search

ansible-collections / community.zabbix

Zabbix Ansible modules
http://galaxy.ansible.com/community/zabbix
Other
317 stars 269 forks source link

Zabbix httpapi does not honor reset_connection #1209

Closed aivarsV closed 1 week ago

aivarsV commented 3 months ago
SUMMARY

I'm working on Zabbix server bootstrap script, which, among other things, creates new Super admin user and disables default Admin user. Issue, that I'm facing is that zabbix httpapi is unable to drop current connection and reconnect with different credentials.

ISSUE TYPE
COMPONENT NAME

community.zabbix.zabbix httpapi – HttpApi Plugin for Zabbix

ANSIBLE VERSION
ansible [core 2.16.5]
  config file = None
  configured module search path = ['/home/vaivis/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.11/site-packages/ansible
  ansible collection location = /home/vaivis/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.11.8 (main, Feb 12 2024, 14:50:05) [GCC 13.2.1 20230801] (/usr/bin/python)
  jinja version = 3.1.3
  libyaml = True

Collection           Version
-------------------- -------
ansible.netcommon    6.1.0  
ansible.posix        1.5.4  
ansible.utils        4.0.0  
ansible.windows      2.3.0  
community.docker     3.4.8  
community.general    5.7.0  
community.mysql      3.9.0  
community.postgresql 3.0.0  
community.zabbix     2.3.1
CONFIGURATION
CONFIG_FILE() = None
EDITOR(env: EDITOR) = vim
OS / ENVIRONMENT / Zabbix Version
STEPS TO REPRODUCE

My approach is to try to connect with new credentials super verysecretpass and check status of default Admin user. If Admin is not disabled, I expect user super to not exist, so connect with default credentials and create user super. After that Admin can be disabled, so I drop current connection and reconnect as super user and disable Admin.

---
- name: Ensure telemetry server is set up and running
  hosts: all
  tasks:

    - name: Configure zabbix server
      vars:
        ansible_network_os: community.zabbix.zabbix
        ansible_connection: httpapi
        ansible_httpapi_port: 8182
        ansible_httpapi_use_ssl: no
        ansible_zabbix_url_path: ""
        ansible_user: "super"
        ansible_httpapi_pass: "verysecretpass"
      block:
        - name: Ensure default admin is deactivated
          block:
            - name: Check status of default admin
              community.zabbix.zabbix_user_info:
                username: Admin
              register: zbx_admin
              failed_when: zbx_admin.zabbix_user.users_status | int == 0

          rescue:
            - name: Reset connection
              meta: reset_connection

            - name: Configure primary admin user
              vars:
                ansible_user: "Admin"
                ansible_httpapi_pass: "zabbix"
              community.zabbix.zabbix_user:
                username: "super"
                state: present
                name: "New Super"
                surname: "User"
                passwd: "verysecretpass"
                role_name: Super admin role
                usrgrps:
                  - Zabbix administrators
                  - Internal
                autologin: no
                autologout: "0"

            - name: Reset connection
              meta: reset_connection

            - name: Disable default admin user
              community.zabbix.zabbix_user:
                username: "Admin"
                passwd: "zabbix"
                usrgrps:
                  - "Disabled"
EXPECTED RESULTS

I expect this play to fail on Ensure default admin is deactivated and be rescued by subsequent tasks. After this play I expect super users Admin (disabled) and super (enabled). Subsequent runs of this play shold make no changes to user accounts.

ACTUAL RESULTS

On first run play proceeds as expected until task Disable default admin user, at which point play fails with following output. Play output

After first run I'm left with two working super admin accounts - Admin and super. Second run proceeds till the end and Admin get's disabled.

My assumption is that Reset connection task has no actual effect on zabbix httpapi module.

pyrodie18 commented 2 weeks ago

Were you able to get this working?

BGmot commented 2 weeks ago

According to docs it probably applies to SSH connections

reset_connection (added in Ansible 2.3) interrupts a persistent connection (i.e. ssh + control persist)

Have you played with disabling persistent connection?

pyrodie18 commented 1 week ago

No response heard....closing ticket