-
Notifications
You must be signed in to change notification settings - Fork 232
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
rjeffman: idempotence playground. #1190
base: master
Are you sure you want to change the base?
Commits on Dec 27, 2023
-
ansbile_module_utils: Use IPA object data type in compare_args_ipa
When comparing a module argument set against an IPA argument set, for each attribute, if it is a list or tuple, a set is created and the sets are compared, this is more efficient than comparing the objects individually, as the list order may be different, and using a set, ordering is ignored. If the parameter value is a scalar, they are directly compared. Although efficient, this method causes idempotence issues with some data types, for example, when the comparison of two strings must be case insensitive. The solution proposed here is to avoid direct value comparison by always using the set comparison method, and that the data type of the values stored in the sets can perform the proper comparison for the specific data type. To ensure the comparison is done only with sets, scalar values are "wrapped" in a list, and the list is later converted to a set. To cope with specific data type comparison (for example: hostnames, services, or case insensitive strings) a new parameter was added, so a dictionaire mapping an argument to a conversion function can be passed, and the set of values is created by applying the conversion function to the IPA and the argument values. The complexity order of the comparison algorithm is not changed, but data conversion, and possibly a customized comparison, are new operations performed, which may have some impact on the execution time.
Configuration menu - View commit details
-
Copy full SHA for 603096e - Browse repository at this point
Copy the full SHA 603096eView commit details -
module_utils: Add support for hostname datatype
One of the issues on ensuring idempotence behavior is that FreeIPA does not expose datatypes along with the values stored in objects. By treating data returned from FreeIPA API with the proper datatype, it is easier to ensure that comparisons that will trigger changes (or not) are properly executed, despite of the stored value or the provided parameter data. This patch provides an initial implementation of the datatypes used by ansible-freeipa modules. An implementation for 'hostname' which ensures data provided for hostnames contain a fully qualified hostname, always in lower case, and an implementation of a 'list_of' to allow for parameters which are lists of objects of a specific datatype.
Configuration menu - View commit details
-
Copy full SHA for a1e90ff - Browse repository at this point
Copy the full SHA a1e90ffView commit details -
ipasudorule: Use 'hostname' datatype
Adapt plugin to use the 'hostname' datatype, instead of reimplementing the required operations.
Configuration menu - View commit details
-
Copy full SHA for b4db7db - Browse repository at this point
Copy the full SHA b4db7dbView commit details -
iparole: Use 'hostname' datatype
Adapt plugin to use the 'hostname' datatype, instead of reimplementing the required operations.
Configuration menu - View commit details
-
Copy full SHA for 2aa9c31 - Browse repository at this point
Copy the full SHA 2aa9c31View commit details -
ipanetgroup: Use 'hostname' datatype
Adapt plugin to use the 'hostname' datatype, instead of reimplementing the required operations.
Configuration menu - View commit details
-
Copy full SHA for 4bbdb89 - Browse repository at this point
Copy the full SHA 4bbdb89View commit details -
ipahostgroup: Use 'hostname' datatype
Adapt plugin to use the 'hostname' datatype, instead of reimplementing the required operations.
Configuration menu - View commit details
-
Copy full SHA for da74378 - Browse repository at this point
Copy the full SHA da74378View commit details -
ipahbacrule: Use 'hostname' datatype
Adapt plugin to use the 'hostname' datatype, instead of reimplementing the required operations.
Configuration menu - View commit details
-
Copy full SHA for e7acfbf - Browse repository at this point
Copy the full SHA e7acfbfView commit details -
module_utils: Add support for service datatype
Add a service cast function that expose an object that allows services to be compared in a case-insensitive manner, but preserve case of the original data.
Configuration menu - View commit details
-
Copy full SHA for c415e38 - Browse repository at this point
Copy the full SHA c415e38View commit details -
iparole: Use 'service' datatype
Adapt plugin to use the 'service' datatype, instead of reimplementing the required operations.
Configuration menu - View commit details
-
Copy full SHA for d29cff4 - Browse repository at this point
Copy the full SHA d29cff4View commit details -
ipaservice: Use 'service' datatype
Adapt plugin to use the 'service' datatype, instead of reimplementing the required operations.
Configuration menu - View commit details
-
Copy full SHA for f6d3819 - Browse repository at this point
Copy the full SHA f6d3819View commit details -
ansible_module_utils: Add support for CaseInsensitive data types
Add a cast function to create a string that can be compared in a case insensitive manner. It also allows the use of the objects in sets and dictionaries, making the key case insensitive.
Configuration menu - View commit details
-
Copy full SHA for 12ecb03 - Browse repository at this point
Copy the full SHA 12ecb03View commit details -
ipadelegation: Fix idempotence issues due to case insensitive strings
Several parameters for ipadelegation need to be compared in a case insensitive manner. Most should be stored in lowercase, but 'memberof' should preserve case to maintain the same behavior as IPA CLI commands.
Configuration menu - View commit details
-
Copy full SHA for 2e3f51d - Browse repository at this point
Copy the full SHA 2e3f51dView commit details -
ansible_module_utils: Make list generation function data type aware
The list generation functions for adding and deleting members from IPA objects create sets but are not aware of the underlying attribute data type. Some data types need to perform special comparison, like case insensitive string comparison, or ensure the existence of a FQDN. This patch adds a new optional attribute to the list generation functions, 'attr_datatype', that takes a function able to convert the expected data (usually a string) to an object that will correctly handle hashing and data comparison. The functions were also modified to perform the list generation, but still return the same data provided to the caller, withot conversion, minimizing the required amount of code changes.
Configuration menu - View commit details
-
Copy full SHA for de1883f - Browse repository at this point
Copy the full SHA de1883fView commit details -
ipahbacrule: Fix handling of hbacsvcgroup in members
FreeIPA provides a default hbacsvcgroup named "Sudo", with capital S, that is different from every other hbacsvcgroup, which are all represented by lower case letters. As data from IPA API was not modified, this causes an idempotence error when using different capitalization with the 'hbacsvcgroup' parameter. This patch fixes the issue by using the CaseInsensitive comparator to create the hbacsvcgroup list. Tests were update to make sure a regression is not included in the future.
Configuration menu - View commit details
-
Copy full SHA for 4015073 - Browse repository at this point
Copy the full SHA 4015073View commit details
Commits on Dec 29, 2023
-
ipahostgroup: Fix idempotence issues due to capitalization
ipahostgroup parameters 'host', 'hostgroup', 'membermanager_user' and 'membermanager_group' must be compared in a case insensitive manner and stored as lower case strings. This patch fixes the comparison and storage of this parameters, and change the handling of members to use the same structure as in newer modules. Two new tests files were added: tests/hostgroup/test_hostgroup_case_insensitive.yml tests/hostgroup/test_hostgroup_membermanager_case_insensitive.yml
Configuration menu - View commit details
-
Copy full SHA for cf4a72d - Browse repository at this point
Copy the full SHA cf4a72dView commit details -
ipagroup: Fix idempotence issues due to capitalization
Some attributes for ipagroup objects are stored using lower case letters and should be converted upon retrieving parameter data. This patch adds the missing conversion and provides a new test playbook: tests/group/test_group_case_insensitive.yml
Configuration menu - View commit details
-
Copy full SHA for c174a36 - Browse repository at this point
Copy the full SHA c174a36View commit details