New 'bigip_user' module -- testers needed

Archives Ansible Project
1

Would love to get a few more eyes from F5 BIG-IP on a new module I just submitted for managing users.

Here’s the pull request:

https://github.com/ansible/ansible-modules-extras/pull/1370

Thanks,

-M

2

Hi Matt,

Thanks for the new PR. I was going to wait for 2.0 to be released to send these remaining PRs in for new F5 modules, but since I saw this thread, figured I’d speak up sooner rather than later.

I maintain the f5network’s modules here

https://github.com/F5Networks/f5-ansible/tree/master/library

and would be interested in working together with you on this one if you’re open to that.

Lemme know.

Thanks!
tim

3

This is fantastic… no idea F5 had an internal Ansible effort going! We should discuss how best to reconcile the modules that have been shipping with Ansible vs. the ones you’ve been working on @ F5.

My only “concerns” would be that we:

  • maintain idempotent behavior when possible
  • support check-mode
  • consistent module API, ie. server, user, password parameters in one module vs. login_host, login_user, etc. in another module is no bueno

The bigip_command is cool, would love to see something like that eventually end up in the Ansible repo.

What’s the vision of the tooling you’ve been working on? Looks very much centered around bootstrapping devices rather than day to day operations.

Thanks,

-M

4

Awesome, I’d be happy to discuss. The modules I pointed to at the separate github spot came in to being only over the last year or so. I didn’t have a place to put them publicly until the f5networks github account came about.

Hopefully, in time, they will find their way into the upstream product and I can remove this side-band repository we currently have. I’m more interested in being part of ansible’s workflow than maintaining a separate one.

I share your same concerns. To the best extent I can, the modules in that repo are idempotent. They do not have a corresponding check-mode, but I agree this is a needed addition. Finally, where I have been unsure about how to implement an interface, I have punted and looked at existing modules. That’s why you see some of those parameters named the way they are. I’ve just used existing modules as references.

For example,

http://docs.ansible.com/ansible/user_module.html

http://docs.ansible.com/ansible/mysql_user_module.html

http://docs.ansible.com/ansible/postgresql_user_module.html

Also I’ve tried to add REST and SOAP interfaces if similar functionality exists in each. It helps test those interfaces on my end and future-proofs these modules in the (unlikely) event that one of the interfaces gets deprecated.

I’ll send a PR to upstream for the bigip_command module. If there are any others you would like to see sooner rather than later, lemme know.

My initial work has been around more of the bootstrapping portions of the process as apparently that’s not an entirely clear process. I’ve been cycling through virtual editions like its going out of style too, so to start with bootstrapping just seemed to fit (if your standing them up and tearing them down all day…why not automate it…)

Moving forward I’m honestly open to suggestion. If you think a specific set of functionality would best be encapsulated in a role or module, let’s have that discussion and see what comes of it.

Feel free to ping me off list, or reach out on DevCentral or on github.

Thanks!
-tim

5

Jumping on your thread here slightly, but you asked for suggestions…

Would definitely be interested in a module that would let us automate updating iRules.

I’ve not dug into this as much as I would like yet so maybe there’s already a way to do this (perhaps templating then using URI to talk to the rest api)?

Jon

6

Hey Jon,

I can see a module existing for this as I have a module that does semi-similar operations for iApps. Would your usage of the iRules include templating content to it? If you could imagine it operating in the same way that the ansible template module does (specify a local template that is sent to the remote machine) but with other BIG-IP considerations taken into account.

Lemme know.

Maybe you can contact me off-list with iRule examples that I could use for test cases?

Thanks,
-tim