everpure.flashblade.purefb_tls_policy module – Manage FlashBlade TLS policies

Note

This module is part of the everpure.flashblade collection (version 1.29.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install everpure.flashblade. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: everpure.flashblade.purefb_tls_policy.

New in everpure.flashblade 1.28.0

Synopsis

  • Create, update or delete FlashBlade TLS policies and manage the network interfaces they are applied to.

  • A TLS policy controls the server certificate presented on a network interface, the TLS versions and ciphers permitted, and optional mutual-TLS settings for verifying client certificates.

Requirements

The below requirements are needed on the host that executes this module.

  • python >= 3.9

  • py-pure-client

  • netaddr

  • datetime

  • pytz

  • distro

  • pycountry

  • urllib3

Parameters

Parameter

Comments

api_token

string

FlashBlade API token for admin privileged user.

appliance_certificate

string

Name of the certificate to present as the server certificate during TLS negotiation with clients connecting to network interfaces covered by this policy.

Required when creating a policy; the array rejects a policy without an appliance certificate. Use global for the built-in certificate.

Set to global to reset the policy to the built-in appliance certificate, effectively removing a previously assigned custom certificate.

client_certificates_required

boolean

If true, all clients must present a client certificate during TLS negotiation; failure to do so will be rejected.

If false, client certificates are optional.

The array only accepts true when verify_client_certificate_trust is also true, which in turn needs trusted_client_certificate_authority.

Requires Purity//FB REST API 2.18 or later.

Choices:

  • false

  • true

client_id

string

added in everpure.flashblade 1.26.0

ID of the API Client that issues the identity token.

Used with private_key_file.

disable_warnings

boolean

added in everpure.flashblade 1.18.0

Disable insecure certificate warnings

Choices:

  • false ← (default)

  • true

disabled_tls_ciphers

list / elements=string

List of TLS ciphers to disable.

enabled

boolean

If true the policy is enabled.

Defaults to true on creation if not specified.

Choices:

  • false

  • true

enabled_tls_ciphers

list / elements=string

List of TLS ciphers to enable.

When supplied, only these ciphers will be enabled.

fb_url

string

FlashBlade management IP address or Hostname.

id_token

string

added in everpure.flashblade 1.26.0

A pre-signed JWT to authenticate with, as an alternative to api_token.

The token is exchanged by the array for a short-lived access token.

Requires a matching API Client to be registered on the array (see everpure.flashblade.purefb_apiclient).

issuer

string

added in everpure.flashblade 1.26.0

The API Client’s trusted identity issuer registered on the array.

Used with private_key_file.

key_id

string

added in everpure.flashblade 1.26.0

Key ID of the API Client that issues the identity token.

Used with private_key_file.

min_tls_version

string

Minimum TLS version permitted for inbound connections.

default lets the array pick a recommended minimum that may shift across software upgrades.

Choices:

  • "default"

  • "1.0"

  • "1.1"

  • "1.2"

  • "1.3"

name

string / required

Name of the TLS policy.

network_interfaces

list / elements=string

Desired set of network interfaces this policy should be applied to.

On update, the set of attached interfaces is reconciled against this list - missing interfaces are attached, extras are detached.

Omit entirely to leave existing attachments untouched.

Use an empty list to detach the policy from all interfaces.

On create, an empty list creates the policy with no interfaces attached; this is equivalent to omitting the parameter.

private_key_file

string

added in everpure.flashblade 1.26.0

Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token.

Requires client_id, key_id, issuer and username.

private_key_password

string

added in everpure.flashblade 1.26.0

Password protecting private_key_file, if encrypted.

state

string

Define whether the TLS policy should exist or not.

Choices:

  • "absent"

  • "present" ← (default)

trusted_client_certificate_authority

string

Name of a certificate, or certificate group, used to verify certificates presented by clients when verify_client_certificate_trust is true.

Set to an empty string ("") to clear a previously assigned trusted CA reference. This only applies on update; on create an empty string is treated the same as omitting the parameter.

Requires Purity//FB REST API 2.18 or later.

username

string

added in everpure.flashblade 1.26.0

Username the issued token should be granted to.

Must be a valid user on the array. Used with private_key_file.

verify_client_certificate_trust

boolean

If true, certificates presented by clients in TLS negotiation will undergo strict trust verification using the certificate(s) referenced by trusted_client_certificate_authority.

Requires Purity//FB REST API 2.18 or later.

Choices:

  • false

  • true

Notes

Note

  • You must set PUREFB_URL and PUREFB_API environment variables if fb_url and api_token arguments are not passed to the module directly

  • Token-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flashblade.purefb_apiclient

Examples

- name: Create TLS policy with a server cert and minimum TLS 1.2
  everpure.flashblade.purefb_tls_policy:
    name: secure_data_plane
    appliance_certificate: my_cert
    min_tls_version: '1.2'
    fb_url: 10.10.10.2
    api_token: T-68618f31-0c9e-4e57-aa44-5306a2cf10e3

- name: Require mutual TLS using a trusted CA group
  everpure.flashblade.purefb_tls_policy:
    name: secure_data_plane
    client_certificates_required: true
    verify_client_certificate_trust: true
    trusted_client_certificate_authority: corp_ca_group
    fb_url: 10.10.10.2
    api_token: T-68618f31-0c9e-4e57-aa44-5306a2cf10e3

- name: Apply the policy to a specific set of data network interfaces
  everpure.flashblade.purefb_tls_policy:
    name: secure_data_plane
    network_interfaces:
      - data1.eth0
      - data2.eth0
    fb_url: 10.10.10.2
    api_token: T-68618f31-0c9e-4e57-aa44-5306a2cf10e3

- name: Detach the TLS policy from all network interfaces
  everpure.flashblade.purefb_tls_policy:
    name: secure_data_plane
    network_interfaces: []
    fb_url: 10.10.10.2
    api_token: T-68618f31-0c9e-4e57-aa44-5306a2cf10e3

- name: Disable a TLS policy without deleting it
  everpure.flashblade.purefb_tls_policy:
    name: secure_data_plane
    enabled: false
    fb_url: 10.10.10.2
    api_token: T-68618f31-0c9e-4e57-aa44-5306a2cf10e3

- name: Reset appliance cert to the built-in global cert and clear the trusted CA
  everpure.flashblade.purefb_tls_policy:
    name: secure_data_plane
    appliance_certificate: global
    trusted_client_certificate_authority: ""
    fb_url: 10.10.10.2
    api_token: T-68618f31-0c9e-4e57-aa44-5306a2cf10e3

- name: Delete a TLS policy
  everpure.flashblade.purefb_tls_policy:
    name: secure_data_plane
    state: absent
    fb_url: 10.10.10.2
    api_token: T-68618f31-0c9e-4e57-aa44-5306a2cf10e3

Authors

  • Pure Storage Ansible Team (@avk)