ansible-collections / community.vmware

Ansible Collection for VMware
GNU General Public License v3.0
342 stars 336 forks source link

vmware_host_service_manager has no state 'reloaded' #1962

Closed alice-rc closed 7 months ago

alice-rc commented 7 months ago
SUMMARY

The state parameter does not have an option for reloaded (like the normal ansible.builtin.service or ansible.builtin.systemd_service modules do)

ISSUE TYPE
COMPONENT NAME

community.vmware.vmware_host_service_manager module

ANSIBLE VERSION
ansible [core 2.15.5]
  config file = <REDACTED>/ansible.cfg
  configured module search path = [<REDACTED>/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = <REDACTED>/site-packages/ansible
  ansible collection location = <REDACTED>/collections
  executable location = <REDACTED>/bin/ansible
  python version = 3.9.13 (main, Nov 16 2022, 15:11:16) [GCC 8.5.0 20210514 (Red Hat 8.5.0-15.0.1)] (<REDACTED>/bin/python3.9)
  jinja version = 3.1.2
  libyaml = True

Version isn't relevant

COLLECTION VERSION
Collection        Version
----------------- -------
community.general 8.0.1
CONFIGURATION
No relevant
OS / ENVIRONMENT

Not relevant

STEPS TO REPRODUCE

There is no state = reload (or reloaded) This is imperative for making updates to some security settings like those for audit as a restart may miss some events which could be a security incident

community.vmware.vmware_host_service_manager:
   hostname: "{{ vcenter_hostname }}"
   username: "{{ vcenter_username }}"
   password: "{{ vcenter_password }}"
   validate_certs: "{{ vcenter_validate_certs }}"
   esxi_hostname: "{{ esxi_host }}"
   service_name: vmsyslogd
   state: reloaded
EXPECTED RESULTS

Expect that code to work

ACTUAL RESULTS

There is no such option as reload or reloaded

ihumster commented 7 months ago

This module have 'state' parameter option 'restart', if you read the documentation, of course.

alice-rc commented 7 months ago

Restart <> Reload Restarting a service disrupts the service's running state and, as stated above, this is unacceptable for a service such as syslog which is processing audit events. This requirement would have been apparent if you read the steps to reproduce above, of course.

ihumster commented 7 months ago

Unfortunately, MOB HostServiceSystem does not have methods to 'reload' a particular service. Only 'start', 'stop', 'restart' and 'refresh'. The description of 'refresh' sounds like: "Refresh the service information and settings to pick up any changes made directly on the host.".

If such a description is suitable, then implementing 'reload', I believe, will not be difficult.

ihumster commented 7 months ago

I understand the difference between restart and reload, but still the vSphere API does not have methods to perform a reload for ESXi services.

alice-rc commented 7 months ago

It may be the case that the 'syslog' service is different than the others (and may be the only one where using reload is required instead of restart).

There are ways of doing this outside of ansible: esxcli system syslog reload or PWSH > ... PWSH> $VMHost = Get-VMHost -Name $EsxHostName PWSH > $EsxCli = Get-EsxCli -V2 -VMHost $VMHost PWSH > $EsxCli.system.syslog.reload.invoke()

My understanding was that everything that is done in PowerCLI is doing API calls under the covers, but I don't know how to map the PowerCLI to the actual API calls.

ihumster commented 7 months ago

The vSphere API does not map in any way to calls to esxcli (or even esxcli via PowerCLI). Personally, I have no idea how to implement what you want. Unless in the form of workaround - after changes we can call ansible.builtin.shell with esxcli (but here you will need to additionally enable ssh on the host, which is not good).

mariolenz commented 7 months ago

My understanding was that everything that is done in PowerCLI is doing API calls under the covers, but I don't know how to map the PowerCLI to the actual API calls.

At the end of the day, PowerCLI will of course call some API. But as far as I understand, some of the API calls PowerCLI uses are not documented. I remember that I've tried to find an equivalent of Get-EsxCli in pyVmomi (the lib most of the modules are based on) but was told that it uses a private API that's not documented and not available to the public.

We can only implement what's documented, and as @ihumster explained we can't find any documentation on reloading a service or something similar to Get-EsxCli. So please understand if I close this for now.

Feel free to open the issue again if you think I'm wrong, but it would be really great if you could suggest a solution if you do. We have no idea how to implement this :-(