everpure.flashblade.purefb_policy module – Manage FlashBlade policies
Note
This module is part of the everpure.flashblade collection (version 1.29.0).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install everpure.flashblade.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: everpure.flashblade.purefb_policy.
New in everpure.flashblade 1.0.0
Synopsis
Manage policies for filesystem, file replica links and object store access.
To update an existing snapshot policy rule, you must first delete the original rule and then add the new rule to replace it. Purity’s best-fit will try to ensure that any required snapshots deleted on the deletion of the first rule will be recovered as long replacement rule is added before the snapshot eradication period is exceeded (usuually 24 hours).
Network access policies cannot be created or deleted on FlashBlade. policy_type=network manages the rules of an existing network access policy (normally
default-network-access-policy).Rule fields that are not set in a task keep their current value when an existing rule is updated; the documented defaults are only applied when a new rule is created.
Requirements
The below requirements are needed on the host that executes this module.
python >= 3.9
py-pure-client
netaddr
datetime
pytz
distro
pycountry
urllib3
Parameters
Parameter |
Comments |
|---|---|
Specifies access control for the export policy rule Defaults to root-squash when a new rule is created. Choices:
|
|
Name of Object Store account policy applies to. Special Case pure policy is used for the system-wide S3 policies |
|
List of permissions to grant. System-wide policy rules cannot be deleted or modified Choices:
|
|
Any user whose GID is affected by an access of `root_squash` or `all_squash` will have their GID mapped to anongid. The default anongid is null, which means 65534. |
|
Any user whose UID is affected by an access of `root_squash` or `all_squash` will have their UID mapped to anonuid. The default is null, which means 65534. |
|
FlashBlade API token for admin privileged user. |
|
Provide a time in 12-hour AM/PM format, eg. 11AM |
|
After a read operation has occurred, the inode access time is updated only if any of the following conditions is true; the previous access time is less than the inode modify time, the previous access time is less than the inode change time, or the previous access time is more than 24 hours ago. If set to false, disables the update of inode access times after read operations. Defaults to true when a new rule is created. Choices:
|
|
The index of the client rule to insert or move a client rule before. Not supported for SMB share policies, whose rules are unordered. |
|
The state of the SMB share principals Change access permission. Setting to “” will clear the current setting Share permissions form the ladder read, change, full_control with a single effect per rule. Setting a level applies its effect to the levels below it; a level set to the opposite effect above the granted ones, or to “”, is not granted, as the array stores it. Choices:
|
|
Specifies the clients that will be permitted to access the export. Accepted notation is a single IP address, subnet in CIDR notation, netgroup, or anonymous (*). |
|
ID of the API Client that issues the identity token. Used with private_key_file. |
|
Name of fleet member on which to perform the operation. This requires the array receiving the request is a member of a fleet and the context name to be a member of the same fleet. Default: |
|
The retention period used for committing files to WORM status. Will be applied if no access time is provided, or the access time is less than the current server time. Between min_retention and max_retention periods. Valid values are weeks (w), days(d), hours(h), minutes(m) and seconds(s). |
|
A description of an object store policy, optionally specified when the policy is created. Cannot be modified for an existing policy. Default: |
|
This parameter must be set to true in order to modify a policy such that local or remote snapshots would be destroyed. Choices:
|
|
Disable insecure certificate warnings Choices:
|
|
Allow S3 requests that match all of the actions item selected. Rules are additive. Also the effect of a network access policy rule. Defaults to allow when a new rule is created. Choices:
|
|
State of policy Choices:
|
|
Interval between snapshots in seconds Range available 300 - 31536000 (equates to 5m to 365d) |
|
FlashBlade management IP address or Hostname. |
|
Whether the file id is 32 bits or not. Defaults to false when a new rule is created. Choices:
|
|
List of filesystems to add to a policy on creation To amend policy members use the everpure.flashblade.purefb_fs module |
|
Force the deletion of a Object Store Access Policy is this has attached users. WARNING This can have undesired side-effects. System-wide policies cannot be deleted Choices:
|
|
The state of the SMB share principals Full Control access permission. Setting to “” will clear the current setting See change for how the share permission levels interact. Choices:
|
|
A pre-signed JWT to authenticate with, as an alternative to api_token. The token is exchanged by the array for a short-lived access token. Requires a matching API Client to be registered on the array (see everpure.flashblade.purefb_apiclient). |
|
Certain combinations of actions and other rule elements are inherently ignored if specified together in a rule. If set to true, operations which attempt to set these combinations will fail. If set to false, such operations will instead be allowed. Choices:
|
|
Specifies which product interfaces the network access policy rule applies to, whether it is permitting or denying access. Required for policy_type=network; only used when a rule is created or updated. Choices:
|
|
The API Client’s trusted identity issuer registered on the array. Used with private_key_file. |
|
How long to keep snapshots for Range available 300 - 31536000 (equates to 5m to 365d) Must not be set less than every |
|
Key ID of the API Client that issues the identity token. Used with private_key_file. |
|
The maximum retention period of the WORM file system. Between 1 second and 100 years. Cannot be less than the min_retention. Valid values are weeks (w), days(d), hours(h), minutes(m) and seconds(s). |
|
The minimum retention period of the WORM file system. Between 1 second and 100 years. Cannot be greater than the max_retention. Valid values are weeks (w), days(d), hours(h), minutes(m) and seconds(s). |
|
Name of the policy |
|
List of bucket names and object paths, with a wildcard (*) to specify objects in a bucket; e.g., bucket1, bucket1/*, bucket2, bucket2/*. System-wide policy rules cannot be deleted or modified |
|
Specifies which read-write client access permissions are allowed for the export. Defaults to ro when a new rule is created. Choices:
|
|
Type of policy Choices:
|
|
The user or group who is the subject of this rule, and their domain |
|
Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token. Requires client_id, key_id, issuer and username. |
|
Password protecting private_key_file, if encrypted. |
|
The state of the SMB share principals Read access permission. Setting to “” will clear the current setting See change for how the share permission levels interact. Choices:
|
|
New name for policy Applies to snapshot, NFS, SMB and network access policies. WORM data policies cannot be renamed. Purity//FB up to at least 4.6.4 (REST 2.21) ignores a new name for snapshot policies; the module fails instead of reporting a rename the array did not perform. |
|
List of filesystem replica links to add to a policy on creation To amend policy members use the everpure.flashblade.purefb_fs_replica module |
|
State of policy attributes after creation. If set to locked then values of the policy attributes are not allowed to change. If set to locked then values of the policy attributes can be changed. Changing from unlocked to locked is allowed, but to change from locked to unlocked will require support from Everpure Technical Services. Choices:
|
|
Name of the rule for the Object Store Access Policy Rules in system wide policies cannot be deleted or modified |
|
List of delimiter characters allowed in object list requests. Grants permissions to list ‘folder names’ (prefixes ending in a delimiter) instead of object keys. System-wide policy rules cannot be deleted or modified |
|
List of ‘folders’ (object key prefixes) for which object listings may be requested. System-wide policy rules cannot be deleted or modified |
|
If true, this prevents NFS access to client connections coming from non-reserved ports. If false, allows NFS access to client connections coming from non-reserved ports. Applies to NFSv3, NFSv4.1, and auxiliary protocols MOUNT and NLM. Defaults to false when a new rule is created. Choices:
|
|
The security flavors to use for accessing files on this mount point. If the server does not support the requested flavor, the mount operation fails. sys trusts the client to specify users identity. krb provides cryptographic proof of a users identity in each RPC request. krb5i adds integrity checking to krb5, to ensure the data has not been tampered with. krb5p adds integrity checking and encryption to krb5. Defaults to Choices:
|
|
The status of SMB encryption in a client policy rule Defaults to optional when a new rule is created. Choices:
|
|
List of IPs and subnets from which this rule should allow requests; e.g., 10.20.30.40, 10.20.30.0/24, 2001:DB8:1234:5678::/64. System-wide policy rules cannot be deleted or modified |
|
Create or delete policy. copy copies a single rule for Object Store Access Policies (rule and target in For snapshot, NFS, SMB and WORM policies copy creates target as a new policy with the same settings and rules as name. Network access policies cannot be copied. Choices:
|
|
Name of policy to copy rule to, or name of the new policy to create when copying a whole policy. |
|
Name of the rule to copy the exisitng rule to. If not defined the existing rule name is used. |
|
Time Zone used for the at parameter If not provided, the module will attempt to get the current local timezone from the server |
|
User in the account that the policy is granted to. |
|
Username the issued token should be granted to. Must be a valid user on the array. Used with private_key_file. |
Notes
Note
You must set
PUREFB_URLandPUREFB_APIenvironment variables if fb_url and api_token arguments are not passed to the module directlyToken-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flashblade.purefb_apiclient
Examples
- name: Create a simple snapshot policy with no rules
everpure.flashblade.purefb_policy:
name: test_policy
policy_type: snapshot
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create a snapshot policy and connect to existing filesystems and filesystem replica links
everpure.flashblade.purefb_policy:
name: test_policy_with_members
policy_type: snapshot
filesystem:
- fs1
- fs2
replica_link:
- rl1
- rl2
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create a snapshot policy with rules
everpure.flashblade.purefb_policy:
name: test_policy2
policy_type: snapshot
at: 11AM
keep_for: 86400
every: 86400
timezone: Asia/Shanghai
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Delete filesystem foo from snapshot policy
everpure.flashblade.purefb_policy:
name: test_policy
policy_type: snapshot
filesystem: foo
state: absent
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Delete a snapshot policy
everpure.flashblade.purefb_policy:
name: test_policy
policy_type: snapshot
state: absent
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create an empty object store access policy
everpure.flashblade.purefb_policy:
name: test_os_policy
account: test
policy_type: access
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create an empty object store access policy and assign user
everpure.flashblade.purefb_policy:
name: test_os_policy
account: test
policy_type: access
user: fred
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create a object store access policy with simple rule
everpure.flashblade.purefb_policy:
name: test_os_policy_rule
policy_type: access
account: test
rule: rule1
actions: "s3:*"
object_resources: "*"
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create an empty SMB client policy
everpure.flashblade.purefb_policy:
name: test_smb_client
policy_type: smb_client
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create an SMB client policy with a client rule
everpure.flashblade.purefb_policy:
name: test_smb_client
policy_type: smb_client
client: "10.0.1.0/24"
permission: rw
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create an empty NFS export policy
everpure.flashblade.purefb_policy:
name: test_nfs_export
policy_type: nfs
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create an NFS export policy with a client rule
everpure.flashblade.purefb_policy:
name: test_nfs_export
policy_type: nfs
atime: true
client: "10.0.1.0/24"
secure: true
security: [sys, krb5]
permission: rw
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create a new rule for an existing NFS export policy
everpure.flashblade.purefb_policy:
name: test_nfs_export
policy_type: nfs
atime: true
client: "10.0.2.0/24"
security: sys
permission: ro
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Delete a client rule from an NFS export policy
everpure.flashblade.purefb_policy:
name: test_nfs_export
client: "10.0.1.0/24"
policy_type: nfs
state: absent
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Delete an NFS export policy and all associated rules
everpure.flashblade.purefb_policy:
name: test_nfs_export
state: absent
policy_type: nfs
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Delete a rule from an object store access policy
everpure.flashblade.purefb_policy:
name: test_os_policy_rule
account: test
policy_type: access
rule: rule1
state: absent
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Delete a user from an object store access policy
everpure.flashblade.purefb_policy:
name: test_os_policy_rule
account: test
user: fred
policy_type: access
state: absent
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Delete an object store access policy with attached users (USE WITH CAUTION)
everpure.flashblade.purefb_policy:
name: test_os_policy_rule
account: test
policy_type: access
force_delete: true
state: absent
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Delete an object store access policy with no attached users
everpure.flashblade.purefb_policy:
name: test_os_policy_rule
account: test
policy_type: access
state: absent
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Copy an object store access policy rule to another exisitng policy
everpure.flashblade.purefb_policy:
name: test_os_policy_rule
policy_type: access
account: test
target: "account2/anotherpolicy"
target_rule: new_rule1
state: copy
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Rename an NFS Export Policy
everpure.flashblade.purefb_policy:
name: old_name
policy_type: nfs
rename: new_name
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Copy an NFS Export Policy, including its rules, to a new policy
everpure.flashblade.purefb_policy:
name: test_nfs_export
policy_type: nfs
target: test_nfs_export_copy
state: copy
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Add a rule to the default network access policy
everpure.flashblade.purefb_policy:
name: default-network-access-policy
policy_type: network
client: 10.0.1.0/24
effect: deny
interfaces:
- management-ssh
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Create a WORM Data Policy
everpure.flashblade.purefb_policy:
name: worm1
policy_type: worm
default_retention: 5d
min_rentetion: 20h
max_retention: 1y
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6