Ansible Update multiple firewall rules on Vyos - ansible

Question

I've been trying to create a playbook that I can run periodically to go through all my Vyos firewall rules and ensure the "log enabled" command is present, just in case someone forgets to add logging to a firewall rule. I've found the vyos.vyos.vyos_firewall_rules module which I think will be perfect for what I need to do.
The only problem is, is that this module requires you input the rule set name and rule number of each firewall rule that you want to update. However in my case, I want this to be done automatically and Ansible to go through each firewall rule set and associated rules that are present, and ensure logging is enabled on each rule. Something like this is what I need:
- name: Enable logging for each firewall rule
vyos.vyos.vyos_firewall_rules:
config:
- afi: ipv4
rule_sets:
- name: *all rules sets*
rules:
- number: *all numbers*
log: enabled
I've used vyos.vyos.vyos_firewall_rules to gather a dump of all rule sets and associated rules and have filtered this down to list each rule set name along with each associated rule number :
- name: Get rulesets
vyos.vyos.vyos_firewall_rules:
config:
state: gathered
register: output
- name: Filter output and populate the list of rule set names
debug:
msg: "Rule set name: {{ item.0.name }}, rule number: {{ item.1.number }}"
loop: "{{ output.gathered[0]['rule_sets'] | subelements('rules') }}"
This produces output like this:
"Rule set name: ruleset-1, rule number: 1"
"Rule set name: ruleset-1, rule number: 2"
"Rule set name: ruleset-1, rule number: 15"
"Rule set name: ruleset-1, rule number: 20"
"Rule set name: ruleset-2, rule number: 1"
"Rule set name: ruleset-2, rule number: 2"
I'm a bit stuck on where to go from here. I feel like I need the info filtered into a nested list like I have below, and then somehow loop the vyos.vyos.vyos_firewall_rules module to update each rule set name and rule number.
firewall_rules:
ruleset-1:
1
2
15
20
ruleset-2
1
2
I haven't been able to figure out how to create a nested list, or if I even need one in the first place.
I'm relatively new to Ansible so if anyone could point me in the right direction I would appreciate it.

Answer 1

You can create the dictionary first
- set_fact:
firewall_rules: "{{ dict(rsets|zip(rules)) }}"
vars:
rsets: "{{ output.gathered.0.rule_sets|
map(attribute='name')|list }}"
rules: "{{ output.gathered.0.rule_sets|
map(attribute='rules')|
map('map', attribute='number')|list }}"
gives
firewall_rules:
ruleset-1:
- 1
- 2
- 15
- 20
ruleset-2:
- 1
- 2
Then use Jinja to create the structure, e.g.
- debug:
var: _config|from_yaml
vars:
_config: |-
- afi: ipv4
rule_sets:
{% for set, rules in firewall_rules.items() %}
- name: {{ set }}
rules:
{% for rule in rules %}
- number: {{ rule }}
{% endfor %}
{% endfor %}
gives
_config|from_yaml:
- afi: ipv4
rule_sets:
- name: ruleset-1
rules:
- number: 1
- number: 2
- number: 15
- number: 20
- name: ruleset-2
rules:
- number: 1
- number: 2
Fit the structure to your needs and use it in the module, e.g.
- vyos.vyos.vyos_firewall_rules:
config: "{{ _config|from_yaml }}"
vars:
_config: |-
...
Q: "Output of {{ _config|from_yaml }} is not preserving the hyphens."
A: The format you see depends on the callback plugin. If you want to see YAML set DEFAULT_STDOUT_CALLBACK to yaml
shell> ANSIBLE_STDOUT_CALLBACK=yaml ansible-playbook test-753.yml
or copy the content to a file
- copy:
dest: test-753-out.yml
content: |
{{ _config }}
vars:
_config: |-
- afi: ipv4
rule_sets:
{% for set, rules in firewall_rules.items() %}
- name: {{ set }}
rules:
{% for rule in rules %}
- number: {{ rule }}
{% endfor %}
{% endfor %}
gives
shell> cat test-753-out.yml
- afi: ipv4
rule_sets:
- name: ruleset-1
rules:
- number: 1
- number: 2
- number: 15
- number: 20
- name: ruleset-2
rules:
- number: 1
- number: 2