everpure.flasharray.purefa_policy_management_access module – Manage management-access (RBAC) policies on Everpure FlashArrays

Note

This module is part of the everpure.flasharray collection (version 1.46.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install everpure.flasharray. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: everpure.flasharray.purefa_policy_management_access.

New in everpure.flasharray 1.44.0

Synopsis

  • Create, delete and modify management-access policies on Everpure FlashArrays.

  • A management-access policy grants a role a set of permissions scoped to a resource, such as a realm, and is the object used for realm-scoped RBAC.

  • These policies are also reported by everpure.flasharray.purefa_info.

Requirements

The below requirements are needed on the host that executes this module.

  • python >= 3.3

  • purestorage >= 1.19

  • py-pure-client >= 1.88.0

  • netaddr

  • requests

  • pycountry

  • urllib3

Parameters

Parameter

Comments

aggregation_strategy

string

How the permissions from this policy combine with other policies that apply to the same user.

least-common-permissions restricts users to no more than the access defined here.

all-permissions allows users to also receive access from other policies that apply to them.

A new policy uses all-permissions unless otherwise specified. When omitted on an existing policy the current setting is left unchanged.

Choices:

  • "all-permissions"

  • "least-common-permissions"

api_token

string

FlashArray API token for admin privileged user.

client_id

string

added in everpure.flasharray 1.43.0

ID of the API Client that issues the identity token.

Used with private_key_file.

context

string

Name of fleet member on which to perform the operation.

This requires the array receiving the request is a member of a fleet and the context name to be a member of the same fleet.

Default: ""

disable_warnings

boolean

added in everpure.flasharray 1.29.0

Disable insecure certificate warnings in debug logs

Choices:

  • false ← (default)

  • true

enabled

boolean

Define whether the policy is enabled and grants its permissions.

A new policy is enabled unless this is set to false. When omitted on an existing policy the current setting is left unchanged.

Choices:

  • false

  • true

fa_url

string

FlashArray management IPv4 address or Hostname.

id_token

string

added in everpure.flasharray 1.43.0

A pre-signed JWT to authenticate with, as an alternative to api_token.

The token is exchanged by the array for a short-lived access token.

Requires a matching API Client to be registered on the array (see everpure.flasharray.purefa_apiclient).

issuer

string

added in everpure.flasharray 1.43.0

The API Client’s trusted identity issuer registered on the array.

Used with private_key_file.

key_id

string

added in everpure.flasharray 1.43.0

Key ID of the API Client that issues the identity token.

Used with private_key_file.

name

string / required

The name of the management-access policy.

private_key_file

string

added in everpure.flasharray 1.43.0

Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token.

Requires client_id, key_id, issuer and username.

private_key_password

string

added in everpure.flasharray 1.43.0

Password protecting private_key_file, if encrypted.

rename

string

New name for an existing management-access policy.

rules

list / elements=dictionary

List of scoped-role rules that make up the policy.

Replaces the full set of rules on the policy when provided.

resource_type

string

Type of the scoped resource.

Default: "realms"

role

string / required

Name of the role granted by this rule.

The array accepts only viewer, support, admin and storage in a management-access policy.

scope

string / required

Name of the resource the role is scoped to, for example a realm name.

state

string

Define whether the policy should exist or not.

Choices:

  • "absent"

  • "present" ← (default)

username

string

added in everpure.flasharray 1.43.0

Username the issued token should be granted to.

Must be a valid user on the array. Used with private_key_file.

Notes

Note

  • This module requires the py-pure-client Python library.

  • Additional Python libraries may be required for specific modules.

  • You must set PUREFA_URL and PUREFA_API environment variables if fa_url and api_token arguments are not passed to the module directly.

  • Token-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flasharray.purefa_apiclient.

Examples

- name: Create a realm-scoped management-access policy for the storage role
  everpure.flasharray.purefa_policy_management_access:
    name: myrealm_admin
    aggregation_strategy: least-common-permissions
    rules:
      - role: storage
        scope: myrealm
        resource_type: realms
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Disable a management-access policy
  everpure.flasharray.purefa_policy_management_access:
    name: myrealm_admin
    enabled: false
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Delete a management-access policy
  everpure.flasharray.purefa_policy_management_access:
    name: myrealm_admin
    state: absent
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

Authors

  • Everpure Ansible Team (@sdodsley)