ngine_io.cloudstack.cs_firewall – Manages firewall rules on Apache CloudStack based clouds.

From Get docs
Ansible/docs/2.10/collections/ngine io/cloudstack/cs firewall module


ngine_io.cloudstack.cs_firewall – Manages firewall rules on Apache CloudStack based clouds.

Note

This plugin is part of the ngine_io.cloudstack collection (version 1.1.0).

To install it use: ansible-galaxy collection install ngine_io.cloudstack.

To use it in a playbook, specify: ngine_io.cloudstack.cs_firewall.


New in version 0.1.0: of ngine_io.cloudstack


Synopsis

  • Creates and removes firewall rules.

Requirements

The below requirements are needed on the host that executes this module.

  • python >= 2.6
  • cs >= 0.9.0

Parameters

Parameter Choices/Defaults Comments

account

string

Account the firewall rule is related to.

api_http_method

string

  • get
  • post

HTTP method used to query the API endpoint.

If not given, the CLOUDSTACK_METHOD env variable is considered.

As the last option, the value is taken from the ini config file, also see the notes.

Fallback value is get if not specified.

api_key

string

API key of the CloudStack API.

If not given, the CLOUDSTACK_KEY env variable is considered.

As the last option, the value is taken from the ini config file, also see the notes.

api_region

string

Default:

"cloudstack"

Name of the ini section in the cloustack.ini file.

If not given, the CLOUDSTACK_REGION env variable is considered.

api_secret

string

Secret key of the CloudStack API.

If not set, the CLOUDSTACK_SECRET env variable is considered.

As the last option, the value is taken from the ini config file, also see the notes.

api_timeout

integer

HTTP timeout in seconds.

If not given, the CLOUDSTACK_TIMEOUT env variable is considered.

As the last option, the value is taken from the ini config file, also see the notes.

Fallback value is 10 seconds if not specified.

api_url

string

URL of the CloudStack API e.g. https://cloud.example.com/client/api.

If not given, the CLOUDSTACK_ENDPOINT env variable is considered.

As the last option, the value is taken from the ini config file, also see the notes.

api_verify_ssl_cert

string

CA authority cert file.

If not given, the CLOUDSTACK_VERIFY env variable is considered.

As the last option, the value is taken from the ini config file, also see the notes.

Fallback value is null if not specified.

cidrs

list / elements=string

Default:

"0.0.0.0/0"

List of CIDRs (full notation) to be used for firewall rule.

Since version 2.5, it is a list of CIDR.


aliases: cidr

domain

string

Domain the firewall rule is related to.

end_port

integer

End port for this rule. Considered if protocol=tcp or protocol=udp.

If not specified, equal start_port.

icmp_code

integer

Error code for this icmp message.

Considered if protocol=icmp.

icmp_type

integer

Type of the icmp message being sent.

Considered if protocol=icmp.

ip_address

string

Public IP address the ingress rule is assigned to.

Required if type=ingress.

network

string

Network the egress rule is related to.

Required if type=egress.

poll_async

boolean

  • no

  • yes ←

Poll async jobs until job has finished.

project

string

Name of the project the firewall rule is related to.

protocol

string

  • tcp ←

  • udp
  • icmp
  • all

Protocol of the firewall rule.

all is only available if type=egress.

start_port

integer

Start port for this rule.

Considered if protocol=tcp or protocol=udp.


aliases: port

state

string

  • present ←

  • absent

State of the firewall rule.

tags

list / elements=dictionary

List of tags. Tags are a list of dictionaries having keys key and value.

To delete all tags, set an empty list e.g. tags: [].


aliases: tag

type

string

  • ingress ←

  • egress

Type of the firewall rule.

zone

string

Name of the zone in which the virtual machine is in.

If not set, default zone is used.



Notes

Note

  • Ansible uses the cs library’s configuration method if credentials are not provided by the arguments api_url, api_key, api_secret. Configuration is read from several locations, in the following order. The CLOUDSTACK_ENDPOINT, CLOUDSTACK_KEY, CLOUDSTACK_SECRET and CLOUDSTACK_METHOD. CLOUDSTACK_TIMEOUT environment variables. A CLOUDSTACK_CONFIG environment variable pointing to an .ini file. A cloudstack.ini file in the current working directory. A .cloudstack.ini file in the users home directory. Optionally multiple credentials and endpoints can be specified using ini sections in cloudstack.ini. Use the argument api_region to select the section name, default section is cloudstack. See https://github.com/exoscale/cs for more information.
  • A detailed guide about cloudstack modules can be found in the CloudStack Cloud Guide.
  • This module supports check mode.


Examples

- name: Allow inbound port 80/tcp from 1.2.3.4 to 4.3.2.1
  ngine_io.cloudstack.cs_firewall:
    ip_address: 4.3.2.1
    port: 80
    cidr: 1.2.3.4/32

- name: Allow inbound tcp/udp port 53 to 4.3.2.1
  ngine_io.cloudstack.cs_firewall:
    ip_address: 4.3.2.1
    port: 53
    protocol: '{{ item }}'
  with_items:
  - tcp
  - udp

- name: Ensure firewall rule is removed
  ngine_io.cloudstack.cs_firewall:
    ip_address: 4.3.2.1
    start_port: 8000
    end_port: 8888
    cidr: 17.0.0.0/8
    state: absent

- name: Allow all outbound traffic
  ngine_io.cloudstack.cs_firewall:
    network: my_network
    type: egress
    protocol: all

- name: Allow only HTTP outbound traffic for an IP
  ngine_io.cloudstack.cs_firewall:
    network: my_network
    type: egress
    port: 80
    cidr: 10.101.1.20

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description

cidr

string

success

CIDR string of the rule.


Sample:

0.0.0.0/0

cidrs

list / elements=string

success

CIDR list of the rule.


Sample:

['0.0.0.0/0']

end_port

integer

success

End port of the rule.


Sample:

80

icmp_code

integer

success

ICMP code of the rule.


Sample:

1

icmp_type

integer

success

ICMP type of the rule.


Sample:

1

id

string

success

UUID of the rule.


Sample:

04589590-ac63-4ffc-93f5-b698b8ac38b6

ip_address

string

success

IP address of the rule if type=ingress


Sample:

10.100.212.10

network

string

success

Name of the network if type=egress


Sample:

my_network

protocol

string

success

Protocol of the rule.


Sample:

tcp

start_port

integer

success

Start port of the rule.


Sample:

80

type

string

success

Type of the rule.


Sample:

ingress




Authors

  • René Moser (@resmo)

© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.10/collections/ngine_io/cloudstack/cs_firewall_module.html


Retrieved from "https://getdocs.org/index.php?title=Ansible/docs/2.10/collections/ngine_io/cloudstack/cs_firewall_module&oldid=59549"
Powered by MediaWiki