everpure.flasharray.purefa_apiclient module – Manage FlashArray API Clients

Note

This module is part of the everpure.flasharray collection (version 1.46.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install everpure.flasharray. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: everpure.flasharray.purefa_apiclient.

New in everpure.flasharray 1.5.0

Synopsis

  • Enable or disable FlashArray API Clients

Requirements

The below requirements are needed on the host that executes this module.

  • python >= 3.3

  • purestorage >= 1.19

  • py-pure-client >= 1.88.0

  • netaddr

  • requests

  • pycountry

  • urllib3

Parameters

Parameter

Comments

api_token

string

FlashArray API token for admin privileged user.

client_id

string

added in everpure.flasharray 1.43.0

ID of the API Client that issues the identity token.

Used with private_key_file.

disable_warnings

boolean

added in everpure.flasharray 1.29.0

Disable insecure certificate warnings in debug logs

Choices:

  • false ← (default)

  • true

enabled

boolean

State of the API Client Key

Choices:

  • false

  • true ← (default)

fa_url

string

FlashArray management IPv4 address or Hostname.

id_token

string

added in everpure.flasharray 1.43.0

A pre-signed JWT to authenticate with, as an alternative to api_token.

The token is exchanged by the array for a short-lived access token.

Requires a matching API Client to be registered on the array (see everpure.flasharray.purefa_apiclient).

issuer

string

added in everpure.flasharray 1.43.0

The name of the identity provider that will be issuing ID Tokens for this API client

If not specified, defaults to the API client name, name.

key_id

string

added in everpure.flasharray 1.43.0

Key ID of the API Client that issues the identity token.

Used with private_key_file.

name

string / required

Name of the API Client

private_key_file

string

added in everpure.flasharray 1.43.0

Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token.

Requires client_id, key_id, issuer and username.

private_key_password

string

added in everpure.flasharray 1.43.0

Password protecting private_key_file, if encrypted.

public_key

string

The API clients PEM formatted (Base64 encoded) RSA public key.

Include the —–BEGIN PUBLIC KEY—– and —–END PUBLIC KEY—– lines

role

string

The maximum role allowed for ID Tokens issued by this API client

Choices:

  • "readonly"

  • "ops_admin"

  • "storage_admin"

  • "array_admin"

state

string

Define whether the API client should exist or not.

Choices:

  • "absent"

  • "present" ← (default)

token_ttl

integer

Time To Live, in seconds, of the access tokens exchanged for this client’s ID tokens. The array stores the value in milliseconds, so the module multiplies the value given here by 1000.

Range is 1 second to 1 day (86400 seconds).

If not specified when creating a client, defaults to 86400.

username

string

added in everpure.flasharray 1.43.0

Username the issued token should be granted to.

Must be a valid user on the array. Used with private_key_file.

Notes

Note

  • The array only allows the enabled state of an existing API client to be changed. public_key, issuer, role and token_ttl cannot be changed in place, so when a supplied value differs from the array the module warns and leaves the client as it is. Delete and recreate the client to apply a new value.

  • This module requires the py-pure-client Python library.

  • Additional Python libraries may be required for specific modules.

  • You must set PUREFA_URL and PUREFA_API environment variables if fa_url and api_token arguments are not passed to the module directly.

  • Token-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flasharray.purefa_apiclient.

Examples

- name: Create API token ansible-token
  everpure.flasharray.purefa_apiclient:
    name: ansible-token
    issuer: "Everpure"
    token_ttl: 3000  # seconds, sent to the array as 3000000 milliseconds
    role: array_admin
    public_key: "{{lookup('file', 'public_pem_file') }}"
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Disable API CLient
  everpure.flasharray.purefa_apiclient:
    name: ansible-token
    enabled: false
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Enable API CLient
  everpure.flasharray.purefa_apiclient:
    name: ansible-token
    enabled: true
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Delete API Client
  everpure.flasharray.purefa_apiclient:
    state: absent
    name: ansible-token
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

Authors

  • Everpure Ansible Team (@sdodsley)