IBM-Security / isam-ansible-roles

Ansible Custom Modules, Handlers and Tasks for ISAM. Requires "ibmsecurity" python package.
Apache License 2.0
24 stars 43 forks source link

3 major changes: AdminProxy support, new roles (hierarchically structured), exclude filter #64

Closed svetterIO closed 6 years ago

svetterIO commented 6 years ago
  1. AdminProxy support:

    Introducing the AdminProxy parameters (adminProxyProtocol, adminProxyHostname, adminProxyPort, adminProxyApplianceShortName, omitAdminProxy) to the isam module.

    E.g.

    • https://adminProxy.ibm.com/isam.ibm.com adminProxyProtocol=https (optional) adminProxyHostname=isam.ibm.com adminProxyPort=443 (optional)
    • https://adminPrxy.ibm.com/isam adminProxyProtocol=https (optional) adminProxyHostname=isam.ibm.com (necessary for hostname configuration) adminProxyPort=443 (optional) adminProxyApplianceShortName=true
    • https://isam.ibm.com adminProxyProtocol=https (optional) adminProxyHostname=isam.ibm.com adminProxyPort=443 (optional) omitAdminProxy=true (can be used on command line for bypassing the adminProxy)
  2. New roles: hierarchically structured

    New roles with hierarchy structure (aac, base, fed, web) is introduced. The roles partially rely on each other

  3. new exclude filter

    Problem: Currently it is only possible to pop off an element form a dict with a set_fact workaround. (workaround: https://stackoverflow.com/questions/40496021/how-to-remove-a-single-key-from-an-ansible-dictionary) Solution: Adding exclude filter to pop off one element from a dict.

    E.g. dict = {'a':1, 'b':2} dict2 = {{ dict | exclude('b') }}

    result dict: {'a':1, 'b':2} dict2: {'a':1}

sygilber commented 6 years ago

Hi Sebastian

This is I found a good initiative to structure a bit more the role by ISAM module categories so with the increase of new role showing up from time to time nowadays well thing stay well organized.

I was wondering if some role you left out intentionally behind for now or if this just a first cut? I see some ‘base’ role like install_license not considered. Maybe others, I have not all checked.

Also, when let’s say when a role affects (or is common to) either the AAC or Federation module, where would it need to end-up? I am thinking about roles that fall under the category of “Global Settings” of both AAC/Federation menus under the LMI. For instance, a role that would manage “User Registry” (or embedded ldap account if you prefer), would it fall under AAC or Fed category? Another example is “Advanced Configuration” or “Runtime Parameters” … just asking. Not having a particular strong opinion on this other than maybe just wishing an approach that helps all to understand that AAC and Federation modules share a common server infrastructure (Liberty), and that these common functionality are not duplicated in the Appliance, and that they are equally equivalent, i.e. not necessarily biased more toward AAC than Federation.

ram-ibm commented 6 years ago

Please note that these new roles can co-exist with the existing ones. You can choose one or the other.