mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-07-30 19:34:45 +00:00
ipahost: Extension to be able handle several hosts and all settings
The ipahost management module was not able to add several hosts at once.
Addtionally there have been settings missing.
ansible_freeipa_module has been extended to provide two additional functions
that are needed to simplify the extension of the ipahost module:
gen_add_del_lists(user_list, res_list)
encode_certificate(cert)
gen_add_del_lists will generate the lists for the addition and removal of
members using the provided user and ipa settings.
encode_certificate will encode a certificate using base64 with also taking
FreeIPA and Python versions into account.
The missing settings in ipahost have been:
certificate
managedby_host
principal
create_keytab_[user,group,host,hostgroup]
retrieve_keytab_[user,group,host,hostgroup]
sshpubkey
userclass
auth_ind
requires_pre_auth
ok_as_delegate
ok_to_auth_as_delegate
The README-host.md file has been updated to provide information about the
new settings and also the members. Also examples for the new things have
been added.
New example playbooks have been added:
playbooks/host/add-host.yml
playbooks/host/host-member-allow_create_keytab-absent.yml
playbooks/host/host-member-allow_create_keytab-present.yml
playbooks/host/host-member-allow_retrieve_keytab-absent.yml
playbooks/host/host-member-allow_retrieve_keytab-present.yml
playbooks/host/host-member-certificate-absent.yml
playbooks/host/host-member-certificate-present.yml
playbooks/host/host-member-managedby_host-absent.yml
playbooks/host/host-member-managedby_host-present.yml
playbooks/host/host-member-principal-absent.yml
playbooks/host/host-member-principal-present.yml
playbooks/host/host-present-with-allow_create_keytab.yml
playbooks/host/host-present-with-allow_retrieve_keytab.yml
playbooks/host/host-present-with-certificate.yml
playbooks/host/host-present-with-managedby_host.yml
playbooks/host/host-present-with-principal.yml
playbooks/host/host-present-with-randompassword.yml
playbooks/host/host-present.yml
playbooks/host/hosts-member-certificate-absent.yml
playbooks/host/hosts-member-certificate-present.yml
playbooks/host/hosts-member-managedby_host-absent.yml
playbooks/host/hosts-member-managedby_host-present.yml
playbooks/host/hosts-member-principal-absent.yml
playbooks/host/hosts-member-principal-present.yml
playbooks/host/hosts-present-with-certificate.yml
playbooks/host/hosts-present-with-managedby_host.yml
playbooks/host/hosts-present-with-randompasswords.yml
New tests have been added for the module:
tests/host/certificate/cert1.der
tests/host/certificate/cert1.pem
tests/host/certificate/cert2.der
tests/host/certificate/cert2.pem
tests/host/certificate/cert3.der
tests/host/certificate/cert3.pem
tests/host/certificate/private1.key
tests/host/certificate/private2.key
tests/host/certificate/private3.key
tests/host/certificate/test_host_certificate.yml
tests/host/certificate/test_hosts_certificate.yml
tests/host/test_host.yml
tests/host/test_host_allow_create_keytab.yml
tests/host/test_host_allow_retrieve_keytab.yml
tests/host/test_host_managedby_host.yml
tests/host/test_host_principal.yml
tests/host/test_host_random.yml
tests/host/test_hosts.yml
tests/host/test_hosts_managedby_host.yml
tests/host/test_hosts_principal.yml
This commit is contained in:
Thomas Woerner
140
README-host.md
140
README-host.md
@@ -41,7 +41,7 @@ ipaserver.test.local
|
||||
```
|
||||
|
||||
|
||||
Example playbook to add hosts:
|
||||
Example playbook to ensure host presence:
|
||||
|
||||
```yaml
|
||||
---
|
||||
@@ -67,7 +67,7 @@ Example playbook to add hosts:
|
||||
```
|
||||
|
||||
|
||||
Example playbook to create host without DNS:
|
||||
Example playbook to ensure host presence without DNS:
|
||||
|
||||
```yaml
|
||||
---
|
||||
@@ -85,28 +85,118 @@ Example playbook to create host without DNS:
|
||||
```
|
||||
|
||||
|
||||
Example playbook to initiate the generation of a random password to be used in bulk enrollment:
|
||||
Example playbook to ensure host presence with a random password:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to handle hosts
|
||||
- name: Ensure host with random password
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
# Generate a random password for bulk enrollment
|
||||
- ipahost:
|
||||
- name: Host host01.example.com present with random password
|
||||
ipahost:
|
||||
ipaadmin_password: MyPassword123
|
||||
name: host01.example.com
|
||||
description: Example host
|
||||
ip_address: 192.168.0.123
|
||||
random: yes
|
||||
force: yes
|
||||
register: ipahost
|
||||
|
||||
- name: Print generated random password
|
||||
debug:
|
||||
var: ipahost.host.randompassword
|
||||
```
|
||||
Please remember that the `force` tag will also force the generation of a new random password even if the host already exists and if `update_password` is limited to `on_create`.
|
||||
|
||||
|
||||
Example playbook to ensure presence of several hosts with a random password:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Ensure hosts with random password
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Hosts host01.example.com and host01.example.com present with random passwords
|
||||
ipahost:
|
||||
ipaadmin_password: MyPassword123
|
||||
hosts:
|
||||
- name: host01.example.com
|
||||
random: yes
|
||||
force: yes
|
||||
- name: host02.example.com
|
||||
random: yes
|
||||
force: yes
|
||||
register: ipahost
|
||||
|
||||
- name: Print generated random password for host01.example.com
|
||||
debug:
|
||||
var: ipahost.host["host01.example.com"].randompassword
|
||||
|
||||
- name: Print generated random password for host02.example.com
|
||||
debug:
|
||||
var: ipahost.host["host02.example.com"].randompassword
|
||||
```
|
||||
Please remember that the `force` tag will also force the generation of a new random password even if the host alreay exists and if `update_password` is limited to `on_create`.
|
||||
|
||||
|
||||
Example playbook to ensure presence of host member principal:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Host present with principal
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Host host01.example.com present with principals host/testhost01.example.com and host/myhost01.example.com
|
||||
ipahost:
|
||||
ipaadmin_password: MyPassword123
|
||||
name: host01.example.com
|
||||
principal:
|
||||
- host/testhost01.example.com
|
||||
- host/myhost01.example.com
|
||||
action: member
|
||||
```
|
||||
|
||||
|
||||
Example playbook to ensure presence of host member certificate:
|
||||
|
||||
```yaml
|
||||
- name: Host present with certificate
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Host host01.example.com present with certificate
|
||||
ipahost:
|
||||
ipaadmin_password: MyPassword123
|
||||
name: host01.example.com
|
||||
certificate:
|
||||
- MIIC/zCCAeegAwIBAg...
|
||||
action: member
|
||||
```
|
||||
|
||||
|
||||
Example playbook to ensure presence of member managedby_host for serveral hosts:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Host present with managedby_host
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
ipahost:
|
||||
ipaadmin_password: MyPassword123
|
||||
hosts:
|
||||
- name: host01.exmaple.com
|
||||
managedby_host: server.exmaple.com
|
||||
- name: host02.exmaple.com
|
||||
managedby_host: server.exmaple.com
|
||||
action: member
|
||||
```
|
||||
|
||||
|
||||
Example playbook to disable a host:
|
||||
@@ -155,7 +245,20 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`name` \| `fqdn` | The list of host name strings. | yes
|
||||
`name` \| `fqdn` | The list of host name strings. `name` with *host variables* or `hosts` containing *host variables* need to be used. | no
|
||||
**Host variables** | Only used with `name` variable in the first level. | no
|
||||
`hosts` | The list of host dicts. Each `hosts` dict entry can contain **host variables**.<br>There is one required option in the `hosts` dict:| no
|
||||
| `name` \| `fqdn` - The user name string of the entry. | yes
|
||||
| **Host variables** | no
|
||||
`update_password` | Set password for a host in present state only on creation or always. It can be one of `always` or `on_create` and defaults to `always`. | no
|
||||
`action` | Work on host or member level. It can be on of `member` or `host` and defaults to `host`. | no
|
||||
`state` | The state to ensure. It can be one of `present`, `absent` or `disabled`, default: `present`. | yes
|
||||
|
||||
|
||||
**Host Variables:**
|
||||
|
||||
Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`description` | The host description. | no
|
||||
`locality` | Host locality (e.g. "Baltimore, MD"). | no
|
||||
`location` \| `ns_host_location` | Host location (e.g. "Lab 2"). | no
|
||||
@@ -163,13 +266,28 @@ Variable | Description | Required
|
||||
`os` \| `ns_os_version` | Host operating system and version (e.g. "Fedora 9"). | no
|
||||
`password` \| `user_password` \| `userpassword` | Password used in bulk enrollment. | no
|
||||
`random` \| `random_password` | Initiate the generation of a random password to be used in bulk enrollment. | no
|
||||
`certificate` \| `usercertificate` | List of base-64 encoded host certificates | no
|
||||
`managedby` \| `principalname` \| `krbprincipalname` | List of hosts that can manage this host | no
|
||||
`principal` \| `principalname` \| `krbprincipalname` | List of principal aliases for this host | no
|
||||
`allow_create_keytab_user` \| `ipaallowedtoperform_write_keys_user` | Users allowed to create a keytab of this host. <br>Options: | no
|
||||
`allow_create_keytab_group` \| `ipaallowedtoperform_write_keys_group` | Groups allowed to create a keytab of this host. <br>Options: | no
|
||||
`allow_create_keytab_host` \| `ipaallowedtoperform_write_keys_host` | Hosts allowed to create a keytab of this host. <br>Options: | no
|
||||
`allow_create_keytab_hostgroup` \| `ipaallowedtoperform_write_keys_hostgroup` | Host groups allowed to create a keytab of this host. <br>Options: | no
|
||||
`allow_retrieve_keytab_user` \| `ipaallowedtoperform_read_keys_user` | Users allowed to retieve a keytab of this host. <br>Options: | no
|
||||
`allow_retrieve_keytab_group` \| `ipaallowedtoperform_read_keys_group` | Groups allowed to retieve a keytab of this host. <br>Options: | no
|
||||
`allow_retrieve_keytab_host` \| `ipaallowedtoperform_read_keys_host` | Hosts allowed to retieve a keytab of this host. <br>Options: | no
|
||||
`allow_retrieve_keytab_hostgroup` \| `ipaallowedtoperform_read_keys_hostgroup` | Host groups allowed to retieve a keytab of this host. <br>Options: | no
|
||||
`mac_address` \| `macaddress` | List of hardware MAC addresses. | no
|
||||
`sshpubkey` \| `ipasshpubkey` | List of SSH public keys | no
|
||||
`userclass` \| `class` | Host category (semantics placed on this attribute are for local interpretation) | no
|
||||
`auth_ind` \| `krbprincipalauthind` | Defines a whitelist for Authentication Indicators. Use 'otp' to allow OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA authentications. Other values may be used for custom configurations. choices: ["radius", "otp", "pkinit", "hardened"] | no
|
||||
`requires_pre_auth` \| `ipakrbrequirespreauth` | Pre-authentication is required for the service (bool) | no
|
||||
`ok_as_delegate` \| `ipakrbokasdelegate` | Client credentials may be delegated to the service (bool) | no
|
||||
`ok_to_auth_as_delegate` \| `ipakrboktoauthasdelegate` | The service is allowed to authenticate on behalf of a client (bool) | no
|
||||
`force` | Force host name even if not in DNS. | no
|
||||
`reverse` | Reverse DNS detection. | no
|
||||
`ip_address` \| `ipaddress` | The host IP address. | no
|
||||
`update_dns` | Update DNS entries. | no
|
||||
`update_password` | Set password for a host in present state only on creation or always. It can be one of `always` or `on_create` and defaults to `always`. | no
|
||||
`state` | The state to ensure. It can be one of `present`, `absent` or `disabled`, default: `present`. | yes
|
||||
|
||||
|
||||
Return Values
|
||||
|
||||
Reference in New Issue
Block a user