I'm using fortinet.fortios.system_global module as describe here: https://docs.ansible.com/ansible/latest/collections/fortinet/fortios/fortios_system_global_module.html#ansible-collections-fortinet-fortios-fortios-system-global-module
My goal is to pass a dictionary to the system_global parameter with the allowed sub-parameters. I have the dictionary as follows for example:
forti:
admin-concurrent: enable
admin-console-timeout: 0
admin-hsts-max-age: 15552000
<more key:value>
This dictionary lives in a separate file called forti.yml.
I then use include_vars to pull this yml file into my play as follows:
vars_files:
- /path/to/forti.yml
And then I use the system_global module:
- name: Configure system_global task
fortios_system_global:
access: "{{ access_token }}"
system_global: "{{ forti }}"
However, when I run the play it throws an error like so:
"msg": "Unsupported parameters for (fortios_system_global) module: system_global.admin-concurrent, system_global.admin-console-timeout, system_global.admin-hsts-max-age,<and so on>. Supported parameters include: member_path, member_state, system_global, vdom, enable_log, access_token."
I tried putting the key:value pairs in the vars: in the play level and passed it to the module the same way and it worked.
vars:
forti:
admin-concurrent: enable
admin-console-timeout: 0
admin-hsts-max-age: 15552000
<more key: value>
What am I missing? They're both type: dict, the data are exactly the same. Not sure what I'm missing here. Can someone please help?
You have - and the parameters are supposed to be _ so it is telling you the module parameter does not exist
vars:
forti:
admin-concurrent: enable
admin-console-timeout: 0
admin-hsts-max-age: 15552000
<more key: value>
should be
vars:
forti:
admin_concurrent: enable
admin_console_timeout: 0
admin_hsts_max_age: 15552000
<more key: value>
Keep on automating!
Just look at module examples here: https://docs.ansible.com/ansible/latest/collections/fortinet/fortios/fortios_system_global_module.html#ansible-collections-fortinet-fortios-fortios-system-global-module
Related
I started using the role argument validation which was introduced in Ansible 2.11. For example an easy variable of type string looks like this in meta/argument_specs.yml:
argument_specs:
main:
short_description: "Checking firewall global policies"
options:
openwrt_firewall_default_forward:
type: "str"
choices:
- "ACCEPT"
- "REJECT"
- "DROP"
But I have more complex variables than that, for example dicts. This is what the variables can look like:
openwrt_firewall_zoneshost:
MGMT:
forward: "REJECT"
input: "ACCEPT"
output: "ACCEPT"
#log: 1
interfaces:
- "mgmt"
SECURE:
forward: "ACCEPT"
input: "ACCEPT"
output: "ACCEPT"
#log: 1
interfaces:
- "secure"
or like this:
openwrt_firewall_ruleshost:
"syslog logrx1":
src: "*"
dest: "RXFORELLE"
dest_ip:
- "{{ hostvars['alsomyhost.mydomain.de']['primary_ip6'] }}"
dest_port: "514"
target: "ACCEPT"
"MGMT myhost":
src: "MGMT"
dest: "RXFORELLE"
dest_ip:
- "{{ hostvars['myhost.mydomain.de']['primary_ip6'] }}"
proto: "tcp"
dest_port: "22"
target: "ACCEPT"
I would like to be able to validate those, meaning. Some of the attributes are mandatory like src or destination. Some others are optional, but if given I would like to make sure they are of the correct type.
Honestly I don't understand the documentation with reference to this very problem having dict variables. Could someone please outline what the validation structure would look like for those type of variables.
Reference:
https://docs.ansible.com/ansible/latest/user_guide/playbooks_reuse_roles.html#role-argument-validation
You can repeat options: in the definition of an option, these are sometimes called "suboptions", and within there you can use all the same fields to define what that dict should contain.
argument_specs:
main:
short_description: "Checking firewall global policies"
options:
openwrt_firewall_ruleshost:
type: "dict"
required: true
options:
src:
required: true
type: str
A want declare hash array in vars/main.yml or default/main.yml of some role, e.g.:
mysql:
instances:
new:
port: 3306
dir: /mydir
config:
innodb_log_file_size: '128M'
tmp_table_size: '128M'
innodb_buffer_pool_size: '10G'
...
And I want change only some values of keys in YAML inventory or group_vars. Other values must be taken from vars/main.yml of some role:
mysql:
instances:
new:
config:
innodb_buffer_pool_size: '2G'
I want result for used in jinja2 template:
mysql:
instances:
new:
port: 3306
dir: /mydir
config:
innodb_log_file_size: '128M'
tmp_table_size: '128M'
innodb_buffer_pool_size: '2G'
...
Question: "Want to change only some values of keys in YAML inventory or group_vars. Other values must be taken from vars/main.yml of some role".
1) Service role (nginx, mysql, pgsql ...). In this role, I describe the default settings, ...
2) Then I create a project role in which I can include the service role and I will use most of the default settings described in the service role. Only a small part of the service settings can be changed in the project role.
Answer:
In the "service" roles create in defaults special variables for parameters that might be changed later. For example
mysql_port: "3306"
mysql_dir: "mydir"
mysql_innodb_log_file_size: "128M"
mysql:
instances:
new:
port: "{{ mysql_port }}"
dir: "{{ mysql_dir }}"
config:
innodb_log_file_size: "{{ mysql_innodb_log_file_size }}"
...
In the "project" role any variable with higher precedence will override the role's defaults.
I have a playbook creating EC2 by using a dictionary declared in vars: then registering the IPs into a group to be used later on.
The dict looks like this:
servers:
serv1:
name: tag1
type: t2.small
region: us-west-1
image: ami-****
serv2:
name: tag2
type: t2.medium
region: us-east-1
image: ami-****
serv3:
[...]
I would like to apply tags to this playbook in the simplest way so I can create just some of them using tags. For example, running the playbook with --tags tag1,tag3 would only start EC2 matching serv1 and serv3.
Applying tags on the dictionary doesn't seem possible and I would like to avoid doing multiplying tasks like:
Creatinge EC2
Register infos
Getting private IP from previously registered infos
adding host to group
While I already have a working loop for the case I want to create all EC2 at once, is there any way to achieve that (without relying on --extra-vars, which would need key=value) ? For example, filtering out the dictionary by keeping only what is tagged before running the EC2 loop ?
I doubt you can do this out of the box. And not sure this is good idea at all.
Because tags are used to filter tasks in Ansible, so you will have to mark all tasks with tags: always.
You can accomplish this with custom filter plugin, for example (./filter_plugins/apply_tags.py):
try:
from __main__ import cli
except ImportError:
cli = False
def apply_tags(src):
if cli:
tags = cli.options.tags.split(',')
res = {}
for k,v in src.iteritems():
keep = True
if 'name' in v:
if v['name'] not in tags:
keep = False
if keep:
res[k] = v
return res
else:
return src
class FilterModule(object):
def filters(self):
return {
'apply_tags': apply_tags
}
And in your playbook:
- debug: msg="{{ servers | apply_tags }}"
tags: always
I found a way to match my needs without touching to the rest so I'm sharing it in case other might have a similar need.
I needed to combine dictionaries depending on tags, so my "main" dictionary wouldn't be static.
Variables became :
- serv1:
- name: tag1
type: t2.small
region: us-west-1
image: ami-****
- serv2:
- name: tag2
type: t2.medium
region: us-east-1
image: ami-****
- serv3:
[...]
So instead of duplicating my tasks, I used set_fact with tags like this:
- name: Combined dict
# Declaring empty dict
set_fact:
servers: []
tags: ['always']
- name: Add Server 1
set_fact:
servers: "{{ servers + serv1 }}"
tags: ['tag1']
- name: Add Server 2
set_fact:
servers: "{{ servers + serv2 }}"
tags: ['tag2']
[..]
20 lines instead of multiply tasks for each server, change vars from dictionary to lists, a few tags and all good :) Now if I add a new server it will only take a few lines.
I am passing a set of values to the ansible play book. Using the value I try to create a string.
For example, I pass arguments: first_nm, last_nm and nick_nm to my playbook via --extra-vars. And inside my role/:
<task-name>/
vars/main.yml
I tried to do the following:
full_name: {{first_nm}} {{last_nm}}{{'-'+nick_nm if nick_nm is defined else ''}}
My Problem:
Since nick_nm is optional, when its empty or not defined if get the full name as for example : david john- with a - appended to the value.
So how can I avoid this append. Is there a better way to do the same?
You should also check if string is not empty. In your setup you only checking if the variable exists, and since it does the condition evaluates to True and gives you - + nick_nm
You can do it like this:
---
- hosts: localhost
gather_facts: no
connection: local
vars:
- first_nm: John
- last_nm: Smith
- nick_nm:
tasks:
- set_fact: full_name="{{first_nm}} {{last_nm}}{% if nick_nm is defined and nick_nm %}-{{nick_nm}}{%endif%}"
- debug: var=full_name
Is there any way call one task from another, loop through some array and pass variable to this other task?
- include: { task: create_user.yml user: item }
with_items: users
or something like that.
You can just assume that "user" is available to creater_user.yml
# something like this:
- name: create user
include creater_user.yml
# creater_user.yml:
- name: some task
debug: msg="hello"
with_items: users