You are reading an unmaintained version of the Ansible documentation. Unmaintained Ansible versions can contain unfixed security vulnerabilities (CVE). Please upgrade to a maintained version. See the latest Ansible documentation.

community.vmware.vmware_local_role_manager module – Manage local roles on an ESXi host

Note

This module is part of the community.vmware collection (version 1.18.2).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.vmware.

To use it in a playbook, specify: community.vmware.vmware_local_role_manager.

Synopsis
Requirements
Parameters
Notes
Examples
Return Values

Synopsis 

This module can be used to manage local roles on an ESXi host.

Requirements 

The below requirements are needed on the host that executes this module.

python >= 2.6
PyVmomi

Parameters 

Parameter	Comments
action string	This parameter is only valid while updating an existing role with privileges. `add` will add the privileges to the existing privilege list. `remove` will remove the privileges from the existing privilege list. `set` will replace the privileges of the existing privileges with user defined list of privileges. Choices: add remove set ← (default)
force_remove boolean	If set to `False` then prevents the role from being removed if any permissions are using it. Choices: no ← (default) yes
hostname string	The hostname or IP address of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_HOST` will be used instead. Environment variable support added in Ansible 2.6.
local_privilege_ids list / elements=string	The list of privileges that role needs to have. Please see https://docs.vmware.com/en/VMware-vSphere/6.0/com.vmware.vsphere.security.doc/GUID-ED56F3C4-77D0-49E3-88B6-B99B8B437B62.html Default: []
local_role_name string / required	The local role name to be managed.
password aliases: pass, pwd string	The password of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_PASSWORD` will be used instead. Environment variable support added in Ansible 2.6.
port integer	The port number of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_PORT` will be used instead. Environment variable support added in Ansible 2.6. Default: 443
proxy_host string	Address of a proxy that will receive all HTTPS requests and relay them. The format is a hostname or a IP. If the value is not specified in the task, the value of environment variable `VMWARE_PROXY_HOST` will be used instead. This feature depends on a version of pyvmomi greater than v6.7.1.2018.12
proxy_port integer	Port of the HTTP proxy that will receive all HTTPS requests and relay them. If the value is not specified in the task, the value of environment variable `VMWARE_PROXY_PORT` will be used instead.
state string	Indicate desired state of the role. If the role already exists when `state=present`, the role info is updated. Choices: present ← (default) absent
username aliases: admin, user string	The username of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_USER` will be used instead. Environment variable support added in Ansible 2.6.
validate_certs boolean	Allows connection when SSL certificates are not valid. Set to `false` when certificates are not trusted. If the value is not specified in the task, the value of environment variable `VMWARE_VALIDATE_CERTS` will be used instead. Environment variable support added in Ansible 2.6. If set to `true`, please make sure Python >= 2.7.9 is installed on the given machine. Choices: no yes ← (default)

Notes 

Note

Tested on ESXi 6.5
Be sure that the ESXi user used for login, has the appropriate rights to create / delete / edit roles
All modules requires API write access and hence is not supported on a free ESXi license.

Examples 

- name: Add local role to ESXi
  community.vmware.vmware_local_role_manager:
    hostname: '{{ esxi_hostname }}'
    username: '{{ esxi_username }}'
    password: '{{ esxi_password }}'
    local_role_name: vmware_qa
    state: present
  delegate_to: localhost

- name: Add local role with privileges to ESXi
  community.vmware.vmware_local_role_manager:
    hostname: '{{ esxi_hostname }}'
    username: '{{ esxi_username }}'
    password: '{{ esxi_password }}'
    local_role_name: vmware_qa
    local_privilege_ids: [ 'Folder.Create', 'Folder.Delete']
    state: present
  delegate_to: localhost

- name: Remove local role from ESXi
  community.vmware.vmware_local_role_manager:
    hostname: '{{ esxi_hostname }}'
    username: '{{ esxi_username }}'
    password: '{{ esxi_password }}'
    local_role_name: vmware_qa
    state: absent
  delegate_to: localhost

- name: Add a privilege to an existing local role
  community.vmware.vmware_local_role_manager:
    hostname: '{{ esxi_hostname }}'
    username: '{{ esxi_username }}'
    password: '{{ esxi_password }}'
    local_role_name: vmware_qa
    local_privilege_ids: [ 'Folder.Create' ]
    action: add
  delegate_to: localhost

- name: Remove a privilege to an existing local role
  community.vmware.vmware_local_role_manager:
    hostname: '{{ esxi_hostname }}'
    username: '{{ esxi_username }}'
    password: '{{ esxi_password }}'
    local_role_name: vmware_qa
    local_privilege_ids: [ 'Folder.Create' ]
    action: remove
  delegate_to: localhost

- name: Set a privilege to an existing local role
  community.vmware.vmware_local_role_manager:
    hostname: '{{ esxi_hostname }}'
    username: '{{ esxi_username }}'
    password: '{{ esxi_password }}'
    local_role_name: vmware_qa
    local_privilege_ids: [ 'Folder.Create' ]
    action: set
  delegate_to: localhost

Return Values 

Common return values are documented here, the following are the fields unique to this module:

Key	Description
local_role_name string	Name of local role Returned: always
new_privileges list / elements=string	List of privileges Returned: always
old_privileges list / elements=string	List of privileges of role before the update Returned: on update
privileges list / elements=string	List of privileges Returned: always
privileges_previous list / elements=string	List of privileges of role before the update Returned: on update
role_id integer	ESXi generated local role id Returned: always
role_name string	Name of local role Returned: always

Authors

Abhijeet Kasurde (@Akasurde)
Christian Kotte (@ckotte)

Collection links

Issue Tracker Homepage Repository (Sources)

community.vmware.vmware_local_role_manager module – Manage local roles on an ESXi host

Synopsis

Requirements

Parameters

Notes

Examples

Return Values