cs_network_acl_rule – Manages network access control list (ACL) rules on Apache CloudStack based clouds¶

New in version 2.4.

Synopsis
Requirements
Parameters
Notes
Examples
Return Values
Status

Synopsis ¶

Add, update and remove network ACL rules.

Requirements ¶

The below requirements are needed on the host that executes this module.

python >= 2.6
cs >= 0.6.10

Parameters ¶

Parameter	Choices/Defaults	Comments
account string		Account the VPC is related to.
action_policy string	Choices: allow ← deny	Action policy of the rule. aliases: action
api_http_method string	Choices: get post	HTTP method used to query the API endpoint. If not given, the `CLOUDSTACK_METHOD` env variable is considered. As the last option, the value is taken from the ini config file, also see the notes. Fallback value is `get` if not specified.
api_key string		API key of the CloudStack API. If not given, the `CLOUDSTACK_KEY` env variable is considered. As the last option, the value is taken from the ini config file, also see the notes.
api_region string	Default: "cloudstack"	Name of the ini section in the `cloustack.ini` file. If not given, the `CLOUDSTACK_REGION` env variable is considered.
api_secret string		Secret key of the CloudStack API. If not set, the `CLOUDSTACK_SECRET` env variable is considered. As the last option, the value is taken from the ini config file, also see the notes.
api_timeout integer		HTTP timeout in seconds. If not given, the `CLOUDSTACK_TIMEOUT` env variable is considered. As the last option, the value is taken from the ini config file, also see the notes. Fallback value is 10 seconds if not specified.
api_url string		URL of the CloudStack API e.g. https://cloud.example.com/client/api. If not given, the `CLOUDSTACK_ENDPOINT` env variable is considered. As the last option, the value is taken from the ini config file, also see the notes.
cidrs list	Default: ["0.0.0.0/0"]	CIDRs of the rule. aliases: cidr
domain string		Domain the VPC is related to.
end_port integer		End port for this rule. Considered if protocol=tcp or protocol=udp. If not specified, equal start_port.
icmp_code integer		Error code for this icmp message. Considered if protocol=icmp.
icmp_type integer		Type of the icmp message being sent. Considered if protocol=icmp.
network_acl string / required		Name of the network ACL. aliases: acl
poll_async boolean	Choices: no yes ←	Poll async jobs until job has finished.
project string		Name of the project the VPC is related to.
protocol string	Choices: tcp ← udp icmp all by_number	Protocol of the rule
protocol_number integer		Protocol number from 1 to 256 required if protocol=by_number.
rule_position integer / required		The position of the network ACL rule. aliases: number
start_port integer		Start port for this rule. Considered if protocol=tcp or protocol=udp. aliases: port
state string	Choices: present ← absent	State of the network ACL rule.
tags list		List of tags. Tags are a list of dictionaries having keys key and value. If you want to delete all tags, set a empty list e.g. tags: []. aliases: tag
traffic_type string	Choices: ingress ← egress	Traffic type of the rule. aliases: type
vpc string / required		VPC the network ACL is related to.
zone string		Name of the zone the VPC related to. If not set, default zone is used.

Notes ¶

Note

Ansible uses the cs library’s configuration method if credentials are not provided by the arguments api_url, api_key, api_secret. Configuration is read from several locations, in the following order. The CLOUDSTACK_ENDPOINT, CLOUDSTACK_KEY, CLOUDSTACK_SECRET and CLOUDSTACK_METHOD. CLOUDSTACK_TIMEOUT environment variables. A CLOUDSTACK_CONFIG environment variable pointing to an .ini file. A cloudstack.ini file in the current working directory. A .cloudstack.ini file in the users home directory. Optionally multiple credentials and endpoints can be specified using ini sections in cloudstack.ini. Use the argument api_region to select the section name, default section is cloudstack. See https://github.com/exoscale/cs for more information.
A detailed guide about cloudstack modules can be found in the CloudStack Cloud Guide.
This module supports check mode.

Examples ¶

- name: create a network ACL rule, allow port 80 ingress
  cs_network_acl_rule:
    network_acl: web
    rule_position: 1
    vpc: my vpc
    traffic_type: ingress
    action_policy: allow
    port: 80
    cidr: 0.0.0.0/0
  delegate_to: localhost

- name: create a network ACL rule, deny port range 8000-9000 ingress for 10.20.0.0/16 and 10.22.0.0/16
  cs_network_acl_rule:
    network_acl: web
    rule_position: 1
    vpc: my vpc
    traffic_type: ingress
    action_policy: deny
    start_port: 8000
    end_port: 9000
    cidrs:
    - 10.20.0.0/16
    - 10.22.0.0/16
  delegate_to: localhost

- name: remove a network ACL rule
  cs_network_acl_rule:
    network_acl: web
    rule_position: 1
    vpc: my vpc
    state: absent
  delegate_to: localhost

Return Values ¶

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
account string	success	Account the network ACL rule is related to. Sample: example account
action_policy string	success	Action policy of the network ACL rule. Sample: deny
cidr string	success	CIDR of the network ACL rule. Sample: 0.0.0.0/0
cidrs list added in 2.9	success	CIDRs of the network ACL rule. Sample: ['0.0.0.0/0']
domain string	success	Domain the network ACL rule is related to. Sample: example domain
end_port integer	success	End port of the network ACL rule. Sample: 80
icmp_code integer	success	ICMP code of the network ACL rule. Sample: 8
icmp_type integer	success	ICMP type of the network ACL rule.
network_acl string	success	Name of the network ACL. Sample: customer acl
project string	success	Name of project the network ACL rule is related to. Sample: Production
protocol string	success	Protocol of the network ACL rule. Sample: tcp
protocol_number integer	success	Protocol number in case protocol is by number. Sample: 8
rule_position integer	success	Position of the network ACL rule. Sample: 1
start_port integer	success	Start port of the network ACL rule. Sample: 80
state string	success	State of the network ACL rule. Sample: Active
tags list	success	List of resource tags associated with the network ACL rule. Sample: [ { "key": "foo", "value": "bar" } ]
traffic_type string	success	Traffic type of the network ACL rule. Sample: ingress
vpc string	success	VPC of the network ACL. Sample: customer vpc
zone string	success	Zone the VPC is related to. Sample: ch-gva-2

Status ¶

This module is not guaranteed to have a backwards compatible interface. [preview]
This module is maintained by the Ansible Community. [community]

Authors¶

René Moser (@resmo)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.

cs_network_acl_rule – Manages network access control list (ACL) rules on Apache CloudStack based clouds¶

Synopsis¶

Requirements¶

Parameters¶

Notes¶

Examples¶

Return Values¶

Status¶