ngine_io.cloudstack.cs_firewall – Manages firewall rules on Apache CloudStack based clouds.

Note

This plugin is part of the ngine_io.cloudstack collection (version 2.2.2).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install ngine_io.cloudstack.

To use it in a playbook, specify: ngine_io.cloudstack.cs_firewall.

New in version 0.1.0: of ngine_io.cloudstack

Synopsis

  • Creates and removes firewall rules.

Requirements

The below requirements are needed on the host that executes this module.

  • python >= 2.6
  • cs >= 0.9.0

Parameters

Parameter Choices/Defaults Comments
account
string
Account the firewall rule is related to.
api_http_method
string
    Choices:
  • get ←
  • post
HTTP method used to query the API endpoint.
If not given, the CLOUDSTACK_METHOD env variable is considered.
api_key
string / required
API key of the CloudStack API.
If not given, the CLOUDSTACK_KEY env variable is considered.
api_secret
string / required
Secret key of the CloudStack API.
If not set, the CLOUDSTACK_SECRET env variable is considered.
api_timeout
integer
Default:
10
HTTP timeout in seconds.
If not given, the CLOUDSTACK_TIMEOUT env variable is considered.
api_url
string / required
URL of the CloudStack API e.g. https://cloud.example.com/client/api.
If not given, the CLOUDSTACK_ENDPOINT env variable is considered.
api_verify_ssl_cert
string
Verify CA authority cert file.
If not given, the CLOUDSTACK_VERIFY env variable is considered.
cidrs
list / elements=string
Default:
"0.0.0.0/0"
List of CIDRs (full notation) to be used for firewall rule.
Since version 2.5, it is a list of CIDR.

aliases: cidr
domain
string
Domain the firewall rule is related to.
end_port
integer
End port for this rule. Considered if protocol=tcp or protocol=udp.
If not specified, equal start_port.
icmp_code
integer
Error code for this icmp message.
Considered if protocol=icmp.
icmp_type
integer
Type of the icmp message being sent.
Considered if protocol=icmp.
ip_address
string
Public IP address the ingress rule is assigned to.
Required if type=ingress.
network
string
Network the egress rule is related to.
Required if type=egress.
poll_async
boolean
    Choices:
  • no
  • yes ←
Poll async jobs until job has finished.
project
string
Name of the project the firewall rule is related to.
protocol
string
    Choices:
  • tcp ←
  • udp
  • icmp
  • all
Protocol of the firewall rule.
all is only available if type=egress.
start_port
integer
Start port for this rule.
Considered if protocol=tcp or protocol=udp.

aliases: port
state
string
    Choices:
  • present ←
  • absent
State of the firewall rule.
tags
list / elements=dictionary
List of tags. Tags are a list of dictionaries having keys key and value.
To delete all tags, set an empty list e.g. tags: [].

aliases: tag
type
string
    Choices:
  • ingress ←
  • egress
Type of the firewall rule.
zone
string / required
Name of the zone in which the virtual machine is in.

Notes

Note

  • A detailed guide about cloudstack modules can be found in the CloudStack Cloud Guide.
  • This module supports check mode.

Examples

- name: Allow inbound port 80/tcp from 1.2.3.4 to 4.3.2.1
  ngine_io.cloudstack.cs_firewall:
    ip_address: 4.3.2.1
    zone: zone01
    port: 80
    cidr: 1.2.3.4/32

- name: Allow inbound tcp/udp port 53 to 4.3.2.1
  ngine_io.cloudstack.cs_firewall:
    ip_address: 4.3.2.1
    zone: zone01
    port: 53
    protocol: '{{ item }}'
  with_items:
  - tcp
  - udp

- name: Ensure firewall rule is removed
  ngine_io.cloudstack.cs_firewall:
    ip_address: 4.3.2.1
    zone: zone01
    start_port: 8000
    end_port: 8888
    cidr: 17.0.0.0/8
    state: absent

- name: Allow all outbound traffic
  ngine_io.cloudstack.cs_firewall:
    network: my_network
    zone: zone01
    type: egress
    protocol: all

- name: Allow only HTTP outbound traffic for an IP
  ngine_io.cloudstack.cs_firewall:
    network: my_network
    zone: zone01
    type: egress
    port: 80
    cidr: 10.101.1.20

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
cidr
string
success
CIDR string of the rule.

Sample:
0.0.0.0/0
cidrs
list / elements=string
success
CIDR list of the rule.

Sample:
['0.0.0.0/0']
end_port
integer
success
End port of the rule.

Sample:
80
icmp_code
integer
success
ICMP code of the rule.

Sample:
1
icmp_type
integer
success
ICMP type of the rule.

Sample:
1
id
string
success
UUID of the rule.

Sample:
04589590-ac63-4ffc-93f5-b698b8ac38b6
ip_address
string
success
IP address of the rule if type=ingress

Sample:
10.100.212.10
network
string
success
Name of the network if type=egress

Sample:
my_network
protocol
string
success
Protocol of the rule.

Sample:
tcp
start_port
integer
success
Start port of the rule.

Sample:
80
type
string
success
Type of the rule.

Sample:
ingress


Authors

  • René Moser (@resmo)

© 2012–2018 Michael DeHaan
© 2018–2021 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/collections/ngine_io/cloudstack/cs_firewall_module.html