query_convert_result now reports the failing field name per-key instead
of aborting the whole loop with an unrelated try/except scope. main()
also rejects state=query with action=member and query is excluded from
rename's generated args and PARAM_MAPPING query fields.
The task used a users dict with name, first and last name given
and state:absent. This combination does not make sense and was
silenty ignored before by ipauser module.
The ipauser module has been reworked to use the new PARAM_MAPPING added
to ansible_freeipa_module.
The member handling for manager, principal, certificate and certmapdata
has been simplified by using gen_member_add_del_lists. The member
entries in PARAM_MAPPING are now marked with "member": True. This
replaces the manual calls to gen_add_del_lists, gen_add_list and
gen_intersection_list across three separate action/state branches with
a single unified call.
The new query state allows to retrieve user information from IPA.
The query_param option controls which fields are returned: BASE for
essential fields, ALL for all fields, PKEY_ONLY for user names only,
or a list of specific field names.
Here is the updated documentation of the module:
README-user.md
New tests for the query state can be found at:
tests/user/test_user_query.yml
New functions and methods have been added to reduce code complexity
and duplication in several modules, as well as to enable query mode
in the modules.
New functions:
gen_member_add_del_lists
Compute member add/del lists for all member params marked with
"member": True in PARAM_MAPPING. Handles sync, add-only and
remove-only modes based on action and state.
gen_member_args_from_mapping
Build a member args dict for compare_args_ipa() from
PARAM_MAPPING. Replaces per-module gen_member_args() functions.
New static methods:
gen_args_from_mapping
Generate IPA command args dict from PARAM_MAPPING. Replaces
per-module gen_args() functions.
extract_params
Extract parameter values from module params using PARAM_MAPPING.
extract_params_from_entry
Extract parameter values from a users/hosts dict entry using
PARAM_MAPPING.
build_query_param_settings
Build query parameter settings from PARAM_MAPPING and
QUERY_FIELDS for use with execute_query.
New methods:
execute_query
Execute query state for modules supporting state: query.
_extract_query_fields
Extract requested fields from a query result using the mapping.
The params_fail_used_invalid method has been extended to accept optional
params and param_mapping arguments for use with extracted params dicts.
PARAM_MAPPING is an ordered dict that maps Ansible parameter names to
their metadata. Each entry is a dict with optional keys:
"api_name" IPA attribute name if different from the Ansible
parameter name.
"gen_args" Set to False to exclude the parameter from
gen_args_from_mapping (used for members and
parameters handled separately).
"member" Set to True to include the parameter in
gen_member_add_del_lists and
gen_member_args_from_mapping.
"module_param" Set to True for top-level module parameters that
are not part of the entity (e.g. action, state,
query_param, users).
"return_only" Set to True for parameters that are only returned
by IPA and never sent (excluded from
gen_args_from_mapping).
"nonempty_list" Set to True if an empty list value should not be
sent to IPA.
"lowercase" Set to True to lowercase values before comparison.
"convert_to" Conversion type for the parameter value
(e.g. "str", "int", "bool").
An empty dict {} means the Ansible name equals the IPA attribute name
and the parameter is included in gen_args_from_mapping with no special
handling.
For query support a QUERY_FIELDS dict is needed with "prefix" for the
grouping key in PKEY_ONLY results, "primary_key" for the IPA name
attribute and "base" for the list of essential field names returned by
default.
ansible-lint was updated to v26.4.0, yamllint to v1.38.0 and pylint to
v4.0.6.
parseable was deactivated in .ansible-lint as this option is not
supported any more.
The tests using SSH public tests without using the "ssh-" key type name
are failing with latest Fedora versions.
The missing "ssh-rsa" key type name for the ssh public keys has been
added.
AAH and also Galaxy are automatically trying to render the base README.md
file in the collection even if "readme" is set to another file in galaxy.yml.
Fixes:
1) README.md is renamed to README-COLLECTION.md
2) New README.md is generated with information about the rename and also
pointing to the README-COLLECTION.md file in the collection and also
the upstream documentation (versioned and latest).
3) Upstream "documentation" in galaxy.yml set to new README.md file.
The new container_save and container_load functions can be used to
save and load container images.
container_save
Save a container image to a local file.
Example: container_save "${name}"
container_load
Load a container image from an tar archive.
Example: local_image=$(container_load "${archive}")
The script utils/build-galaxy-release.sh has been renamed to
utils/build-collection.sh, the script provides the same options, but
requires an extra argument now:
build-collection.sh [options] rpm|aah|galaxy
The namespace and name are defined according to the argument:
rpm freeipa.ansible_freeipa - General use and RPMs
galaxy freeipa.ansible_freeipa - Ansible Galaxy
aah redhat.rhel_idm - Ansible AutomationHub
The generated file README-COLLECTION.md is set in galaxy.yml as the
documentation entry point for the collections generated with aah and galaxy
as Ansible AutomationHub and also Ansible Galaxy are not able to render the
documentation README files in the collection properly.
The commit also changes the calls of utils/build-galaxy-release.sh to
utils/build-collection.sh.
The firewalld zone verification tasks in ipaserver, ipareplica, and
ipabackup roles were triggering Ansible warnings due to variable
ipareplica_firewalld_zone not being defined when evaluating the task
name.
This fix remove the Jinja template from the task names and wrap the
tasks in a single block so the variable verification is done only once.
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
Adding an A/AAAA record to a host fails if there's not a reverse zone
set that the resulting PTR record can be added to, even if
create_reverse is false.
Changing the rule to create the reverse record fixes the issue.
Fixes: #1381
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
There is a new paskeyconfig management module placed in the plugins
folder:
plugins/modules/ipapasskeyconfig.py
The paskeyconfig module allows to retrieve and modify global passkey
configuration attributes.
Here is the documentation of the module:
README-passkeyconfig.md
New example playbooks have been added:
playbooks/passkeyconfig/passkeyconfig-retrieve.yml
playbooks/passkeyconfig/passkeyconfig-present.yml
New tests for the module can be found at:
tests/passkeyconfig/test_passkeyconfig.yml
tests/passkeyconfig/test_passkeyconfig_client_context.yml
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
When testing passkey attributes some version of IPA do not support it,
se we need a fact that states that the support is available for proper
testing.
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
sysaccounts can now be used as a member for roles.
Example:
- name: Ensure role my-app role has sysaccount member my-app
iparole:
name: my-app role
sysaccount: my-app
action: member
New tests for the module:
tests/role/test_role_sysaccount_member.yml
The error message for an invalid profile has changes in dogtag. The new
message is "Certificate operation cannot be completed: Unable to get
enrollment template for <profile name>: Profile not found"
Therefore the test is additionally checking for "Profile not found" now.
There is a new sysaccount management module placed in the plugins folder:
plugins/modules/ipasysaccount.py
The sysaccount module allows to ensure presence or absence of system
accounts.
Here is the documentation for the module:
README-sysaccount.md
New sysaccount example playbooks:
playbooks/sysaccount/sysaccount-absent.yml
playbooks/sysaccount/sysaccount-disabled.yml
playbooks/sysaccount/sysaccount-enabled.yml
playbooks/sysaccount/sysaccount-present.yml
playbooks/sysaccount/sysaccount-privileged.yml
playbooks/sysaccount/sysaccount-unprivileged.yml
New tests for the module:
tests/sysaccount/test_sysaccount.yml
tests/sysaccount/test_sysaccount_client_context.yml
As the ansible_version variable may contain a version specification, we
need a version_name to correctly report the job label in Azure.
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
By using the 'ansible-version' variable as '<2.17' allows 'pip' to
install the latest version of the 2.16 series, instead of version 2.16.0
in the case '==2.16'. This ensures we run the tests with the latest
supported version for the specific distro.
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
Modify nigtly pipelines to use the same distro-to-Ansible version map
so that the Ansible version matches the required version for the
specific distro. Nightly pipelines are the same used for Weekly tests.
This was required due to recent updates for Python 3.14 and Ansible
upstream versions.
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
ansible-lint version series 24.y is not working with ansible-core 2.19 and
requires versions in series 25.y. Also, other tools were update to more
recent versions.
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
Although the available ansible-core package version for c9s is 2.14, the
upstream "pip" version of this package has a broken certificate and is
unusable against Galaxy.
This patch fixes the version to 2.16, as it is the same version for c8s
and c10s, and the oldest one available as packages for the CentOS
Streams.
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
With Python 3.14, the required pytest version stopped working due to
breaking changes in AST.
This patch changes the test tool versions to the most recent one, by
requiring only the minimal version, but not setting a specific one.
Recent pytest version also requires that the search path for Python
modules is defined.
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
Pylint 4.0.1 seems to not understand that some of the constants used by
ansible-freeipa roles and modules are constants and not variables, and
complain about the naming style.
By adding these constant names to the "good-names" list avoid pylint
errors and don't require future unnecessary changes.
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
A task in 'roles/ipaclient/tasks/install.yml' uses logic that
ansible-lint and jinja are unable to evaluate due to missing type. By
refactoring the task the tools are able to evaluate the task.
