Skip to content

Commit 51005f9

Browse files
da-arda-ar
committed
(FM-7602) Update tasks to work with Bolt and RSAPI Transports
1 parent a18bb23 commit 51005f9

File tree

9 files changed

+107
-98
lines changed

9 files changed

+107
-98
lines changed

‎lib/puppet/transport/panos.rb‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ module Puppet::Transport
88
# The main connection class to a PAN-OS API endpoint
99
class Panos
1010
def self.validate_connection_info(connection_info)
11-
raise Puppet::ResourceError, 'Could not find "username"/"password" or "apikey" in the configuration' unless (connection_info.key?(:username) && connection_info.key?(:password)) || connection_info.key?(:apikey) # rubocop:disable Metrics/LineLength
11+
raise Puppet::ResourceError, 'Could not find "user"/"password" or "apikey" in the configuration' unless (connection_info.key?(:user) && connection_info.key?(:password)) || connection_info.key?(:apikey) # rubocop:disable Metrics/LineLength
1212
connection_info
1313
end
1414

@@ -102,6 +102,10 @@ def commit
102102
api.job_request('commit', cmd: '<commit></commit>')
103103
end
104104

105+
def apikey
106+
api.apikey
107+
end
108+
105109
private
106110

107111
def api

‎lib/puppet/transport/schema/panos.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,15 @@
77
EOS
88
features: [],
99
connection_info: {
10-
address: {
10+
host: {
1111
type: 'String',
1212
desc: 'The FQDN or IP address of the firewall to connect to.',
1313
},
1414
port: {
1515
type: 'Optional[Integer]',
1616
desc: 'The port of the firewall to connect to.',
1717
},
18-
username: {
18+
user: {
1919
type: 'Optional[String]',
2020
desc: 'The username to use for authenticating all connections to the firewall. Only one of `username`/`password` or `apikey` can be specified.',
2121
},

‎tasks/apikey.json‎

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,13 @@
11
{
22
"puppet_task_version": 1,
33
"supports_noop": false,
4-
"description": "Retrieve a PAN-OS apikey using PAN-OS host, username and password.",
4+
"remote": true,
5+
"description": "Retrieve a PAN-OS apikey",
56
"parameters": {
6-
"host": {
7-
"description": "The host to connect to",
8-
"type": "String"
9-
},
10-
"user": {
11-
"description": "The user name",
12-
"type": "String"
13-
},
14-
"password": {
15-
"description": "The password",
16-
"type": "String"
17-
}
18-
}
7+
},
8+
"files": [
9+
"panos/tasks/panos_task.rb",
10+
"panos/lib/puppet/transport/panos.rb",
11+
"panos/lib/puppet/transport/schema/panos.rb"
12+
]
1913
}

‎tasks/apikey.rb‎

Lines changed: 3 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,6 @@
11
#!/opt/puppetlabs/puppet/bin/ruby
22

3-
# work around the fact that bolt (for now, see BOLT-132) is not able to transport additional code from the module
4-
# this requires that the panos module is pluginsynced to the node executing the task
5-
require 'puppet'
6-
Puppet.settings.initialize_app_defaults(
7-
Puppet::Settings.app_defaults_for_run_mode(
8-
Puppet::Util::RunMode[:agent],
9-
),
10-
)
11-
$LOAD_PATH.unshift(Puppet[:plugindest])
3+
require_relative 'panos_task'
4+
task = PanosTask.new
125

13-
# setup logging to stdout/stderr which will be available to task executors
14-
Puppet::Util::Log.newdestination(:console)
15-
Puppet[:log_level] = 'debug'
16-
17-
#### the real task ###
18-
19-
require 'json'
20-
require 'puppet/resource_api/transport/wrapper'
21-
22-
params = JSON.parse(ENV['PARAMS'] || STDIN.read)
23-
wrapper = Puppet::ResourceApi::Transport::Wrapper.new('panos', params['credentials_file'])
24-
transport = wrapper.transport
25-
26-
puts JSON.generate(apikey: transport.apikey)
6+
puts JSON.generate(apikey: task.transport.apikey)

‎tasks/commit.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
{
22
"puppet_task_version": 1,
3+
"remote": true,
34
"supports_noop": false,
45
"description": "Commit a candidate configuration to a firewall.",
56
"parameters": {
6-
"credentials_file": {
7-
"description": "The filename of the credentials file (as referenced in device.conf)",
8-
"type": "String"
9-
}
10-
}
7+
},
8+
"files": [
9+
"panos/tasks/panos_task.rb",
10+
"panos/lib/puppet/transport/panos.rb",
11+
"panos/lib/puppet/transport/schema/panos.rb"
12+
]
1113
}

‎tasks/commit.rb‎

Lines changed: 4 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,8 @@
11
#!/opt/puppetlabs/puppet/bin/ruby
22

3-
# work around the fact that bolt (for now, see BOLT-132) is not able to transport additional code from the module
4-
# this requires that the panos module is pluginsynced to the node executing the task
5-
require 'puppet'
6-
Puppet.settings.initialize_app_defaults(
7-
Puppet::Settings.app_defaults_for_run_mode(
8-
Puppet::Util::RunMode[:agent],
9-
),
10-
)
11-
$LOAD_PATH.unshift(Puppet[:plugindest])
3+
require_relative 'panos_task'
4+
task = PanosTask.new
125

13-
# setup logging to stdout/stderr which will be available to task executors
14-
Puppet::Util::Log.newdestination(:console)
15-
Puppet[:log_level] = 'debug'
16-
17-
#### the real task ###
18-
19-
require 'json'
20-
require 'puppet/resource_api/transport/wrapper'
21-
22-
params = JSON.parse(ENV['PARAMS'] || STDIN.read)
23-
wrapper = Puppet::ResourceApi::Transport::Wrapper.new('panos', params['credentials_file'])
24-
transport = wrapper.transport
25-
26-
if transport.outstanding_changes?
27-
transport.commit
6+
if task.transport.outstanding_changes?
7+
task.transport.commit
288
end

‎tasks/panos_task.rb‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
require 'puppet'
2+
require 'json'
3+
4+
class PanosTask
5+
def initialize
6+
# work around the fact that bolt (for now, see BOLT-132) is not able to transport additional code from the module
7+
# this requires that the panos module is pluginsynced to the node executing the task
8+
Puppet.settings.initialize_app_defaults(
9+
Puppet::Settings.app_defaults_for_run_mode(
10+
Puppet::Util::RunMode[:agent],
11+
),
12+
)
13+
$LOAD_PATH.unshift(Puppet[:plugindest])
14+
15+
unless target
16+
puts "Panos task must be run on a proxy"
17+
exit 1
18+
end
19+
20+
add_plugin_paths(params['_installdir'])
21+
end
22+
23+
def transport
24+
require 'puppet/resource_api/transport'
25+
require 'puppet/transport/panos'
26+
27+
Puppet::ResourceApi::Transport.connect('panos', credentials)
28+
end
29+
30+
def params
31+
@params ||= JSON.parse(ENV['PARAMS'] || STDIN.read)
32+
end
33+
34+
def target
35+
@target ||= params['_target']
36+
end
37+
38+
def credentials
39+
@credentials ||= if target.key? 'apikey'
40+
{
41+
host: target['host'],
42+
apikey: target['apikey']
43+
}
44+
else
45+
{
46+
host: target['host'],
47+
user: target['user'],
48+
password: target['password']
49+
}
50+
end
51+
52+
if target.key? 'port'
53+
@credentials[:port] = target['port']
54+
end
55+
56+
@credentials
57+
end
58+
59+
private
60+
# Syncs across anything from the module lib
61+
def add_plugin_paths(install_dir)
62+
Dir.glob(File.join([install_dir, '*'])).each do |mod|
63+
$LOAD_PATH << File.join([mod, "lib"])
64+
end
65+
end
66+
end

‎tasks/set_config.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,9 @@
11
{
22
"puppet_task_version": 1,
33
"supports_noop": false,
4+
"remote": true,
45
"description": "upload and/or apply a configuration to a firewall.",
56
"parameters": {
6-
"credentials_file": {
7-
"description": "The filename of the credentials file (as referenced in device.conf)",
8-
"type": "String"
9-
},
107
"config_file": {
118
"description": "The filename of the configuration file to upload",
129
"type": "String"
@@ -15,5 +12,10 @@
1512
"description": "true: upload and immediately apply the config. false: upload the config, without applying",
1613
"type": "Boolean"
1714
}
18-
}
15+
},
16+
"files": [
17+
"panos/tasks/panos_task.rb",
18+
"panos/lib/puppet/transport/panos.rb",
19+
"panos/lib/puppet/transport/schema/panos.rb"
20+
]
1921
}

‎tasks/set_config.rb‎

Lines changed: 5 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,11 @@
11
#!/opt/puppetlabs/puppet/bin/ruby
22

3-
# work around the fact that bolt (for now, see BOLT-132) is not able to transport additional code from the module
4-
# this requires that the panos module is pluginsynced to the node executing the task
5-
require 'puppet'
6-
Puppet.settings.initialize_app_defaults(
7-
Puppet::Settings.app_defaults_for_run_mode(
8-
Puppet::Util::RunMode[:agent],
9-
),
10-
)
11-
$LOAD_PATH.unshift(Puppet[:plugindest])
3+
require_relative 'panos_task'
4+
task = PanosTask.new
125

13-
# setup logging to stdout/stderr which will be available to task executors
14-
Puppet::Util::Log.newdestination(:console)
15-
Puppet[:log_level] = 'debug'
16-
17-
#### the real task ###
18-
19-
require 'json'
20-
require 'puppet/resource_api/transport/wrapper'
21-
22-
params = JSON.parse(ENV['PARAMS'] || STDIN.read)
23-
wrapper = Puppet::ResourceApi::Transport::Wrapper.new('panos', params['credentials_file'])
24-
transport = wrapper.transport
25-
26-
file = params['config_file']
6+
file = task.params['config_file']
277
transport.import(file, 'configuration')
28-
if params['apply']
8+
9+
if task.params['apply']
2910
transport.load_config(File.basename(file))
3011
end

0 commit comments

Comments
 (0)