Itential Automation GatewayAnsible

Ansible F5 device provider object

When monitoring and configuring F5 (also referred to as F5 BIG-IP) network devices via Ansible, a provider dictionary object that contains connection information and credentials is required to access a device. The object is passed as an argument to the Ansible modules (e.g., bigip_command, bigip_config) that manage the device. When using the Automation Gateway module execution API to run Ansible bigip modules, the provider object is required to be in JSON format. Below is the JSON schema for the provider object found in the F5-BIGiP module decorations certified by Itential. Additional information about the provider object can be found in the Ansible documentation.

1"provider": {
2                "description": "A dictionary object containing connection details.",
3                "type": "object",
4                "properties": {
5                    "password": {
6                        "description": "The password for the user account used to connect to the BIG-IP. You can omit this option if the environment variable C(F5_PASSWORD) is set.",
7                        "type": "string"
8                    },
9                    "server": {
10                        "description": "The BIG-IP host. You can omit this option if the environment variable C(F5_SERVER is set.",
11                        "type": "string"
12                    },
13                    "server_port": {
14                        "description": "The BIG-IP server port. You can omit this option if the environment variable C(F5_SERVER_PORT) is set.",
15                        "default": 443,
16                        "type": "integer"
17                    },
18                    "user": {
19                        "description": "The username to connect to the BIG-IP with. This user must have administrative privileges on the device. You can omit this option if the environment variable C(F5_USER) is set.",
20                        "type": "string"
21                    },
22                    "validate_certs": {
23                        "description": "If C(no), SSL certificates will not be validated. Use this only on personally controlled sites using self-signed certificates. You can omit this option if the environment variable C(F5_VALIDATE_CERTS) is set.",
24                        "default": true,
25                        "type": "boolean"
26                    },
27                    "timeout": {
28                        "description": "Specifies the timeout in seconds for communicating with the network device for either connecting or sending commands.  If the timeout is exceeded before the operation is completed, the module will error.",
29                        "default": 10,
30                        "type": "integer"
31                    },
32                    "ssh_keyfile": {
33                        "description": "Specifies the SSH keyfile to use to authenticate the connection to the remote device.  This argument is only used for I(cli) transports. If the value is not specified in the task, the value of environment variable C(ANSIBLE_NET_SSH_KEYFILE) will be used instead.",
34                        "type": "string"
35                    },
36                    "transport": {
37                        "description": "Configures the transport connection to use when connecting to the remote device.",
38                        "default": "rest",
39                        "type": "string",
40                        "enum": [
41                            "cli",
42                            "rest"
43                        ]
44                    }
45                },
46                "anyOf": [
47                    {"required": ["password"]},
48                    {"required": ["ssh_keyfile"]}
49                ],
50                "required": [
51                    "server",
52                    "user"
53                ]
54            }

ansible_provider inventory variable

Starting in release 2019.3, in addition to support for Ansible connection inventory variables (e.g., ansible_host, ansible_connection, ansible_network_os), support has been added for the Automation Gateway specific inventory variable ansible_provider. This variable is of type object and supports the exact same fields as the F5 provider object shown in the JSON schema. Like all other inventory variables, this variable is added when configuring a device using the AG device APIs, or included in the Ansible device inventory file when running in external inventory mode.

Sample F5 device inventory configuration

1{
2    "name": "f5_host",
3    "variables": {
4        "ansible_connection": "local",
5        "ansible_network_os": "bigip",
6        "ansible_provider": {
7            "server": "bigip01-host",
8            "user": "sample_user",
9            "password": "sample_password",
10            "validate_certs": false
11        },
12        "ansible_host": "bigip01-host"
13    }
14}

In order to avoid AG clients having to include a JSON provider object for each F5-BIGIP module execution, AG will automatically construct the object using the contents of the ansible_provider inventory variable fields and add it as a module execution argument. The ansible_network_os variable must be set to bigip and be present at the host level for this conversion to occur. If a provider object is already present as a module argument, the contents of the argument will be used instead of the contents of the host’s ansible_provider inventory variable.

When managing F5 devices via the Itential provided roles (e.g., itential_cli, itential_get_config), the ansible_provider inventory variable must be configured for the F5 devices that are present in the hosts parameter of the Automation Gateway role execution API.

Sample INI inventory file with ansible_provider variable

The variable ansible_provider must be a valid JSON string passed in single quotes (').

1[F5_Group]
2F5_device1 ansible_host=172.20.100.53 ansible_connection=local ansible_network_os=bigip ansible_provider='{"server":"172.20.100.53","user":"admin","password":"admin","validate_certs":false}'

Sample F5 module execution request

1{"hosts":["f5_host"],"args":{"commands":["show sys clock"]}}

Sample F5 module execution response

1[
2    {
3        "module": "bigip_command",
4        "task": "bigip_command",
5        "host": "f5_host",
6        "status": "SUCCESS",
7        "argument_warnings": null,
8        "results": {
9            "executed_commands": [
10                "tmsh -c \\\"show sys clock\\\""
11            ],
12            "changed": false,
13            "stdout": [
14                "----------------------------\nSys::Clock\n----------------------------\nMon Dec 02 17:25:39 EST 2019"
15            ],
16            "stdout_lines": [
17                [
18                    "----------------------------",
19                    "Sys::Clock",
20                    "----------------------------",
21                    "Mon Dec 02 17:25:39 EST 2019"
22                ]
23            ]
24        }
25    }
26]