community.general.consul_policy module – Manipulate Consul policies

Note

This module is part of the community.general collection (version 14.0.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.general.

To use it in a playbook, specify: community.general.consul_policy.

New in community.general 7.2.0

Synopsis

Parameters

Parameter

Comments

ca_path

string

The CA bundle to use for https connections.

If unset, the value of the CONSUL_CACERT environment variable is used when set. This is supported since community.general 13.4.0.

description

string

Description of the policy.

host

string

Host of the Consul agent.

If unset, the host component of url is used, and localhost when url is not set either.

name

string / required

The name that should be associated with the policy, this is opaque to Consul.

port

integer

The port on which the consul agent is running.

If unset, the port component of url is used, and 8500 when that does not specify one either.

rules

string

Rule document that should be associated with the current policy.

scheme

string

The protocol scheme on which the Consul agent is running.

If unset, a true value in the CONSUL_HTTP_SSL environment variable selects https, otherwise the scheme component of url is used, and http when that does not specify one either. A false CONSUL_HTTP_SSL does not downgrade an https url.

state

string

Whether the policy should be present or absent.

Choices:

  • "present" ← (default)

  • "absent"

token

string

The token to use for authorization.

If unset, the value of the CONSUL_HTTP_TOKEN environment variable is used. This is supported since community.general 13.4.0.

url

string

added in community.general 13.4.0

The address of the Consul agent, in the host:port or scheme://host:port form. The scheme and the port are optional, the host is not.

host, port and scheme take precedence over the components of this option.

If unset, the value of the CONSUL_HTTP_ADDR environment variable is used when set. An address these modules cannot use, a unix:// socket for example, makes the module fail, unless host, port and scheme are all set, in which case the address is not consulted at all.

valid_datacenters

list / elements=string

Valid datacenters for the policy. All if list is empty.

validate_certs

boolean

Whether to verify the TLS certificate of the Consul agent.

If unset, the value of the CONSUL_HTTP_SSL_VERIFY environment variable is used when set. This is supported since community.general 13.4.0.

Choices:

  • false

  • true ← (default)

Attributes

Attribute

Support

Description

action_group

Action group: community.general.consul

added in community.general 8.3.0

Use group/community.general.consul in module_defaults to set defaults for this module.

check_mode

Support: full

added in community.general 8.3.0

Can run in check_mode and return changed status prediction without modifying target.

diff_mode

Support: partial

added in community.general 8.3.0

In check mode the diff misses operational attributes.

Returns details on what has changed (or possibly needs changing in check_mode), when in diff mode.

Examples

- name: Create a policy with rules
  community.general.consul_policy:
    host: consul1.example.com
    token: some_management_acl
    name: foo-access
    rules: |
      key "foo" {
          policy = "read"
      }
      key "private/foo" {
          policy = "deny"
      }

- name: Update the rules associated to a policy
  community.general.consul_policy:
    host: consul1.example.com
    token: some_management_acl
    name: foo-access
    rules: |
      key "foo" {
          policy = "read"
      }
      key "private/foo" {
          policy = "deny"
      }
      event "bbq" {
          policy = "write"
      }

- name: Remove a policy
  community.general.consul_policy:
    host: consul1.example.com
    token: some_management_acl
    name: foo-access
    state: absent

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

operation

string

The operation performed.

Returned: changed

Sample: "update"

policy

dictionary

The policy as returned by the Consul HTTP API.

Returned: always

Sample: {"CreateIndex": 632, "Description": "Testing", "Hash": "rj5PeDHddHslkpW7Ij4OD6N4bbSXiecXFmiw2SYXg2A=", "Name": "foo-access", "Rules": "key \"foo\" {\n    policy = \"read\"\n}\nkey \"private/foo\" {\n    policy = \"deny\"\n}"}

Authors

  • Håkon Lerring (@Hakon)