everpure.flashblade.purefb_mgmt_policy module – Manage FlashBlade Management Access Policies and their rules
Note
This module is part of the everpure.flashblade collection (version 1.29.0).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install everpure.flashblade.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: everpure.flashblade.purefb_mgmt_policy.
New in everpure.flashblade 1.28.0
Synopsis
Create, update, or delete a FlashBlade Management Access Policy.
Reconcile the declarative list of rules (role + scope) attached to the policy.
Attachment of policies to admins or directory-service roles is handled by everpure.flashblade.purefb_mgmt_role.
Requirements
The below requirements are needed on the host that executes this module.
python >= 3.9
py-pure-client
netaddr
datetime
pytz
distro
pycountry
urllib3
Parameters
Parameter |
Comments |
|---|---|
How permissions combine across multiple policies attached to the same member.
Never affects rule combination within a single policy. Omit to leave unchanged on an existing policy. Choices:
|
|
FlashBlade API token for admin privileged user. |
|
ID of the API Client that issues the identity token. Used with private_key_file. |
|
Name of fleet member on which to perform the operation. This requires the array receiving the request is a member of a fleet and the context name to be a member of the same fleet. Default: |
|
Disable insecure certificate warnings Choices:
|
|
Whether the policy is active. Disabled policies are dropped during aggregation on the member. Omit to leave unchanged on an existing policy; defaults to Choices:
|
|
FlashBlade management IP address or Hostname. |
|
A pre-signed JWT to authenticate with, as an alternative to api_token. The token is exchanged by the array for a short-lived access token. Requires a matching API Client to be registered on the array (see everpure.flashblade.purefb_apiclient). |
|
The API Client’s trusted identity issuer registered on the array. Used with private_key_file. |
|
Key ID of the API Client that issues the identity token. Used with private_key_file. |
|
Name of the management access policy. Case-insensitive, case-preserving. This is the handle used for attachment and for naming child rules. |
|
Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token. Requires client_id, key_id, issuer and username. |
|
Password protecting private_key_file, if encrypted. |
|
Declarative list of rules (role + scope) that make up the policy. Setting the list will add missing rules and remove any rule not listed here. Rule identity is (role, scope.resource_type, scope.name), matched case-insensitively — names are case-preserving on the array. Duplicate rules (same role and scope, any case) are rejected. Omit (or set to Provide an empty list to remove every rule from the policy. On REST API 2.26 and newer rules are added and removed one at a time. Older arrays (REST 2.19 to 2.25) have no per-rule endpoints, so the rule list is sent with the policy at creation and replaced as a whole when it differs on update. Purity//FB 4.6 (REST 2.21) requires exactly one rule when a policy is created. |
|
Name of the role granted by this rule (built-in, e.g. |
|
Where the role applies. |
|
Name of the target (the FlashBlade array name for resource_type=arrays, or the realm name for resource_type=realms). |
|
Scope type. Choices:
|
|
Whether the policy should exist. Choices:
|
|
Username the issued token should be granted to. Must be a valid user on the array. Used with private_key_file. |
Notes
Note
You must set
PUREFB_URLandPUREFB_APIenvironment variables if fb_url and api_token arguments are not passed to the module directlyToken-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flashblade.purefb_apiclient
Examples
- name: Create an empty policy
everpure.flashblade.purefb_mgmt_policy:
name: tenant-a-ops
enabled: true
aggregation_strategy: all-permissions
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Create a policy with two rules
everpure.flashblade.purefb_mgmt_policy:
name: tenant-a-ops
rules:
- role: viewer
scope:
name: my-flashblade
resource_type: arrays
- role: backup-operator
scope:
name: realm-a
resource_type: realms
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Disable a policy
everpure.flashblade.purefb_mgmt_policy:
name: tenant-a-ops
enabled: false
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Remove every rule from a policy
everpure.flashblade.purefb_mgmt_policy:
name: tenant-a-ops
rules: []
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Delete a policy
everpure.flashblade.purefb_mgmt_policy:
name: tenant-a-ops
state: absent
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641