Skip to content
Snippets Groups Projects
Commit bf864469 authored by Rafael Guterres Jeffman's avatar Rafael Guterres Jeffman
Browse files

Add support for attribute `permission` on dnsforwardzone module. 

Adds missing attribute `permission to dnsforwardzone module, that
enable setting `manageby` for the DNS Forwar Zone.
parent 1d223c2b
Branches
Tags
No related merge requests found
Show whitespace changes
Inline Side-by-side
README-dnsforwardzone.md
+ 1
− 0
View file @ bf864469
...@@ -104,6 +104,7 @@ Variable | Description | Required ...@@ -104,6 +104,7 @@ Variable | Description | Required
  | `port`: The forwarder IP port. | no   | `port`: The forwarder IP port. | no
`forwardpolicy` \| `idnsforwardpolicy` | Per-zone conditional forwarding policy. Possible values are `only`, `first`, `none`. Set to "none" to disable forwarding to global forwarder for this zone. In that case, conditional zone forwarders are disregarded. | no `forwardpolicy` \| `idnsforwardpolicy` | Per-zone conditional forwarding policy. Possible values are `only`, `first`, `none`. Set to "none" to disable forwarding to global forwarder for this zone. In that case, conditional zone forwarders are disregarded. | no
`skip_overlap_check` | Force DNS zone creation even if it will overlap with an existing zone. Defaults to False. | no `skip_overlap_check` | Force DNS zone creation even if it will overlap with an existing zone. Defaults to False. | no
`permission` | Allow DNS Forward Zone to be managed. (bool) | no
`action` | Work on group or member level. It can be on of `member` or `dnsforwardzone` and defaults to `dnsforwardzone`. | no `action` | Work on group or member level. It can be on of `member` or `dnsforwardzone` and defaults to `dnsforwardzone`. | no
`state` | The state to ensure. It can be one of `present`, `absent`, `enabled` or `disabled`, default: `present`. | yes `state` | The state to ensure. It can be one of `present`, `absent`, `enabled` or `disabled`, default: `present`. | yes
......
plugins/modules/ipadnsforwardzone.py
+ 49
− 22
View file @ bf864469
...@@ -75,6 +75,11 @@ options: ...@@ -75,6 +75,11 @@ options:
- Force DNS zone creation even if it will overlap with an existing zone. - Force DNS zone creation even if it will overlap with an existing zone.
required: false required: false
default: false default: false
permission:
description:
- Allow DNS Forward Zone to be managed.
required: false
type: bool
''' '''
EXAMPLES = ''' EXAMPLES = '''
...@@ -168,6 +173,8 @@ def main(): ...@@ -168,6 +173,8 @@ def main():
required=False, required=False,
choices=['only', 'first', 'none']), choices=['only', 'first', 'none']),
skip_overlap_check=dict(type='bool', required=False), skip_overlap_check=dict(type='bool', required=False),
permission=dict(type='bool', required=False,
aliases=['managedby']),
action=dict(type="str", default="dnsforwardzone", action=dict(type="str", default="dnsforwardzone",
choices=["member", "dnsforwardzone"]), choices=["member", "dnsforwardzone"]),
# state # state
...@@ -191,6 +198,7 @@ def main(): ...@@ -191,6 +198,7 @@ def main():
forwardpolicy = module_params_get(ansible_module, "forwardpolicy") forwardpolicy = module_params_get(ansible_module, "forwardpolicy")
skip_overlap_check = module_params_get(ansible_module, skip_overlap_check = module_params_get(ansible_module,
"skip_overlap_check") "skip_overlap_check")
permission = module_params_get(ansible_module, "permission")
state = module_params_get(ansible_module, "state") state = module_params_get(ansible_module, "state")
if state == 'present' and len(names) != 1: if state == 'present' and len(names) != 1:
...@@ -215,7 +223,9 @@ def main(): ...@@ -215,7 +223,9 @@ def main():
wants_enable = True wants_enable = True
if operation == "del": if operation == "del":
invalid = ["forwarders", "forwardpolicy", "skip_overlap_check"] invalid = [
"forwarders", "forwardpolicy", "skip_overlap_check", "permission"
]
for x in invalid: for x in invalid:
if vars()[x] is not None: if vars()[x] is not None:
ansible_module.fail_json( ansible_module.fail_json(
...@@ -241,6 +251,9 @@ def main(): ...@@ -241,6 +251,9 @@ def main():
api_connect() api_connect()
for name in names: for name in names:
commands = []
command = None
# Make sure forwardzone exists # Make sure forwardzone exists
existing_resource = find_dnsforwardzone(ansible_module, name) existing_resource = find_dnsforwardzone(ansible_module, name)
...@@ -249,6 +262,18 @@ def main(): ...@@ -249,6 +262,18 @@ def main():
if existing_resource is None and not forwarders: if existing_resource is None and not forwarders:
ansible_module.fail_json(msg='No forwarders specified.') ansible_module.fail_json(msg='No forwarders specified.')
if existing_resource is not None:
if state != "absent":
if forwarders:
forwarders = list(
set(existing_resource["idnsforwarders"]
+ forwarders))
else:
if forwarders:
forwarders = list(
set(existing_resource["idnsforwarders"])
- set(forwarders))
if existing_resource is None and operation == "update": if existing_resource is None and operation == "update":
# does not exist and is updating # does not exist and is updating
# trying to update something that doesn't exist, so error # trying to update something that doesn't exist, so error
...@@ -256,20 +281,17 @@ def main(): ...@@ -256,20 +281,17 @@ def main():
valid""" % (name)) valid""" % (name))
elif existing_resource is None and operation == "del": elif existing_resource is None and operation == "del":
# does not exists and should be absent # does not exists and should be absent
# set command
command = None
# enabled or disabled? # enabled or disabled?
is_enabled = "IGNORE" is_enabled = "IGNORE"
elif existing_resource is not None and operation == "del": elif existing_resource is not None and operation == "del":
# exists but should be absent # exists but should be absent
# set command # set command
command = "dnsforwardzone_del" command = "dnsforwardzone_del"
args = {}
# enabled or disabled? # enabled or disabled?
is_enabled = "IGNORE" is_enabled = "IGNORE"
elif forwarders is None: elif forwarders is None:
# forwarders are not defined its not a delete, update state? # forwarders are not defined its not a delete, update state?
# set command
command = None
# enabled or disabled? # enabled or disabled?
if existing_resource is not None: if existing_resource is not None:
is_enabled = existing_resource["idnszoneactive"][0] is_enabled = existing_resource["idnszoneactive"][0]
...@@ -278,23 +300,13 @@ def main(): ...@@ -278,23 +300,13 @@ def main():
elif existing_resource is not None and operation == "update": elif existing_resource is not None and operation == "update":
# exists and is updating # exists and is updating
# calculate the new forwarders and mod # calculate the new forwarders and mod
# determine args args = gen_args(forwarders, forwardpolicy, skip_overlap_check)
if state != "absent": if "skip_overlap_check" in args:
forwarders = list(set(existing_resource["idnsforwarders"]
+ forwarders))
else:
forwarders = list(set(existing_resource["idnsforwarders"])
- set(forwarders))
args = gen_args(forwarders, forwardpolicy,
skip_overlap_check)
if skip_overlap_check is not None:
del args['skip_overlap_check'] del args['skip_overlap_check']
# command # command
if not compare_args_ipa(ansible_module, args, existing_resource): if not compare_args_ipa(ansible_module, args, existing_resource):
command = "dnsforwardzone_mod" command = "dnsforwardzone_mod"
else:
command = None
# enabled or disabled? # enabled or disabled?
is_enabled = existing_resource["idnszoneactive"][0] is_enabled = existing_resource["idnszoneactive"][0]
...@@ -313,21 +325,36 @@ def main(): ...@@ -313,21 +325,36 @@ def main():
# exists and should be present, has it changed? # exists and should be present, has it changed?
# determine args # determine args
args = gen_args(forwarders, forwardpolicy, skip_overlap_check) args = gen_args(forwarders, forwardpolicy, skip_overlap_check)
if skip_overlap_check is not None: if 'skip_overlap_check' in args:
del args['skip_overlap_check'] del args['skip_overlap_check']
# set command # set command
if not compare_args_ipa(ansible_module, args, existing_resource): if not compare_args_ipa(ansible_module, args, existing_resource):
command = "dnsforwardzone_mod" command = "dnsforwardzone_mod"
else:
command = None
# enabled or disabled? # enabled or disabled?
is_enabled = existing_resource["idnszoneactive"][0] is_enabled = existing_resource["idnszoneactive"][0]
# if command is set then run it with the args # if command is set...
if command is not None: if command is not None:
api_command(ansible_module, command, name, args) commands.append([name, command, args])
if permission is not None:
if existing_resource is None:
managedby = None
else:
managedby = existing_resource.get('managedby', None)
if permission and managedby is None:
commands.append(
[name, 'dnsforwardzone_add_permission', {}]
)
elif not permission and managedby is not None:
commands.append(
[name, 'dnsforwardzone_remove_permission', {}]
)
for name, command, args in commands:
result = api_command(ansible_module, command, name, args)
changed = True changed = True
# does the enabled state match what we want (if we care) # does the enabled state match what we want (if we care)
......
tests/dnsforwardzone/test_dnsforwardzone.yml
+ 86
− 24
View file @ bf864469
...@@ -51,8 +51,6 @@ ...@@ -51,8 +51,6 @@
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- pause:
- name: ensure forwardzone example.com has one forwarder again - name: ensure forwardzone example.com has one forwarder again
ipadnsforwardzone: ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
...@@ -63,7 +61,7 @@ ...@@ -63,7 +61,7 @@
skip_overlap_check: true skip_overlap_check: true
state: present state: present
register: result register: result
failed_when: not result.changed failed_when: result.changed
- name: skip_overlap_check can only be set on creation so change nothing - name: skip_overlap_check can only be set on creation so change nothing
ipadnsforwardzone: ipadnsforwardzone:
...@@ -77,6 +75,22 @@ ...@@ -77,6 +75,22 @@
register: result register: result
failed_when: result.changed failed_when: result.changed
- name: ensure forwardzone example.com is absent.
ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword
name: example.com
state: absent
register: result
failed_when: not result.changed
- name: ensure forwardzone example.com is absent, again.
ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword
name: example.com
state: absent
register: result
failed_when: result.changed
- name: change all the things at once - name: change all the things at once
ipadnsforwardzone: ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
...@@ -87,11 +101,12 @@ ...@@ -87,11 +101,12 @@
- ip_address: 4.4.4.4 - ip_address: 4.4.4.4
port: 8053 port: 8053
forwardpolicy: only forwardpolicy: only
skip_overlap_check: false skip_overlap_check: true
permission: yes
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: ensure forwardzone example.com is absent for next testset - name: ensure forwardzone example.com is absent.
ipadnsforwardzone: ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: example.com name: example.com
...@@ -156,43 +171,58 @@ ...@@ -156,43 +171,58 @@
register: result register: result
failed_when: result.changed failed_when: result.changed
- name: ensure forwardzone example.com is absent again - name: Add a permission for per-forward zone access delegation.
ipadnsforwardzone: ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: example.com name: example.com
state: absent permission: yes
action: member
register: result
failed_when: not result.changed
- name: try to create a new forwarder with action=member - name: Add a permission for per-forward zone access delegation, again.
ipadnsforwardzone: ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
state: present
name: example.com name: example.com
forwarders: permission: yes
- ip_address: 4.4.4.4
port: 8053
action: member action: member
skip_overlap_check: true
register: result register: result
failed_when: result.changed failed_when: result.changed
- name: ensure forwardzone example.com is absent - tidy up - name: Remove a permission for per-forward zone access delegation.
ipadnsforwardzone: ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: example.com name: example.com
state: absent permission: no
action: member
register: result
failed_when: not result.changed
- name: try to create a new forwarder is disabled state - name: Remove a permission for per-forward zone access delegation, again.
ipadnsforwardzone: ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
state: disabled
name: example.com name: example.com
forwarders: permission: no
- ip_address: 4.4.4.4 action: member
port: 8053 register: result
skip_overlap_check: true failed_when: result.changed
- name: disable the forwarder
ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword
name: example.com
state: disabled
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: disable the forwarder again
ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword
name: example.com
state: disabled
register: result
failed_when: result.changed
- name: enable the forwarder - name: enable the forwarder
ipadnsforwardzone: ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
...@@ -201,12 +231,42 @@ ...@@ -201,12 +231,42 @@
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: disable the forwarder again - name: enable the forwarder, again
ipadnsforwardzone: ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: example.com name: example.com
state: disabled state: enabled
register: result
failed_when: result.changed
- name: ensure forwardzone example.com is absent again
ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword
name: example.com
state: absent
- name: try to create a new forwarder with action=member
ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword
state: present
name: example.com
forwarders:
- ip_address: 4.4.4.4
port: 8053
action: member action: member
skip_overlap_check: true
register: result
failed_when: result.changed
- name: try to create a new forwarder with disabled state
ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword
state: disabled
name: example.com
forwarders:
- ip_address: 4.4.4.4
port: 8053
skip_overlap_check: yes
register: result register: result
failed_when: not result.changed failed_when: not result.changed
...@@ -228,5 +288,7 @@ ...@@ -228,5 +288,7 @@
- name: ensure forwardzone example.com is absent - tidy up - name: ensure forwardzone example.com is absent - tidy up
ipadnsforwardzone: ipadnsforwardzone:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: example.com name:
- example.com
- newfailzone.com
state: absent state: absent
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment