mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-04-25 03:41:25 -07:00
K8s raw modules (#34050)
* New dirs, raw modules, and deprecations, 'openshift' not 'oc'
This commit is contained in:
Chris Houseknecht
Adam Miller
parent
fcc79de246
commit
1a59247f27
6 changed files with 23 additions and 21 deletions
|
|
@ -1,421 +0,0 @@
|
|||
#!/usr/bin/python
|
||||
|
||||
# Copyright: (c) 2015, Google Inc. All Rights Reserved.
|
||||
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
__metaclass__ = type
|
||||
|
||||
ANSIBLE_METADATA = {'metadata_version': '1.1',
|
||||
'status': ['preview'],
|
||||
'supported_by': 'community'}
|
||||
|
||||
DOCUMENTATION = '''
|
||||
---
|
||||
module: kubernetes
|
||||
version_added: "2.1"
|
||||
short_description: Manage Kubernetes resources
|
||||
description:
|
||||
- This module can manage Kubernetes resources on an existing cluster using
|
||||
the Kubernetes server API. Users can specify in-line API data, or
|
||||
specify an existing Kubernetes YAML file.
|
||||
- Currently, this module
|
||||
(1) Only supports HTTP Basic Auth
|
||||
(2) Only supports 'strategic merge' for update, http://goo.gl/fCPYxT
|
||||
SSL certs are not working, use C(validate_certs=off) to disable.
|
||||
options:
|
||||
api_endpoint:
|
||||
description:
|
||||
- The IPv4 API endpoint of the Kubernetes cluster.
|
||||
required: true
|
||||
aliases: [ endpoint ]
|
||||
inline_data:
|
||||
description:
|
||||
- The Kubernetes YAML data to send to the API I(endpoint). This option is
|
||||
mutually exclusive with C('file_reference').
|
||||
required: true
|
||||
file_reference:
|
||||
description:
|
||||
- Specify full path to a Kubernets YAML file to send to API I(endpoint).
|
||||
This option is mutually exclusive with C('inline_data').
|
||||
patch_operation:
|
||||
description:
|
||||
- Specify patch operation for Kubernetes resource update.
|
||||
- For details, see the description of PATCH operations at
|
||||
U(https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/devel/api-conventions.md#patch-operations).
|
||||
default: Strategic Merge Patch
|
||||
choices: [ JSON Patch, Merge Patch, Strategic Merge Patch ]
|
||||
aliases: [ patch_strategy ]
|
||||
version_added: 2.4
|
||||
certificate_authority_data:
|
||||
description:
|
||||
- Certificate Authority data for Kubernetes server. Should be in either
|
||||
standard PEM format or base64 encoded PEM data. Note that certificate
|
||||
verification is broken until ansible supports a version of
|
||||
'match_hostname' that can match the IP address against the CA data.
|
||||
state:
|
||||
description:
|
||||
- The desired action to take on the Kubernetes data.
|
||||
required: true
|
||||
choices: [ absent, present, replace, update ]
|
||||
default: present
|
||||
url_password:
|
||||
description:
|
||||
- The HTTP Basic Auth password for the API I(endpoint). This should be set
|
||||
unless using the C('insecure') option.
|
||||
aliases: [ password ]
|
||||
url_username:
|
||||
description:
|
||||
- The HTTP Basic Auth username for the API I(endpoint). This should be set
|
||||
unless using the C('insecure') option.
|
||||
default: admin
|
||||
aliases: [ username ]
|
||||
insecure:
|
||||
description:
|
||||
- Reverts the connection to using HTTP instead of HTTPS. This option should
|
||||
only be used when execuing the M('kubernetes') module local to the Kubernetes
|
||||
cluster using the insecure local port (locahost:8080 by default).
|
||||
validate_certs:
|
||||
description:
|
||||
- Enable/disable certificate validation. Note that this is set to
|
||||
C(false) until Ansible can support IP address based certificate
|
||||
hostname matching (exists in >= python3.5.0).
|
||||
type: bool
|
||||
default: 'no'
|
||||
author:
|
||||
- Eric Johnson (@erjohnso) <erjohnso@google.com>
|
||||
'''
|
||||
|
||||
EXAMPLES = '''
|
||||
# Create a new namespace with in-line YAML.
|
||||
- name: Create a kubernetes namespace
|
||||
kubernetes:
|
||||
api_endpoint: 123.45.67.89
|
||||
url_username: admin
|
||||
url_password: redacted
|
||||
inline_data:
|
||||
kind: Namespace
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: ansible-test
|
||||
labels:
|
||||
label_env: production
|
||||
label_ver: latest
|
||||
annotations:
|
||||
a1: value1
|
||||
a2: value2
|
||||
state: present
|
||||
|
||||
# Create a new namespace from a YAML file.
|
||||
- name: Create a kubernetes namespace
|
||||
kubernetes:
|
||||
api_endpoint: 123.45.67.89
|
||||
url_username: admin
|
||||
url_password: redacted
|
||||
file_reference: /path/to/create_namespace.yaml
|
||||
state: present
|
||||
|
||||
# Do the same thing, but using the insecure localhost port
|
||||
- name: Create a kubernetes namespace
|
||||
kubernetes:
|
||||
api_endpoint: 123.45.67.89
|
||||
insecure: true
|
||||
file_reference: /path/to/create_namespace.yaml
|
||||
state: present
|
||||
|
||||
'''
|
||||
|
||||
RETURN = '''
|
||||
# Example response from creating a Kubernetes Namespace.
|
||||
api_response:
|
||||
description: Raw response from Kubernetes API, content varies with API.
|
||||
returned: success
|
||||
type: complex
|
||||
contains:
|
||||
apiVersion: "v1"
|
||||
kind: "Namespace"
|
||||
metadata:
|
||||
creationTimestamp: "2016-01-04T21:16:32Z"
|
||||
name: "test-namespace"
|
||||
resourceVersion: "509635"
|
||||
selfLink: "/api/v1/namespaces/test-namespace"
|
||||
uid: "6dbd394e-b328-11e5-9a02-42010af0013a"
|
||||
spec:
|
||||
finalizers:
|
||||
- kubernetes
|
||||
status:
|
||||
phase: "Active"
|
||||
'''
|
||||
|
||||
import base64
|
||||
import json
|
||||
|
||||
try:
|
||||
import yaml
|
||||
HAS_LIB_YAML = True
|
||||
except ImportError:
|
||||
HAS_LIB_YAML = False
|
||||
|
||||
from ansible.module_utils.basic import AnsibleModule
|
||||
from ansible.module_utils.urls import fetch_url
|
||||
|
||||
|
||||
############################################################################
|
||||
############################################################################
|
||||
# For API coverage, this Anislbe module provides capability to operate on
|
||||
# all Kubernetes objects that support a "create" call (except for 'Events').
|
||||
# In order to obtain a valid list of Kubernetes objects, the v1 spec file
|
||||
# was referenced and the below python script was used to parse the JSON
|
||||
# spec file, extract only the objects with a description starting with
|
||||
# 'create a'. The script then iterates over all of these base objects
|
||||
# to get the endpoint URL and was used to generate the KIND_URL map.
|
||||
#
|
||||
# import json
|
||||
# from urllib2 import urlopen
|
||||
#
|
||||
# r = urlopen("https://raw.githubusercontent.com/kubernetes"
|
||||
# "/kubernetes/master/api/swagger-spec/v1.json")
|
||||
# v1 = json.load(r)
|
||||
#
|
||||
# apis = {}
|
||||
# for a in v1['apis']:
|
||||
# p = a['path']
|
||||
# for o in a['operations']:
|
||||
# if o["summary"].startswith("create a") and o["type"] != "v1.Event":
|
||||
# apis[o["type"]] = p
|
||||
#
|
||||
# def print_kind_url_map():
|
||||
# results = []
|
||||
# for a in apis.keys():
|
||||
# results.append('"%s": "%s"' % (a[3:].lower(), apis[a]))
|
||||
# results.sort()
|
||||
# print("KIND_URL = {")
|
||||
# print(",\n".join(results))
|
||||
# print("}")
|
||||
#
|
||||
# if __name__ == '__main__':
|
||||
# print_kind_url_map()
|
||||
############################################################################
|
||||
############################################################################
|
||||
|
||||
KIND_URL = {
|
||||
"binding": "/api/v1/namespaces/{namespace}/bindings",
|
||||
"configmap": "/api/v1/namespaces/{namespace}/configmaps",
|
||||
"endpoints": "/api/v1/namespaces/{namespace}/endpoints",
|
||||
"limitrange": "/api/v1/namespaces/{namespace}/limitranges",
|
||||
"namespace": "/api/v1/namespaces",
|
||||
"node": "/api/v1/nodes",
|
||||
"persistentvolume": "/api/v1/persistentvolumes",
|
||||
"persistentvolumeclaim": "/api/v1/namespaces/{namespace}/persistentvolumeclaims", # NOQA
|
||||
"pod": "/api/v1/namespaces/{namespace}/pods",
|
||||
"podtemplate": "/api/v1/namespaces/{namespace}/podtemplates",
|
||||
"replicationcontroller": "/api/v1/namespaces/{namespace}/replicationcontrollers", # NOQA
|
||||
"resourcequota": "/api/v1/namespaces/{namespace}/resourcequotas",
|
||||
"secret": "/api/v1/namespaces/{namespace}/secrets",
|
||||
"service": "/api/v1/namespaces/{namespace}/services",
|
||||
"serviceaccount": "/api/v1/namespaces/{namespace}/serviceaccounts",
|
||||
"daemonset": "/apis/extensions/v1beta1/namespaces/{namespace}/daemonsets",
|
||||
"deployment": "/apis/extensions/v1beta1/namespaces/{namespace}/deployments",
|
||||
"horizontalpodautoscaler": "/apis/extensions/v1beta1/namespaces/{namespace}/horizontalpodautoscalers", # NOQA
|
||||
"ingress": "/apis/extensions/v1beta1/namespaces/{namespace}/ingresses",
|
||||
"job": "/apis/extensions/v1beta1/namespaces/{namespace}/jobs",
|
||||
}
|
||||
USER_AGENT = "ansible-k8s-module/0.0.1"
|
||||
|
||||
|
||||
# TODO(erjohnso): SSL Certificate validation is currently unsupported.
|
||||
# It can be made to work when the following are true:
|
||||
# - Ansible consistently uses a "match_hostname" that supports IP Address
|
||||
# matching. This is now true in >= python3.5.0. Currently, this feature
|
||||
# is not yet available in backports.ssl_match_hostname (still 3.4).
|
||||
# - Ansible allows passing in the self-signed CA cert that is created with
|
||||
# a kubernetes master. The lib/ansible/module_utils/urls.py method,
|
||||
# SSLValidationHandler.get_ca_certs() needs a way for the Kubernetes
|
||||
# CA cert to be passed in and included in the generated bundle file.
|
||||
# When this is fixed, the following changes can be made to this module,
|
||||
# - Remove the 'return' statement in line 254 below
|
||||
# - Set 'required=true' for certificate_authority_data and ensure that
|
||||
# ansible's SSLValidationHandler.get_ca_certs() can pick up this CA cert
|
||||
# - Set 'required=true' for the validate_certs param.
|
||||
|
||||
def decode_cert_data(module):
|
||||
return
|
||||
# pylint: disable=unreachable
|
||||
d = module.params.get("certificate_authority_data")
|
||||
if d and not d.startswith("-----BEGIN"):
|
||||
module.params["certificate_authority_data"] = base64.b64decode(d)
|
||||
|
||||
|
||||
def api_request(module, url, method="GET", headers=None, data=None):
|
||||
body = None
|
||||
if data:
|
||||
data = json.dumps(data)
|
||||
response, info = fetch_url(module, url, method=method, headers=headers, data=data)
|
||||
if int(info['status']) == -1:
|
||||
module.fail_json(msg="Failed to execute the API request: %s" % info['msg'], url=url, method=method, headers=headers)
|
||||
if response is not None:
|
||||
body = json.loads(response.read())
|
||||
return info, body
|
||||
|
||||
|
||||
def k8s_create_resource(module, url, data):
|
||||
info, body = api_request(module, url, method="POST", data=data, headers={"Content-Type": "application/json"})
|
||||
if info['status'] == 409:
|
||||
name = data["metadata"].get("name", None)
|
||||
info, body = api_request(module, url + "/" + name)
|
||||
return False, body
|
||||
elif info['status'] >= 400:
|
||||
module.fail_json(msg="failed to create the resource: %s" % info['msg'], url=url)
|
||||
return True, body
|
||||
|
||||
|
||||
def k8s_delete_resource(module, url, data):
|
||||
name = data.get('metadata', {}).get('name')
|
||||
if name is None:
|
||||
module.fail_json(msg="Missing a named resource in object metadata when trying to remove a resource")
|
||||
|
||||
url = url + '/' + name
|
||||
info, body = api_request(module, url, method="DELETE")
|
||||
if info['status'] == 404:
|
||||
return False, "Resource name '%s' already absent" % name
|
||||
elif info['status'] >= 400:
|
||||
module.fail_json(msg="failed to delete the resource '%s': %s" % (name, info['msg']), url=url)
|
||||
return True, "Successfully deleted resource name '%s'" % name
|
||||
|
||||
|
||||
def k8s_replace_resource(module, url, data):
|
||||
name = data.get('metadata', {}).get('name')
|
||||
if name is None:
|
||||
module.fail_json(msg="Missing a named resource in object metadata when trying to replace a resource")
|
||||
|
||||
headers = {"Content-Type": "application/json"}
|
||||
url = url + '/' + name
|
||||
info, body = api_request(module, url, method="PUT", data=data, headers=headers)
|
||||
if info['status'] == 409:
|
||||
name = data["metadata"].get("name", None)
|
||||
info, body = api_request(module, url + "/" + name)
|
||||
return False, body
|
||||
elif info['status'] >= 400:
|
||||
module.fail_json(msg="failed to replace the resource '%s': %s" % (name, info['msg']), url=url)
|
||||
return True, body
|
||||
|
||||
|
||||
def k8s_update_resource(module, url, data, patch_operation):
|
||||
# PATCH operations are explained in details at:
|
||||
# https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/devel/api-conventions.md#patch-operations
|
||||
PATCH_OPERATIONS_MAP = {
|
||||
'JSON Patch': 'application/json-patch+json',
|
||||
'Merge Patch': 'application/merge-patch+json',
|
||||
'Strategic Merge Patch': 'application/strategic-merge-patch+json',
|
||||
}
|
||||
|
||||
name = data.get('metadata', {}).get('name')
|
||||
if name is None:
|
||||
module.fail_json(msg="Missing a named resource in object metadata when trying to update a resource")
|
||||
|
||||
headers = {"Content-Type": PATCH_OPERATIONS_MAP[patch_operation]}
|
||||
url = url + '/' + name
|
||||
info, body = api_request(module, url, method="PATCH", data=data, headers=headers)
|
||||
if info['status'] == 409:
|
||||
name = data["metadata"].get("name", None)
|
||||
info, body = api_request(module, url + "/" + name)
|
||||
return False, body
|
||||
elif info['status'] >= 400:
|
||||
module.fail_json(msg="failed to update the resource '%s': %s" % (name, info['msg']), url=url)
|
||||
return True, body
|
||||
|
||||
|
||||
def main():
|
||||
module = AnsibleModule(
|
||||
argument_spec=dict(
|
||||
http_agent=dict(type='str', default=USER_AGENT),
|
||||
url_username=dict(type='str', default='admin', aliases=['username']),
|
||||
url_password=dict(type='str', default='', no_log=True, aliases=['password']),
|
||||
force_basic_auth=dict(type='bool', default=True),
|
||||
validate_certs=dict(type='bool', default=False),
|
||||
certificate_authority_data=dict(type='str'),
|
||||
insecure=dict(type='bool', default=False),
|
||||
api_endpoint=dict(type='str', required=True),
|
||||
patch_operation=dict(type='str', default='Strategic Merge Patch', aliases=['patch_strategy'],
|
||||
choices=['JSON Patch', 'Merge Patch', 'Strategic Merge Patch']),
|
||||
file_reference=dict(type='str'),
|
||||
inline_data=dict(type='str'),
|
||||
state=dict(type='str', default='present', choices=['absent', 'present', 'replace', 'update'])
|
||||
),
|
||||
mutually_exclusive=(('file_reference', 'inline_data'),
|
||||
('url_username', 'insecure'),
|
||||
('url_password', 'insecure')),
|
||||
required_one_of=(('file_reference', 'inline_data')),
|
||||
)
|
||||
|
||||
if not HAS_LIB_YAML:
|
||||
module.fail_json(msg="missing python library: yaml")
|
||||
|
||||
decode_cert_data(module)
|
||||
|
||||
api_endpoint = module.params.get('api_endpoint')
|
||||
state = module.params.get('state')
|
||||
insecure = module.params.get('insecure')
|
||||
inline_data = module.params.get('inline_data')
|
||||
file_reference = module.params.get('file_reference')
|
||||
patch_operation = module.params.get('patch_operation')
|
||||
|
||||
if inline_data:
|
||||
if not isinstance(inline_data, dict) and not isinstance(inline_data, list):
|
||||
data = yaml.safe_load(inline_data)
|
||||
else:
|
||||
data = inline_data
|
||||
else:
|
||||
try:
|
||||
f = open(file_reference, "r")
|
||||
data = [x for x in yaml.safe_load_all(f)]
|
||||
f.close()
|
||||
if not data:
|
||||
module.fail_json(msg="No valid data could be found.")
|
||||
except:
|
||||
module.fail_json(msg="The file '%s' was not found or contained invalid YAML/JSON data" % file_reference)
|
||||
|
||||
# set the transport type and build the target endpoint url
|
||||
transport = 'https'
|
||||
if insecure:
|
||||
transport = 'http'
|
||||
|
||||
target_endpoint = "%s://%s" % (transport, api_endpoint)
|
||||
|
||||
body = []
|
||||
changed = False
|
||||
|
||||
# make sure the data is a list
|
||||
if not isinstance(data, list):
|
||||
data = [data]
|
||||
|
||||
for item in data:
|
||||
namespace = "default"
|
||||
if item and 'metadata' in item:
|
||||
namespace = item.get('metadata', {}).get('namespace', "default")
|
||||
kind = item.get('kind', '').lower()
|
||||
try:
|
||||
url = target_endpoint + KIND_URL[kind]
|
||||
except KeyError:
|
||||
module.fail_json(msg="invalid resource kind specified in the data: '%s'" % kind)
|
||||
url = url.replace("{namespace}", namespace)
|
||||
else:
|
||||
url = target_endpoint
|
||||
|
||||
if state == 'present':
|
||||
item_changed, item_body = k8s_create_resource(module, url, item)
|
||||
elif state == 'absent':
|
||||
item_changed, item_body = k8s_delete_resource(module, url, item)
|
||||
elif state == 'replace':
|
||||
item_changed, item_body = k8s_replace_resource(module, url, item)
|
||||
elif state == 'update':
|
||||
item_changed, item_body = k8s_update_resource(module, url, item, patch_operation)
|
||||
|
||||
changed |= item_changed
|
||||
body.append(item_body)
|
||||
|
||||
module.exit_json(changed=changed, api_response=body)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
Loading…
Add table
Add a link
Reference in a new issue