bigip_profile_dns - Manage DNS profiles on a BIG-IP

New in version 2.6.

Synopsis

  • Manage DNS profiles on a BIG-IP. There are a variety of DNS profiles, each with their own adjustments to the standard dns profile. Users of this module should be aware that many of the adjustable knobs have no module default. Instead, the default is assigned by the BIG-IP system itself which, in most cases, is acceptable.

Requirements

The below requirements are needed on the host that executes this module.

  • f5-sdk >= 3.0.9

Parameters

Parameter Choices/Defaults Comments
enable_dns_express
bool
    Choices:
  • no
  • yes
Specifies whether the DNS Express engine is enabled.
When creating a new profile, if this parameter is not specified, the default is yes.
The DNS Express engine receives zone transfers from the authoritative DNS server for the zone. If the enable_zone_transfer setting is also yes on this profile, the DNS Express engine also responds to zone transfer requests made by the nameservers configured as zone transfer clients for the DNS Express zone.
enable_dns_firewall
bool
    Choices:
  • no
  • yes
Specifies whether DNS firewall capability is enabled.
When creating a new profile, if this parameter is not specified, the default is no.
enable_dnssec
bool
    Choices:
  • no
  • yes
Specifies whether the system signs responses with DNSSEC keys and replies to DNSSEC specific queries (e.g., DNSKEY query type).
When creating a new profile, if this parameter is not specified, the default is yes.
enable_gtm
bool
    Choices:
  • no
  • yes
Specifies whether the system uses Global Traffic Manager to manage the response.
When creating a new profile, if this parameter is not specified, the default is yes.
enable_zone_transfer
bool
    Choices:
  • no
  • yes
Specifies whether the system answers zone transfer requests for a DNS zone created on the system.
When creating a new profile, if this parameter is not specified, the default is no.
The enable_dns_express and enable_zone_transfer settings on a DNS profile affect how the system responds to zone transfer requests.
When the enable_dns_express and enable_zone_transfer settings are both yes, if a zone transfer request matches a DNS Express zone, then DNS Express answers the request.
When the enable_dns_express setting is no and the enable_zone_transfer setting is yes, the BIG-IP system processes zone transfer requests based on the last action and answers the request from local BIND or a pool member.
name
required
Specifies the name of the DNS profile.
parent
Specifies the profile from which this profile inherits settings.
When creating a new profile, if this parameter is not specified, the default is the system-supplied dns profile.
partition Default:
"Common"
Device partition to manage resources on.
password
required
The password for the user account used to connect to the BIG-IP. You can omit this option if the environment variable F5_PASSWORD is set.

aliases: pass, pwd
process_recursion_desired
bool
    Choices:
  • no
  • yes
Specifies whether to process client-side DNS packets with Recursion Desired set in the header.
When creating a new profile, if this parameter is not specified, the default is yes.
If set to no, processing of the packet is subject to the unhandled-query-action option.
provider
(added in 2.5)
A dict object containing connection details.
password
required
The password for the user account used to connect to the BIG-IP. You can omit this option if the environment variable F5_PASSWORD is set.

aliases: pass, pwd
server
required
The BIG-IP host. You can omit this option if the environment variable F5_SERVER is set.
server_port Default:
443
The BIG-IP server port. You can omit this option if the environment variable F5_SERVER_PORT is set.
user
required
The username to connect to the BIG-IP with. This user must have administrative privileges on the device. You can omit this option if the environment variable F5_USER is set.
validate_certs
bool
    Choices:
  • no
  • yes ←
If no, SSL certificates will not be validated. Use this only on personally controlled sites using self-signed certificates. You can omit this option if the environment variable F5_VALIDATE_CERTS is set.
timeout Default:
10
Specifies the timeout in seconds for communicating with the network device for either connecting or sending commands. If the timeout is exceeded before the operation is completed, the module will error.
ssh_keyfile
Specifies the SSH keyfile to use to authenticate the connection to the remote device. This argument is only used for cli transports. If the value is not specified in the task, the value of environment variable ANSIBLE_NET_SSH_KEYFILE will be used instead.
transport
required
    Choices:
  • rest
  • cli ←
Configures the transport connection to use when connecting to the remote device.
server
required
The BIG-IP host. You can omit this option if the environment variable F5_SERVER is set.
server_port
(added in 2.2)
 Default:
443
The BIG-IP server port. You can omit this option if the environment variable F5_SERVER_PORT is set.
state
    Choices:
  • present ←
  • absent
When present, ensures that the profile exists.
When absent, ensures the profile is removed.
use_local_bind
bool
    Choices:
  • no
  • yes
Specifies whether the system forwards non-wide IP queries to the local BIND server on the BIG-IP system.
For best performance, disable this setting when using a DNS cache.
When creating a new profile, if this parameter is not specified, the default is yes.
user
required
The username to connect to the BIG-IP with. This user must have administrative privileges on the device. You can omit this option if the environment variable F5_USER is set.
validate_certs
bool

(added in 2.0)
    Choices:
  • no
  • yes ←
If no, SSL certificates will not be validated. Use this only on personally controlled sites using self-signed certificates. You can omit this option if the environment variable F5_VALIDATE_CERTS is set.

Notes

Note

Examples

- name: Create a DNS profile
  bigip_profile_dns:
    name: foo
    enable_dns_express: no
    enable_dnssec: no
    enable_gtm: no
    process_recursion_desired: no
    use_local_bind: no
    enable_dns_firewall: yes
    password: secret
    server: lb.mydomain.com
    state: present
    user: admin
  delegate_to: localhost

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
enable_dns_express
bool
 changed
Whether DNS Express is enabled on the resource or not.

Sample:
True
enable_dns_firewall
bool
 changed
Whether DNS firewall capability is enabled or not.
enable_dnssec
bool
 changed
Whether DNSSEC is enabled on the resource or not.
enable_gtm
bool
 changed
Whether GTM is used to manage the resource or not.

Sample:
True
enable_zone_transfer
bool
 changed
Whether zone transfer are enabled on the resource or not.
process_recursion_desired
bool
 changed
Whether client-side DNS packets are processed with Recursion Desired set.

Sample:
True
use_local_bind
bool
 changed
Whether non-wide IP queries are forwarded to the local BIND server or not.


Status

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.

Maintenance

This module is flagged as community which means that it is maintained by the Ansible Community. See Module Maintenance & Support for more info.

For a list of other modules that are also maintained by the Ansible Community, see here.

Author

  • Tim Rupp (@caphrim007)

Hint

If you notice any issues in this documentation you can edit this document to improve it.

© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.6/modules/bigip_profile_dns_module.html