There is a new management module placed in the plugins folder:

    plugins/modules/ipadnszone.py

    The dnszone module allows to manage DNS zones.

    Here is the documentation for the module:

    README-dnszone.md

    New example playbooks have been added:

    playbooks/dnszone/disable-zone-forwarders.yml
    playbooks/dnszone/dnszone-absent.yml
    playbooks/dnszone/dnszone-all-params.yml
    playbooks/dnszone/dnszone-disable.yml
    playbooks/dnszone/dnszone-enable.yml
    playbooks/dnszone/dnszone-present.yml

    New tests for the module:

    tests/dnszone/test_dnszone.yml
    tests/dnszone/test_dnszone_mod.yml

ipareplica_prepare: Fix module DOCUMENTATION

The documentation contains the pramaters several times. Reducing the list
to one. Also fixed a typo in options key.

Add dnsforwardzone module

Fixes behavior for host module attribute `reverse`

Due to setting aaaa_extra_create_reverse or a_extra_create_reverse when not
needed, host module fails to add a host with reverse address. This patch
fixes the behavior  by only adding *_extra_create_reverse when needed.

New DNSConfig management module

Add documentation of missing variables for sudorule.

Fixes documentation for module ipaservice.

Removed trailling space on README.md.

README-group: Fix description of external parameter

The external parameter was showing type flag instead of type bool.

There is a new vaultcontainer management module placed in the plugins folder:

plugins/modules/ipadnsconfig.py

The dnsconfig module allows to modify global DNS configuration.

Here is the documentation for the module:

README-dnsconfig.md

New example playbooks have been added:

playbooks/dnsconfig/set_configuration.yml
playbooks/dnsconfig/disable-global-forwarders.yml
playbooks/dnsconfig/disallow-reverse-sync.yml

New tests for the module:

tests/dnsconfig/test_dnsconfig.yml

This patch adds documentation for the sudorule variables `runasusercategory`
and `runasgroupcategory` that was missing.

Add missing documentation for the `principal` variable.

Removed a trailling space on README.md because it was often removed by
text editors, adding an unnecessary line to the update patch.

Unite admin passwords

test_pwpolicy: unite admin passwords

New service management module.

There is a new service management module placed in the pluginsfolder:

  plugins/modules/ipaservice.py

The service module allows to ensure presence and absence of services, and
manage members and certificates of the service.

Here is the documentation for the module:

  README-service.md

New example playbooks have been added:

    playbooks/service/service-host-is-absent.yml
    playbooks/service/service-host-is-present.yml
    playbooks/service/service-is-absent.yml
    playbooks/service/service-is-disabled.yml
    playbooks/service/service-is-present-with-all-attributes.yml
    playbooks/service/service-is-present-without-host-object.yml
    playbooks/service/service-is-present.yml
    playbooks/service/service-member-allow_create_keytab-absent.yml
    playbooks/service/service-member-allow_create_keytab-present.yml
    playbooks/service/service-member-allow_retrieve_keytab-absent.yml
    playbooks/service/service-member-allow_retrieve_keytab-present.yml
    playbooks/service/service-member-certificate-absent.yml
    playbooks/service/service-member-certificate-present.yml
    playbooks/service/service-member-principal-absent.yml
    playbooks/service/service-member-principal-present.yml

New tests added for the module:

  tests/service/test-service.yml

Properly handle certificates stored as bytes in encode_certificate.

Use SomeADMINpassword as the admin password also in the examples in the
management modules.

Use SomeADMINpassword as the admin password everywhere, also in all
playbooks.

Use SomeADMINpassword as the admin password everywhere, also in the README
files.

The tests have been using MyPassword123 and also SomeADMINpassword within
the tasks of the tests. SomeADMINpassword should be used everywhere.

One test did not use the admin password as the rest of the tests.
This caused the tests/pwpolicy/test_pwpolicy.yml suite to fail.

Changing the password to the same as in others fixes the issue.

Signed-off-by: Petr Vobornik <pvoborni@redhat.com>

ipahost: Do not fail on missing DNS or zone when no IP address given

For beeing able to catch ipalib.errors.NotFound errors in ipahost it is
needed to import ipalib.errors. ipalib.errors is now imported as
ipalib_errors to not have name conflicts with the errors list used in some
of the modules.

Related: https://bugzilla.redhat.com/show_bug.cgi?id=1804838

If no IP address is given and either DNS is not configured or if the zone is
not found then ipahost may not fail in dnsrecord_find.

The error happened for example by ensuring the absence of a host that is not
part of the domain or for a host that has been added with force and is using
a domain that is not served by the DNS server in the domain. It also
happened if there was no DNS server in the domain at all.

A new test case has been added to test_host_ipaddresses.yml

The fix requires ipalib_errors provided by ansible_freeipa_module.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1804838

ipahost: Fail on action member for new hosts, fix dnsrecord_add reverse flag

The check to make sure that member can not be used on non existing hosts
has bee missing. Also the reverse flag for the dnsrecord_add call was None
if the varaible was not set.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1803026

ipahost: Add support for several IP addresses and also to change them

This change is needed to properly handle base64 encoding of certificates
stored as bytes, under Python 3, as used by IPA service. It does not
affect Python 2.7 as bytes are identical to str in this version of the
language.

When retireving certificates stored by FreeIPA service data is returned
as bytes, under Python 3, and encoding then breaks, as there is no
bytes.public_bytes method. In Python 3, encoding with base64 will be the
same for strings and bytes.

Modify roles README for consistency.

host1 was used instead of host5 in the repeated host5 test. This lead to an
error with the new IP address handling in ipahost. It was correctly
reporting a change for host1 which resulted in a failed test.

ipahost was so far ignoring IP addresses when the host already existed.
This happened because host_mod is not providing functionality to do this.
Now ipaddress is a list and it is possible to ensure a host with several
IP addresses (these can be IPv4 and IPv6). Also it is possible to ensure
presence and absence of IP addresses for an exising host using action
member.

There are no IP address conclict checks as this would lead into issues with
updating an existing host that already is using a duplicate IP address for
example for round-robin (RR). Also this might lead into issues with ensuring
a new host with several IP addresses in this case. Also to ensure a list of
hosts with changing the IP address of one host to another in the list would
result in issues here.

New example playbooks have been added:

    playbooks/host/host-present-with-several-ip-addresses.yml
    playbooks/host/host-member-ipaddresses-absent.yml
    playbooks/host/host-member-ipaddresses-present.yml

A new test has been added for verification:

    tests/host/test_host_ipaddresses.yml

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1783976
       https://bugzilla.redhat.com/show_bug.cgi?id=1783979

tests: Fix top name tags in tests