbricks.list_nics(datacenter_id, server_id)
|
|
||||||
nic_id = _get_resource_id(nic_list, nic)
|
|
||||||
|
|
||||||
# Locate UUID for firewall rule
|
|
||||||
firewall_rule_list = profitbricks.get_firewall_rules(datacenter_id, server_id, nic_id)
|
|
||||||
firewall_rule_id = _get_resource_id(firewall_rule_list, name)
|
|
||||||
|
|
||||||
try:
|
|
||||||
firewall_rule_response = profitbricks.delete_firewall_rule(
|
|
||||||
datacenter_id, server_id, nic_id, firewall_rule_id
|
|
||||||
)
|
|
||||||
return firewall_rule_response
|
|
||||||
except Exception as e:
|
|
||||||
module.fail_json(msg="failed to remove the firewall rule: %s" % str(e))
|
|
||||||
|
|
||||||
|
|
||||||
def _get_resource_id(resource_list, identity):
|
|
||||||
"""
|
|
||||||
Fetch and return the UUID of a resource regardless of whether the name or
|
|
||||||
UUID is passed.
|
|
||||||
"""
|
|
||||||
for resource in resource_list['items']:
|
|
||||||
if identity in (resource['properties']['name'], resource['id']):
|
|
||||||
return resource['id']
|
|
||||||
return None
|
|
||||||
|
|
||||||
|
|
||||||
def main():
|
|
||||||
module = AnsibleModule(
|
|
||||||
argument_spec=dict(
|
|
||||||
datacenter=dict(type='str', required=True),
|
|
||||||
server=dict(type='str', required=True),
|
|
||||||
nic=dict(type='str', required=True),
|
|
||||||
name=dict(type='str', required=True),
|
|
||||||
protocol=dict(type='str', required=False),
|
|
||||||
source_mac=dict(type='str', default=None),
|
|
||||||
source_ip=dict(type='str', default=None),
|
|
||||||
target_ip=dict(type='str', default=None),
|
|
||||||
port_range_start=dict(type='int', default=None),
|
|
||||||
port_range_end=dict(type='int', default=None),
|
|
||||||
icmp_type=dict(type='int', default=None),
|
|
||||||
icmp_code=dict(type='int', default=None),
|
|
||||||
subscription_user=dict(type='str', required=True),
|
|
||||||
subscription_password=dict(type='str', required=True),
|
|
||||||
wait=dict(type='bool', default=True),
|
|
||||||
wait_timeout=dict(type='int', default=600),
|
|
||||||
state=dict(default='present'),
|
|
||||||
)
|
|
||||||
)
|
|
||||||
|
|
||||||
if not HAS_PB_SDK:
|
|
||||||
module.fail_json(msg='profitbricks required for this module')
|
|
||||||
|
|
||||||
subscription_user = module.params.get('subscription_user')
|
|
||||||
subscription_password = module.params.get('subscription_password')
|
|
||||||
|
|
||||||
profitbricks = ProfitBricksService(
|
|
||||||
username=subscription_user,
|
|
||||||
password=subscription_password)
|
|
||||||
|
|
||||||
state = module.params.get('state')
|
|
||||||
|
|
||||||
if state == 'absent':
|
|
||||||
try:
|
|
||||||
(changed) = delete_firewall_rule(module, profitbricks)
|
|
||||||
module.exit_json(changed=changed)
|
|
||||||
except Exception as e:
|
|
||||||
module.fail_json(msg='failed to set firewall rule state: %s' % str(e))
|
|
||||||
|
|
||||||
elif state == 'present':
|
|
||||||
try:
|
|
||||||
(firewall_rule_dict) = create_firewall_rule(module, profitbricks)
|
|
||||||
module.exit_json(firewall_rules=firewall_rule_dict)
|
|
||||||
except Exception as e:
|
|
||||||
module.fail_json(msg='failed to set firewall rules state: %s' % str(e))
|
|
||||||
|
|
||||||
from ansible.module_utils.basic import *
|
|
||||||
|
|
||||||
main()
|
|
||||||
Loading…
Reference in New Issue