There is a common pattern in modules where some parameters are required
only if another parameter is present AND set to a particular value. For
instance, if a cloud server state is "present" it's important to
indicate the image to be used, but if it's "absent", the image that was
used to launch it is not necessary. Provide a check that takes as an
input a list of 3-element tuples containing parameter to depend on, the
value it should be set to, and a list of parameters which are required
if the required parameter is set to the required value.
The two detection methods currently implemented do not cover all cases.
For example qemu guests invoked like this:
qemu -machine pc-i440fx-1.4,accel=kvm -cpu SandyBridge
return this information:
product_name: Standard PC (i440FX + PIIX, 1996)
cpuinfo: model name : Intel Xeon E312xx (Sandy Bridge)
Also modifies the template action plugin to use this new param
when executing the file/copy modules for templating so that links
are preserved correctly.
Fixes#8998
* makes speed acceptable for some datasets
* obfuscates multiple detected passwords
* obfuscates more characters to account for some corner cases when
trying to detect passwords.
Fixes#8364
This changes the get-attr function slightly, and lets the module specify whether a param is needed and auto-fails if it is not present. A module can now verify params like so::
$params = Parse-Args $args;
$result = New-Object psobject;
Set-Attr $result "changed" $false;
$path = Get-Attr -obj $params -name path -failifempty $true -resultobj $result
or
$params = Parse-Args $args;
$result = New-Object psobject;
Set-Attr $result "changed" $false;
$path = Get-Attr -obj $params -name path -failifempty $true -emptyattributefailmessage "Oh man. You forgot the main part!" -resultobj $result
slight tweak in how the powershell module converts to json in order to support nested objects (allows for more complex facts, among others)
This script gathers some extended facts on windows hosts in a json array attribute called "ansible_interfaces". This info is needed for some network-related modules I'm working on. Required the update to powershell.ps1 to return deeply nested json objects.
Linux and BSD derivatives do not allow unprivileged users to
"give away" files to others for security reasons. (System V
derivatives allow that but they're rare nowadays.)
Taking a page out of the ec2 config, make sure that all of the
OpenStack modules handle the inbound auth config in the same way.
The one outlier is keystone wrt auth_url.
The run_command module function will now poll stdout/stderr for
data rather than using the builtin command communicate(), which can
hang under certain circumstances.
Fixes#7452Fixes#7748Fixes#8163
The provisioning module knows more about how nova deals with IP
addresses now. Ensure that the inventory module is similarly as smart
by separating out the logic into the openstack/module_utils.
Taking a page out of the ec2 config, make sure that all of the
OpenStack modules handle the inbound auth config in the same way.
The one outlier is keystone wrt auth_url.
This method was still failing for me with a "missing http_code" message. After applying this change, the error message is:
```
msg: Unexpected response: {'value': 'PyCrypto library required for Service Account Authentication.'}
```
I wanted to contribute a rock-solid `unexpected_error_msg` implementation.
* Strip lookup calls out of inventory variables and clean unsafe data
returned from lookup plugins (CVE-2014-4966)
* Make sure vars don't insert extra parameters into module args and prevent
duplicate params from superseding previous params (CVE-2014-4967)
The distro version is a string ('jessie/sid') on Debian unstable and testing.
Because load_platform_subclass() evaluations every subclass as it loops,
comparing numbers when get_distribution_version() does not return a number will
break.
This patch fixes that by returning a number (`0`) when we have an invalid
version, instead of returning `None` or a string.
The new CentOS 7 beta lists the distribution as "CentOS Linux", which
breaks the distribution detection and class loading. This patch fixes
that by taking just the first entry in the string when a space is
detected.
Previously, the get_fqdn() function in known_hosts.py only worked
with urls that started with git@, and ignored any urls that started
with a normal schema type (ie. http:// or ssh://). This patch corrects
that by using urlparse to parse the hostname portion out of urls that
have a proper schema.
Fixes#7474
Having an uptime fact allows you to check after a reboot whether the system was effectively rebooted.
```yaml
- name: Safeguard - Was system properly rebooted ?
action: fail msg="System was not properly rebooted"
when: ansible_uptime > 900
```
This patch has been tested on Linux, Solaris and HP-UX.
Also added some error handling to the fetch_url() call in the
apt_repository module, so that failures to look up the PPA info
are properly handled.
Fixes#7322
The ssl cert check will now respect the http and https proxy
environment settings. The url may also have the username/password
embedded, in which case basic auth will be used to connect to the
proxy server.
Fixes#7413
If the module directory is not writable/executable to the current user
(most likely because of a sudo to a non-root user), the ssh_wrapper
will be created in the default location for mkstemp() calls. To facilitate
the deletion of these new files, a new mechanism for cleaning up files
created by the module was also added.
Fixes#7375
This is a corner case for remote file systems that don't support
chown() and where the source and destination for the atomic_move
are on that remote file system.
Fixes#7372
Previously, we set the LANG (and LC_CTYPE) environment variables
directly in the module code and applied them with os.environ().
Instead, we are now pre-pending those variables to the environment
string used to execute the command which allows the user to
override the localization values by setting the environment values
directly (even on a per-task basis):
- subversion: repo=file:///path/to/repos/svn_über dest=/tmp/svntest
environment:
LANG: "C"
LC_CTYPE: "en_US.UTF-8"
So if a user wishes to default their LANG back to C, they can still
avoid unicode issues by doing the above.
Fixes#7060
Modified logic of distribution_release for SuSE to retain the last discovered key/value pair's value in /etc/SuSE-release that contains a '=' character.
- Improved parsing of /proc/cpuinfo to take the specifics of Linux on
System z. ansible_processor and ansible_processor_cores are now
completed.
- Also improved virtualization facts in the same environment, parsing
the output of /usr/bin/lscpu to populate virtualization_type and
virtualization_role more precisely. If lscpu is not available, then
stick to the previous behavior.
On some very old simplejson does not support the 'encoding' and give
following exception:
TypeError: __init__() got an unexpected keyword argument 'encoding'
This fix runs json.dump with no encoding key (such as before #a023cb) on
TypeError exception only.
- unified set attribute functions ... not sure why 2 identical functions
exist with diff names, now there are 3 while i repoint all modules to 1
- fixed issue with symlinks being created w/o existing src when force=no
- refactored conditionals, simplified where possible
- added tests for symlink to nonexistant source, with both force options
- made symlink on existing attomic (force)
Previously, the function checked only for a single CA root cert, however
some distributions may have multiple certs in a directory. This will now
try any .crt or .pem file contained within several common paths for
each platform.
Fixes#6412
* Adds another module utility file which generalizes the
access of urls via the urllib* libraries.
* Adds a new spec generator for common arguments.
* Makes the user-agent string configurable.
Fixes#6211
Allow security tokens and profiles to be used as arguments
to the 'common' ec2 modules
Mostly refactoring to provide two new methods,
`get_aws_connection_info`, which results in a dict that can be
passed through to the boto `connect_to_region` calls, and
`connect_to_aws` that can pass that dict through to the
`connect_to_region` method of the appropriate module.
Tidied up some variable names
Works around boto/boto#2100
profiles don't work with boto < 2.24, but this detects for that
and fails with an appropriate message. It is designed to work
if profile is not passed but boto < 2.24 is installed.
Modifications to allow empty aws auth variables to be passed
(this is useful if wanting to have the keys as an optional
parameter in ec2 calls - if set, use this value, if not set,
use boto config or env variables)
Reworked validate_certs improvements to work with refactoring
Added documentation for profile and security_token to affected modules
In order to simplify the workflow with the GCE modules, it's now
possible to add the parameters and project name as arguments to the
various GCE modules.
The inventory plugin also returns the IP of the host in
`ansible_ssh_host` so that you don't have to specify IPs into the
inventory file.
Some update to the documentation are also added.
Closes#5583.
Bugfixes:
* the remote_src param was not being converted to a boolean correctly,
resulting in it never being used by the module as the default behavior
was remote_src=True (issue #5581)
* the remote_src param was not listed in the generic file params, leading
to a failure when the above bug regarding remote_src was fixed
* the delimiter should always end with a newline to ensure that the file
fragments do not run together on one line
Fixes#5581
When disabled, the boto connection will be instantiated without validating
the SSL certificate from the target endpoint. This allows the modules to connect
to Eucalyptus instances running with self-signed certs without errors.
Fixes#3978
This doesn't account for boto configs where e.g. RDS has one
default region and EC2 another - all will default to `ec2_region_name`.
However, this is just handy to allow an easy site wide default
region if existing configuration already relies on it.
Modules can be improved to mention this in the documentation and
turn off required=True where needed. But it works with `ec2`
and `ec2_vol` without change.
Refactor the currently well-factored ec2 modules (i.e. those that already use ec2_connect) to
have a common argument spec. The idea is that new modules can use this spec without duplication
of code, and that new functionality can be added to the ec2 connection code (e.g. security
token argument)
1. if accept_hostkey is false, no matter if the host key is known or not, it will fail.
2. We don't check for the host key in /etc/ssh/ssh_known_hosts
This fixes both of those issues.
to be reused between modules. See library/system/service and library/system/ping for initial examples. Can
work the old way to just import 'basic', or can import the new way to import multiple pieces of code from
module_utils/.