everpure.flasharray.purefa_network_access_policy module – Manage FlashArray Network Access Policies

Note

This module is part of the everpure.flasharray collection (version 1.46.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install everpure.flasharray. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: everpure.flasharray.purefa_network_access_policy.

New in everpure.flasharray 1.46.0

Synopsis

  • Manage FlashArray network-access policies introduced with Purity//FA 6.10.5 and FlashArray REST API 2.52.

  • Controls inbound access to management interfaces using ordered allow/deny rules.

  • Only one policy can be active array-wide at a time. The default policy allows all access. If no rule matches, access is blocked.

Requirements

The below requirements are needed on the host that executes this module.

  • python >= 3.3

  • purestorage >= 1.19

  • py-pure-client >= 1.88.0

  • netaddr

  • requests

  • pycountry

  • urllib3

Parameters

Parameter

Comments

active

boolean

When true, makes this policy the active array-wide network-access policy via PATCH /arrays.

The policy must be enabled before it can be activated.

Setting active to false is rejected with an error; activate another policy to replace the current one.

Choices:

  • false

  • true

api_token

string

FlashArray API token for admin privileged user.

client

string

Client address the rule applies to.

Accepts an IPv4 address, IPv6 address, CIDR subnet, or * for all clients.

Required together with effect and interfaces when adding a rule.

client_id

string

added in everpure.flasharray 1.43.0

ID of the API Client that issues the identity token.

Used with private_key_file.

context

string

Name of fleet member on which to perform the operation.

This requires the array receiving the request is a member of a fleet and the context name to be a member of the same fleet.

Default: ""

disable_warnings

boolean

added in everpure.flasharray 1.29.0

Disable insecure certificate warnings in debug logs

Choices:

  • false ← (default)

  • true

effect

string

Effect of the rule being added or updated.

Required together with client and interfaces when adding a rule.

Choices:

  • "allow"

  • "deny"

enabled

boolean

Define if the policy is enabled or not.

On create, defaults to false when not specified so a new policy is not enabled implicitly.

On update, an omitted value leaves the current enabled state unchanged so unrelated rule tasks do not re-enable a policy that was intentionally disabled.

Choices:

  • false

  • true

fa_url

string

FlashArray management IPv4 address or Hostname.

id_token

string

added in everpure.flasharray 1.43.0

A pre-signed JWT to authenticate with, as an alternative to api_token.

The token is exchanged by the array for a short-lived access token.

Requires a matching API Client to be registered on the array (see everpure.flasharray.purefa_apiclient).

index

integer

Desired evaluation position of the rule within the policy.

The array enforces ordering constraints (deny before allow; individual IP before CIDR; CIDR before *).

interfaces

list / elements=string

Management interfaces the rule applies to.

Required together with effect and client when adding a rule.

Choices:

  • "management-ssh"

  • "management-rest-api"

  • "management-rest-api-v1"

  • "management-rest-api-v2"

  • "management-web-ui"

  • "snmp"

issuer

string

added in everpure.flasharray 1.43.0

The API Client’s trusted identity issuer registered on the array.

Used with private_key_file.

key_id

string

added in everpure.flasharray 1.43.0

Key ID of the API Client that issues the identity token.

Used with private_key_file.

name

string / required

Name of the network-access policy.

private_key_file

string

added in everpure.flasharray 1.43.0

Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token.

Requires client_id, key_id, issuer and username.

private_key_password

string

added in everpure.flasharray 1.43.0

Password protecting private_key_file, if encrypted.

rename

string

New name of the policy.

Re-running a rename task reports no change if the policy is already known by the new name.

When set, other attributes (enabled, the rule fields, and active) supplied in the same task are ignored; the task only renames the policy.

rule_name

string

Name of an existing rule to update or delete.

When supplied with state=absent, deletes the named rule instead of the whole policy.

When supplied with any of effect, client, interfaces, or index, updates the named rule with a partial patch. Attributes not supplied are left unchanged.

Rule names are positional, of the form <policy>.<index>, and the array renumbers the remaining rules when an earlier rule is deleted. Repeating a delete by name after the rule is gone can therefore remove a different rule; check the rule’s attributes (or use the policy’s rule list) before re-running a delete.

state

string

Define whether the policy (or rule) should exist or not.

Choices:

  • "absent"

  • "present" ← (default)

username

string

added in everpure.flasharray 1.43.0

Username the issued token should be granted to.

Must be a valid user on the array. Used with private_key_file.

Notes

Note

  • This module requires the py-pure-client Python library.

  • Additional Python libraries may be required for specific modules.

  • You must set PUREFA_URL and PUREFA_API environment variables if fa_url and api_token arguments are not passed to the module directly.

  • Token-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flasharray.purefa_apiclient.

Examples

- name: Create an empty network-access policy
  everpure.flasharray.purefa_network_access_policy:
    name: restricted
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Create a network-access policy with an initial deny rule for a subnet
  everpure.flasharray.purefa_network_access_policy:
    name: restricted
    effect: deny
    client: 10.20.30.0/24
    interfaces:
      - management-ssh
      - management-web-ui
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Add an allow-all rule to an existing network-access policy
  everpure.flasharray.purefa_network_access_policy:
    name: restricted
    effect: allow
    client: "*"
    interfaces:
      - management-ssh
      - management-rest-api
      - management-web-ui
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Update a specific rule in a network-access policy
  everpure.flasharray.purefa_network_access_policy:
    name: restricted
    rule_name: restricted.1
    effect: deny
    client: 192.168.0.0/16
    interfaces:
      - management-ssh
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Delete a rule from a network-access policy
  everpure.flasharray.purefa_network_access_policy:
    name: restricted
    rule_name: restricted.1
    state: absent
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Disable a network-access policy
  everpure.flasharray.purefa_network_access_policy:
    name: restricted
    enabled: false
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Activate a network-access policy array-wide
  everpure.flasharray.purefa_network_access_policy:
    name: restricted
    active: true
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Rename a network-access policy
  everpure.flasharray.purefa_network_access_policy:
    name: restricted
    rename: restricted-mgmt
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Delete a network-access policy
  everpure.flasharray.purefa_network_access_policy:
    name: restricted
    state: absent
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

Authors

  • Everpure Ansible Team (@avk)