Skip to content

Commit 2088df7

Browse files
djdanielssondjdanielsson
authored
updates for 2.6 (#1192)
* new file: gateway_role_definitions/defaults/main.yml new file: gateway_role_definitions/meta/argument_specs.yml new file: gateway_role_definitions/meta/main.yml new file: gateway_role_definitions/tasks/main.yml new file: gateway_role_team_assignments/defaults/main.yml new file: gateway_role_team_assignments/meta/argument_specs.yml new file: gateway_role_team_assignments/meta/main.yml new file: gateway_role_team_assignments/tasks/main.yml modified: gateway_role_user_assignments/defaults/main.yml modified: gateway_role_user_assignments/meta/argument_specs.yml * adding some generated readme just to have something * modified: roles/gateway_role_definitions/README.md modified: roles/gateway_role_team_assignments/README.md modified: roles/gateway_role_user_assignments/README.md * new file: changelogs/fragments/aap_26_additions.yml modified: roles/gateway_role_definitions/README.md modified: roles/gateway_role_definitions/meta/argument_specs.yml modified: roles/gateway_role_team_assignments/README.md modified: roles/gateway_role_team_assignments/meta/argument_specs.yml modified: roles/gateway_role_user_assignments/README.md * modified: changelogs/fragments/aap_26_additions.yml * modified: roles/gateway_role_definitions/README.md modified: roles/gateway_role_team_assignments/README.md modified: roles/gateway_role_user_assignments/README.md * modified: roles/gateway_role_definitions/README.md modified: roles/gateway_role_team_assignments/README.md modified: roles/gateway_role_user_assignments/README.md * modified: roles/gateway_role_definitions/README.md modified: roles/gateway_role_definitions/meta/argument_specs.yml modified: roles/gateway_role_team_assignments/README.md modified: roles/gateway_role_team_assignments/meta/argument_specs.yml modified: roles/gateway_role_user_assignments/README.md modified: roles/gateway_role_user_assignments/meta/argument_specs.yml
1 parent d2825f3 commit 2088df7

File tree

14 files changed

+743
-71
lines changed

14 files changed

+743
-71
lines changed

‎changelogs/fragments/aap_26_additions.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
minor_changes:
3+
- Updated `gateway_role_user_assignments` role these changes will only work in AAP 2.6+
4+
- Added `gateway_role_team_assignments` role for AAP 2.6+
5+
- Added `gateway_role_definitions` role for AAP 2.6+
6+
...

‎roles/gateway_role_definitions/README.md‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
# Ansible Role infra.aap_configuration.gateway_role_definitions
2+
3+
## Description
4+
5+
An Ansible Role to create/update/remove Role Definitions on Ansible gateway.
6+
7+
## Variables
8+
9+
|Variable Name|Default Value|Required|Description|Example|
10+
|:---|:---:|:---:|:---|:---|
11+
|`platform_state`|"present"|no|The state all objects will take unless overridden by object default|'absent'|
12+
|`aap_hostname`|""|yes|URL to the Ansible Automation Platform Server.|127.0.0.1|
13+
|`aap_validate_certs`|`true`|no|Whether or not to validate the Ansible Automation Platform Server's SSL certificate.||
14+
|`aap_username`|""|no|Admin User on the Ansible Automation Platform Server. Either username / password or oauthtoken need to be specified.||
15+
|`aap_password`|""|no|Platform Admin User's password on the Server. This should be stored in an Ansible Vault at vars/platform-secrets.yml or elsewhere and called from a parent playbook.||
16+
|`aap_token`|""|no|Controller Admin User's token on the Ansible Automation Platform Server. This should be stored in an Ansible Vault at or elsewhere and called from a parent playbook. Either username / password or oauthtoken need to be specified.||
17+
|`aap_request_timeout`|""|no|Specify the timeout in seconds Ansible should use in requests to the Ansible Automation Platform host.||
18+
|`gateway_role_definitions`|`see below`|yes|Data structure describing your role definitions Described below.||
19+
20+
### Enforcing defaults
21+
22+
The following Variables complement each other.
23+
If Both variables are not set, enforcing default values is not done.
24+
Enabling these variables enforce default values on options that are optional in the controller API.
25+
This should be enabled to enforce configuration and prevent configuration drift. It is recommended to be enabled, however it is not enforced by default.
26+
27+
Enabling this will enforce configuration without specifying every option in the configuration files.
28+
29+
'gateway_role_definitions_enforce_defaults' defaults to the value of 'aap_configuration_enforce_defaults' if it is not explicitly called. This allows for enforced defaults to be toggled for the entire suite of controller configuration roles with a single variable, or for the user to selectively use it.
30+
31+
|Variable Name|Default Value|Required|Description|
32+
|:---:|:---:|:---:|:---:|
33+
|`gateway_role_definitions_enforce_defaults`|`false`|no|Whether or not to enforce default option values on only the role definitions role|
34+
|`aap_configuration_enforce_defaults`|`false`|no|This variable enables enforced default values as well, but is shared globally.|
35+
36+
### Secure Logging Variables
37+
38+
The following Variables complement each other.
39+
If Both variables are not set, secure logging defaults to false.
40+
The role defaults to false as normally the add role definitions task does not include sensitive information.
41+
gateway_role_definitions_secure_logging defaults to the value of aap_configuration_secure_logging if it is not explicitly called. This allows for secure logging to be toggled for the entire suite of gateway configuration roles with a single variable, or for the user to selectively use it.
42+
43+
|Variable Name|Default Value|Required|Description|
44+
|:---:|:---:|:---:|:---:|
45+
|`gateway_role_definitions_secure_logging`|`false`|no|Whether or not to include the sensitive role definitions role tasks in the log. Set this value to `true` if you will be providing your sensitive values from elsewhere.|
46+
|`aap_configuration_secure_logging`|`false`|no|This variable enables secure logging as well, but is shared across multiple roles, see above.|
47+
48+
### Asynchronous Retry Variables
49+
50+
The following Variables set asynchronous retries for the role.
51+
If neither of the retries or delay or retries are set, they will default to their respective defaults.
52+
This allows for all items to be created, then checked that the task finishes successfully.
53+
This also speeds up the overall role.
54+
55+
|Variable Name|Default Value|Required|Description|
56+
|:---:|:---:|:---:|:---:|
57+
|`aap_configuration_async_retries`|30|no|This variable sets the number of retries to attempt for the role globally.|
58+
|`gateway_role_definitions_async_retries`|`aap_configuration_async_retries`|no|This variable sets the number of retries to attempt for the role.|
59+
|`aap_configuration_async_delay`|1|no|This sets the delay between retries for the role globally.|
60+
|`gateway_role_definitions_async_delay`|`aap_configuration_async_delay`|no|This sets the delay between retries for the role.|
61+
|`aap_configuration_loop_delay`|0|no|This variable sets the loop_delay for the role globally.|
62+
|`gateway_role_definitions_loop_delay`|`aap_configuration_loop_delay`|no|This variable sets the loop_delay for the role.|
63+
|`aap_configuration_async_dir`|`null`|no|Sets the directory to write the results file for async tasks. The default value is set to `null` which uses the Ansible Default of `/root/.ansible_async/`.|
64+
65+
## Data Structure
66+
67+
### Role Definition Variables
68+
69+
**WARNING: This role will only work in AAP 2.6+** Options for the `gateway_role_definitions` variable:
70+
71+
| Variable Name | Default Value | Required | Type | Description |
72+
|:--------------------|:-------------:|:--------:|:----:|:------------------------------------------------------------------------------------------------------|
73+
| `content_type` | N/A | yes | str | The content type for which the role applies (e.g., awx.inventory) |
74+
| `description` | N/A | no | str | Description of the role definition |
75+
| `name` | N/A | yes | str | The name of the role definition (must be unique) |
76+
| `new_name` | N/A | no | str | Setting this option will change the existing name (looked up via the name field) |
77+
| `permissions` | N/A | yes | list | List of permission strings to associate with the role (e.g., awx.view_inventory) |
78+
| `state` | `present` | no | str | Desired state of the resource. |
79+
80+
### Standard Role Definition Data Structure
81+
82+
#### Json Example
83+
84+
```json
85+
{
86+
"gateway_role_definitions": [
87+
{
88+
"name": "Create a role definition",
89+
"ansible.platform.role_definition": {
90+
"name": "Organization Inventory Admin",
91+
"description": "Grants full inventory access",
92+
"content_type": "awx.inventory",
93+
"permissions": [
94+
"awx.view_inventory",
95+
"awx.change_inventory"
96+
],
97+
"state": "present"
98+
}
99+
}
100+
]
101+
}
102+
```
103+
104+
#### Yaml Example
105+
106+
File name: `data/gateway_role_definitions.yml`
107+
108+
```yaml
109+
---
110+
gateway_role_definitions:
111+
- name: Create a role definition
112+
ansible.platform.role_definition:
113+
name: Organization Inventory Admin
114+
description: Grants full inventory access
115+
content_type: awx.inventory
116+
permissions:
117+
- awx.view_inventory
118+
- awx.change_inventory
119+
state: present
120+
```
121+
122+
## License
123+
124+
[GPL-3.0](https://github.com/redhat-cop/aap_configuration#licensing)

‎roles/gateway_role_definitions/defaults/main.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
# These are the default variables common to most gateway_configuration roles
3+
# You shouldn't need to define them again and again but they should be defined
4+
# aap_hostname: "{{ inventory_hostname }}"
5+
# gateway_token: ""
6+
# aap_validate_certs: false
7+
8+
# These are the default variables specific to the license role
9+
10+
# a list of dictionaries describing the gateway role_definitions
11+
gateway_role_definitions: []
12+
gateway_role_definitions_secure_logging: "{{ aap_configuration_secure_logging | default('false') }}"
13+
gateway_role_definitions_async_retries: "{{ aap_configuration_async_retries | default(30) }}"
14+
gateway_role_definitions_async_delay: "{{ aap_configuration_async_delay | default(1) }}"
15+
gateway_role_definitions_enforce_defaults: "{{ aap_configuration_enforce_defaults | default(false) }}"
16+
gateway_role_definitions_loop_delay: "{{ aap_configuration_loop_delay | default(0) }}"
17+
aap_configuration_async_dir:
18+
...

‎roles/gateway_role_definitions/meta/argument_specs.yml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
---
2+
argument_specs:
3+
main:
4+
short_description: An Ansible Role to create role_definitions on Ansible gateway for AAP 2.6+.
5+
options:
6+
gateway_role_definitions:
7+
description: Data structure describing your role_definitions
8+
type: list
9+
required: true
10+
elements: dict
11+
options:
12+
content_type:
13+
required: true
14+
type: str
15+
description: The content type for which the role applies (e.g., awx.inventory)
16+
description:
17+
type: str
18+
description: Description of the role definition
19+
name:
20+
required: true
21+
type: str
22+
description: The name of the role definition (must be unique)
23+
new_name:
24+
type: str
25+
description: Setting this option will change the existing name (looked up via the name field)
26+
permissions:
27+
required: true
28+
type: list
29+
description: List of permission strings to associate with the role (e.g., awx.view_inventory)
30+
state:
31+
default: present
32+
type: str
33+
description: Desired state of the role definition
34+
35+
# Async variables
36+
role_definitions_async_retries:
37+
default: "{{ aap_configuration_async_retries | default(30) }}"
38+
required: false
39+
description: This variable sets the number of retries to attempt for the role.
40+
aap_configuration_async_retries:
41+
default: 30
42+
required: false
43+
description: This variable sets number of retries across all roles as a default.
44+
role_definitions_async_delay:
45+
default: "{{ aap_configuration_async_delay | default(1) }}"
46+
required: false
47+
description: This variable sets delay between retries for the role.
48+
aap_configuration_async_delay:
49+
default: 1
50+
required: false
51+
description: This variable sets delay between retries across all roles as a default.
52+
aap_configuration_async_dir:
53+
default:
54+
required: false
55+
description: Sets the directory to write the results file for async tasks. The default value is set to `null` which uses the Ansible Default of `/root/.ansible_async/`.
56+
57+
# No_log variables
58+
gateway_role_definitions_secure_logging:
59+
default: "{{ aap_configuration_secure_logging | default(false) }}"
60+
required: false
61+
type: bool
62+
description: Whether or not to include the sensitive tasks from this role in the log. Set this value to `true` if you will be providing your sensitive values from elsewhere.
63+
aap_configuration_secure_logging:
64+
default: false
65+
required: false
66+
type: bool
67+
description: This variable enables secure logging across all roles as a default.
68+
69+
# Generic across all roles
70+
platform_state:
71+
default: present
72+
required: false
73+
description: The state all objects will take unless overridden by object default
74+
type: str
75+
aap_hostname:
76+
default: None
77+
required: false
78+
description: URL to the Ansible gateway Server.
79+
type: str
80+
aap_validate_certs:
81+
default: true
82+
required: false
83+
description: Whether or not to validate the Ansible gateway Server's SSL certificate.
84+
type: str
85+
aap_username:
86+
default: None
87+
required: false
88+
description: Admin User on the Ansible gateway Server. Either username / password or oauthtoken need to be specified.
89+
type: str
90+
aap_password:
91+
default: None
92+
required: false
93+
description: Gateway Admin User's password on the Ansible gateway Server. This should be stored in an Ansible Vault at vars/gateway-secrets.yml or elsewhere and called from a parent playbook. Either username / password or oauthtoken need to be specified.
94+
type: str
95+
aap_token:
96+
default: None
97+
required: false
98+
description: Gateway Admin User's token on the Ansible gateway Server. This should be stored in an Ansible Vault at or elsewhere and called from a parent playbook. Either username / password or oauthtoken need to be specified.
99+
type: str
100+
...

‎roles/gateway_role_definitions/meta/main.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
galaxy_info:
3+
role_name: gateway_role_definitions
4+
author: Auto Generated
5+
description: An Ansible Role to create role_definitions in Ansible gateway.
6+
company: Red Hat
7+
8+
# If the issue tracker for your role is not on github, uncomment the
9+
# next line and provide a value
10+
# issue_tracker_url: http://example.com/issue/tracker
11+
license: GPLv3
12+
13+
min_ansible_version: 2.16.0
14+
15+
platforms:
16+
- name: EL
17+
versions:
18+
- all
19+
20+
galaxy_tags:
21+
- gateway
22+
- aap
23+
- configuration
24+
- roledefinition
25+
- roledefinitions
26+
27+
dependencies:
28+
- role: global_vars
29+
...

‎roles/gateway_role_definitions/tasks/main.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
- name: Manage Gateway Role definitions Block
3+
vars:
4+
ansible_async_dir: "{{ aap_configuration_async_dir }}"
5+
no_log: "{{ gateway_role_definitions_secure_logging }}"
6+
block:
7+
- name: Role definitions | Configuration
8+
ansible.platform.role_definition:
9+
name: "{{ __gateway_role_definition_item.name | mandatory }}"
10+
new_name: "{{ __gateway_role_definition_item.new_name | default(omit, true) }}"
11+
description: "{{ __gateway_role_definition_item.description | default(('' if gateway_role_definitions_enforce_defaults else omit), true) }}"
12+
content_type: "{{ __gateway_role_definition_item.content_type | mandatory }}"
13+
permissions: "{{ __gateway_role_definition_item.permissions | mandatory }}"
14+
state: "{{ __gateway_role_definition_item.state | default(platform_state | default(omit, true)) }}"
15+
16+
# Role Standard Options
17+
gateway_hostname: "{{ aap_hostname | default(omit, true) }}"
18+
gateway_username: "{{ aap_username | default(omit, true) }}"
19+
gateway_password: "{{ aap_password | default(omit, true) }}"
20+
gateway_token: "{{ aap_token | default(omit, true) }}"
21+
gateway_request_timeout: "{{ aap_request_timeout | default(omit, true) }}"
22+
gateway_validate_certs: "{{ aap_validate_certs | default(omit) }}"
23+
loop: "{{ gateway_role_definitions }}"
24+
loop_control:
25+
loop_var: __gateway_role_definitions_item
26+
label: "{{ __operation.verb }} Role Based Access Entry on Controller {{ __gateway_role_definitions_item.1 | default(__gateway_role_definitions_item.role_definition) }}"
27+
pause: "{{ gateway_role_definitions_loop_delay }}"
28+
async: 1000
29+
poll: 0
30+
register: __gateway_role_definitions_job_async
31+
changed_when: not __gateway_role_definitions_job_async.changed
32+
vars:
33+
__operation: "{{ operation_translate[__gateway_role_definitions_item.state | default(platform_state) | default('present')] }}"
34+
35+
- name: Role definitions | Wait for finish the configuration
36+
when:
37+
- not ansible_check_mode
38+
- __gateway_role_definitions_job_async_results_item.ansible_job_id is defined
39+
ansible.builtin.include_role:
40+
name: infra.aap_configuration.collect_async_status
41+
loop: "{{ __gateway_role_definitions_job_async.results }}"
42+
loop_control:
43+
loop_var: __gateway_role_definitions_job_async_results_item
44+
label: "{{ __operation.verb }} Role {{ __gateway_role_definitions_job_async_results_item.__gateway_role_definitions_item.1 | default(__gateway_role_definitions_job_async_results_item.__gateway_role_definitions_item.role_definition) }} | Wait for finish the Roles {{ __operation.action }}"
45+
vars:
46+
cas_secure_logging: "{{ gateway_role_definitions_secure_logging }}"
47+
cas_job_async_results_item: "{{ __gateway_role_definitions_job_async_results_item }}"
48+
cas_error_list_var_name: "gateway_role_definitions_errors"
49+
__operation: "{{ operation_translate[__gateway_role_definitions_job_async_results_item.__controller_role_item.state | default(platform_state) | default('present')] }}"
50+
51+
always:
52+
- name: Cleanup async results files
53+
when:
54+
- not ansible_check_mode
55+
- __gateway_role_definitions_job_async_results_item.ansible_job_id is defined
56+
ansible.builtin.async_status:
57+
jid: "{{ __gateway_role_definitions_job_async_results_item.ansible_job_id }}"
58+
mode: cleanup
59+
loop: "{{ __gateway_role_definitions_job_async.results }}"
60+
loop_control:
61+
loop_var: __gateway_role_definitions_job_async_results_item
62+
label: "Cleaning up job results file: {{ __gateway_role_definitions_job_async_results_item.results_file | default('Unknown') }}"
63+
...

0 commit comments

Comments
 (0)