D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
lib
/
python2.7
/
site-packages
/
ansible
/
modules
/
cloud
/
amazon
/
Filename :
elb_classic_lb.py
back
Copy
#!/usr/bin/python # Copyright: Ansible Project # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) from __future__ import absolute_import, division, print_function __metaclass__ = type ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ['preview'], 'supported_by': 'community'} DOCUMENTATION = """ --- module: elb_classic_lb description: - Returns information about the load balancer. - Will be marked changed when called only if state is changed. short_description: Creates or destroys Amazon ELB. version_added: "2.4" author: - "Jim Dalton (@jsdalton)" options: state: description: - Create or destroy the ELB choices: ["present", "absent"] required: true name: description: - The name of the ELB required: true listeners: description: - List of ports/protocols for this ELB to listen on (see example) purge_listeners: description: - Purge existing listeners on ELB that are not found in listeners type: bool default: 'yes' instance_ids: description: - List of instance ids to attach to this ELB version_added: "2.1" purge_instance_ids: description: - Purge existing instance ids on ELB that are not found in instance_ids type: bool default: 'no' version_added: "2.1" zones: description: - List of availability zones to enable on this ELB purge_zones: description: - Purge existing availability zones on ELB that are not found in zones type: bool default: 'no' security_group_ids: description: - A list of security groups to apply to the elb version_added: "1.6" security_group_names: description: - A list of security group names to apply to the elb version_added: "2.0" health_check: description: - An associative array of health check configuration settings (see example) access_logs: description: - An associative array of access logs configuration settings (see example) version_added: "2.0" subnets: description: - A list of VPC subnets to use when creating ELB. Zones should be empty if using this. version_added: "1.7" purge_subnets: description: - Purge existing subnet on ELB that are not found in subnets type: bool default: 'no' version_added: "1.7" scheme: description: - The scheme to use when creating the ELB. For a private VPC-visible ELB use 'internal'. If you choose to update your scheme with a different value the ELB will be destroyed and recreated. To update scheme you must use the option wait. choices: ["internal", "internet-facing"] default: 'internet-facing' version_added: "1.7" validate_certs: description: - When set to C(no), SSL certificates will not be validated for boto versions >= 2.6.0. type: bool default: 'yes' version_added: "1.5" connection_draining_timeout: description: - Wait a specified timeout allowing connections to drain before terminating an instance version_added: "1.8" idle_timeout: description: - ELB connections from clients and to servers are timed out after this amount of time version_added: "2.0" cross_az_load_balancing: description: - Distribute load across all configured Availability Zones type: bool default: 'no' version_added: "1.8" stickiness: description: - An associative array of stickiness policy settings. Policy will be applied to all listeners ( see example ) version_added: "2.0" wait: description: - When specified, Ansible will check the status of the load balancer to ensure it has been successfully removed from AWS. type: bool default: 'no' version_added: "2.1" wait_timeout: description: - Used in conjunction with wait. Number of seconds to wait for the elb to be terminated. A maximum of 600 seconds (10 minutes) is allowed. default: 60 version_added: "2.1" tags: description: - An associative array of tags. To delete all tags, supply an empty dict. version_added: "2.1" extends_documentation_fragment: - aws - ec2 """ EXAMPLES = """ # Note: None of these examples set aws_access_key, aws_secret_key, or region. # It is assumed that their matching environment variables are set. # Basic provisioning example (non-VPC) - elb_classic_lb: name: "test-please-delete" state: present zones: - us-east-1a - us-east-1d listeners: - protocol: http # options are http, https, ssl, tcp load_balancer_port: 80 instance_port: 80 proxy_protocol: True - protocol: https load_balancer_port: 443 instance_protocol: http # optional, defaults to value of protocol setting instance_port: 80 # ssl certificate required for https or ssl ssl_certificate_id: "arn:aws:iam::123456789012:server-certificate/company/servercerts/ProdServerCert" delegate_to: localhost # Internal ELB example - elb_classic_lb: name: "test-vpc" scheme: internal state: present instance_ids: - i-abcd1234 purge_instance_ids: true subnets: - subnet-abcd1234 - subnet-1a2b3c4d listeners: - protocol: http # options are http, https, ssl, tcp load_balancer_port: 80 instance_port: 80 delegate_to: localhost # Configure a health check and the access logs - elb_classic_lb: name: "test-please-delete" state: present zones: - us-east-1d listeners: - protocol: http load_balancer_port: 80 instance_port: 80 health_check: ping_protocol: http # options are http, https, ssl, tcp ping_port: 80 ping_path: "/index.html" # not required for tcp or ssl response_timeout: 5 # seconds interval: 30 # seconds unhealthy_threshold: 2 healthy_threshold: 10 access_logs: interval: 5 # minutes (defaults to 60) s3_location: "my-bucket" # This value is required if access_logs is set s3_prefix: "logs" delegate_to: localhost # Ensure ELB is gone - elb_classic_lb: name: "test-please-delete" state: absent delegate_to: localhost # Ensure ELB is gone and wait for check (for default timeout) - elb_classic_lb: name: "test-please-delete" state: absent wait: yes delegate_to: localhost # Ensure ELB is gone and wait for check with timeout value - elb_classic_lb: name: "test-please-delete" state: absent wait: yes wait_timeout: 600 delegate_to: localhost # Normally, this module will purge any listeners that exist on the ELB # but aren't specified in the listeners parameter. If purge_listeners is # false it leaves them alone - elb_classic_lb: name: "test-please-delete" state: present zones: - us-east-1a - us-east-1d listeners: - protocol: http load_balancer_port: 80 instance_port: 80 purge_listeners: no delegate_to: localhost # Normally, this module will leave availability zones that are enabled # on the ELB alone. If purge_zones is true, then any extraneous zones # will be removed - elb_classic_lb: name: "test-please-delete" state: present zones: - us-east-1a - us-east-1d listeners: - protocol: http load_balancer_port: 80 instance_port: 80 purge_zones: yes delegate_to: localhost # Creates a ELB and assigns a list of subnets to it. - elb_classic_lb: state: present name: 'New ELB' security_group_ids: 'sg-123456, sg-67890' region: us-west-2 subnets: 'subnet-123456,subnet-67890' purge_subnets: yes listeners: - protocol: http load_balancer_port: 80 instance_port: 80 delegate_to: localhost # Create an ELB with connection draining, increased idle timeout and cross availability # zone load balancing - elb_classic_lb: name: "New ELB" state: present connection_draining_timeout: 60 idle_timeout: 300 cross_az_load_balancing: "yes" region: us-east-1 zones: - us-east-1a - us-east-1d listeners: - protocol: http load_balancer_port: 80 instance_port: 80 delegate_to: localhost # Create an ELB with load balancer stickiness enabled - elb_classic_lb: name: "New ELB" state: present region: us-east-1 zones: - us-east-1a - us-east-1d listeners: - protocol: http load_balancer_port: 80 instance_port: 80 stickiness: type: loadbalancer enabled: yes expiration: 300 delegate_to: localhost # Create an ELB with application stickiness enabled - elb_classic_lb: name: "New ELB" state: present region: us-east-1 zones: - us-east-1a - us-east-1d listeners: - protocol: http load_balancer_port: 80 instance_port: 80 stickiness: type: application enabled: yes cookie: SESSIONID delegate_to: localhost # Create an ELB and add tags - elb_classic_lb: name: "New ELB" state: present region: us-east-1 zones: - us-east-1a - us-east-1d listeners: - protocol: http load_balancer_port: 80 instance_port: 80 tags: Name: "New ELB" stack: "production" client: "Bob" delegate_to: localhost # Delete all tags from an ELB - elb_classic_lb: name: "New ELB" state: present region: us-east-1 zones: - us-east-1a - us-east-1d listeners: - protocol: http load_balancer_port: 80 instance_port: 80 tags: {} delegate_to: localhost """ import random import time import traceback try: import boto import boto.ec2.elb import boto.ec2.elb.attributes import boto.vpc from boto.ec2.elb.healthcheck import HealthCheck from boto.ec2.tag import Tag HAS_BOTO = True except ImportError: HAS_BOTO = False from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.ec2 import ec2_argument_spec, connect_to_aws, AnsibleAWSError, get_aws_connection_info from ansible.module_utils.six import string_types from ansible.module_utils._text import to_native def _throttleable_operation(max_retries): def _operation_wrapper(op): def _do_op(*args, **kwargs): retry = 0 while True: try: return op(*args, **kwargs) except boto.exception.BotoServerError as e: if retry < max_retries and e.code in \ ("Throttling", "RequestLimitExceeded"): retry = retry + 1 time.sleep(min(random.random() * (2 ** retry), 300)) continue else: raise return _do_op return _operation_wrapper def _get_vpc_connection(module, region, aws_connect_params): try: return connect_to_aws(boto.vpc, region, **aws_connect_params) except (boto.exception.NoAuthHandlerFound, AnsibleAWSError) as e: module.fail_json(msg=str(e)) _THROTTLING_RETRIES = 5 class ElbManager(object): """Handles ELB creation and destruction""" def __init__(self, module, name, listeners=None, purge_listeners=None, zones=None, purge_zones=None, security_group_ids=None, health_check=None, subnets=None, purge_subnets=None, scheme="internet-facing", connection_draining_timeout=None, idle_timeout=None, cross_az_load_balancing=None, access_logs=None, stickiness=None, wait=None, wait_timeout=None, tags=None, region=None, instance_ids=None, purge_instance_ids=None, **aws_connect_params): self.module = module self.name = name self.listeners = listeners self.purge_listeners = purge_listeners self.instance_ids = instance_ids self.purge_instance_ids = purge_instance_ids self.zones = zones self.purge_zones = purge_zones self.security_group_ids = security_group_ids self.health_check = health_check self.subnets = subnets self.purge_subnets = purge_subnets self.scheme = scheme self.connection_draining_timeout = connection_draining_timeout self.idle_timeout = idle_timeout self.cross_az_load_balancing = cross_az_load_balancing self.access_logs = access_logs self.stickiness = stickiness self.wait = wait self.wait_timeout = wait_timeout self.tags = tags self.aws_connect_params = aws_connect_params self.region = region self.changed = False self.status = 'gone' self.elb_conn = self._get_elb_connection() try: self.elb = self._get_elb() except boto.exception.BotoServerError as e: module.fail_json(msg='unable to get all load balancers: %s' % e.message, exception=traceback.format_exc()) self.ec2_conn = self._get_ec2_connection() @_throttleable_operation(_THROTTLING_RETRIES) def ensure_ok(self): """Create the ELB""" if not self.elb: # Zones and listeners will be added at creation self._create_elb() else: if self._get_scheme(): # the only way to change the scheme is by recreating the resource self.ensure_gone() self._create_elb() else: self._set_zones() self._set_security_groups() self._set_elb_listeners() self._set_subnets() self._set_health_check() # boto has introduced support for some ELB attributes in # different versions, so we check first before trying to # set them to avoid errors if self._check_attribute_support('connection_draining'): self._set_connection_draining_timeout() if self._check_attribute_support('connecting_settings'): self._set_idle_timeout() if self._check_attribute_support('cross_zone_load_balancing'): self._set_cross_az_load_balancing() if self._check_attribute_support('access_log'): self._set_access_log() # add sticky options self.select_stickiness_policy() # ensure backend server policies are correct self._set_backend_policies() # set/remove instance ids self._set_instance_ids() self._set_tags() def ensure_gone(self): """Destroy the ELB""" if self.elb: self._delete_elb() if self.wait: elb_removed = self._wait_for_elb_removed() # Unfortunately even though the ELB itself is removed quickly # the interfaces take longer so reliant security groups cannot # be deleted until the interface has registered as removed. elb_interface_removed = self._wait_for_elb_interface_removed() if not (elb_removed and elb_interface_removed): self.module.fail_json(msg='Timed out waiting for removal of load balancer.') def get_info(self): try: check_elb = self.elb_conn.get_all_load_balancers(self.name)[0] except Exception: check_elb = None if not check_elb: info = { 'name': self.name, 'status': self.status, 'region': self.region } else: try: lb_cookie_policy = check_elb.policies.lb_cookie_stickiness_policies[0].__dict__['policy_name'] except Exception: lb_cookie_policy = None try: app_cookie_policy = check_elb.policies.app_cookie_stickiness_policies[0].__dict__['policy_name'] except Exception: app_cookie_policy = None info = { 'name': check_elb.name, 'dns_name': check_elb.dns_name, 'zones': check_elb.availability_zones, 'security_group_ids': check_elb.security_groups, 'status': self.status, 'subnets': self.subnets, 'scheme': check_elb.scheme, 'hosted_zone_name': check_elb.canonical_hosted_zone_name, 'hosted_zone_id': check_elb.canonical_hosted_zone_name_id, 'lb_cookie_policy': lb_cookie_policy, 'app_cookie_policy': app_cookie_policy, 'proxy_policy': self._get_proxy_protocol_policy(), 'backends': self._get_backend_policies(), 'instances': [instance.id for instance in check_elb.instances], 'out_of_service_count': 0, 'in_service_count': 0, 'unknown_instance_state_count': 0, 'region': self.region } # status of instances behind the ELB if info['instances']: info['instance_health'] = [dict( instance_id=instance_state.instance_id, reason_code=instance_state.reason_code, state=instance_state.state ) for instance_state in self.elb_conn.describe_instance_health(self.name)] else: info['instance_health'] = [] # instance state counts: InService or OutOfService if info['instance_health']: for instance_state in info['instance_health']: if instance_state['state'] == "InService": info['in_service_count'] += 1 elif instance_state['state'] == "OutOfService": info['out_of_service_count'] += 1 else: info['unknown_instance_state_count'] += 1 if check_elb.health_check: info['health_check'] = { 'target': check_elb.health_check.target, 'interval': check_elb.health_check.interval, 'timeout': check_elb.health_check.timeout, 'healthy_threshold': check_elb.health_check.healthy_threshold, 'unhealthy_threshold': check_elb.health_check.unhealthy_threshold, } if check_elb.listeners: info['listeners'] = [self._api_listener_as_tuple(l) for l in check_elb.listeners] elif self.status == 'created': # When creating a new ELB, listeners don't show in the # immediately returned result, so just include the # ones that were added info['listeners'] = [self._listener_as_tuple(l) for l in self.listeners] else: info['listeners'] = [] if self._check_attribute_support('connection_draining'): info['connection_draining_timeout'] = int(self.elb_conn.get_lb_attribute(self.name, 'ConnectionDraining').timeout) if self._check_attribute_support('connecting_settings'): info['idle_timeout'] = self.elb_conn.get_lb_attribute(self.name, 'ConnectingSettings').idle_timeout if self._check_attribute_support('cross_zone_load_balancing'): is_cross_az_lb_enabled = self.elb_conn.get_lb_attribute(self.name, 'CrossZoneLoadBalancing') if is_cross_az_lb_enabled: info['cross_az_load_balancing'] = 'yes' else: info['cross_az_load_balancing'] = 'no' # return stickiness info? info['tags'] = self.tags return info @_throttleable_operation(_THROTTLING_RETRIES) def _wait_for_elb_removed(self): polling_increment_secs = 15 max_retries = (self.wait_timeout // polling_increment_secs) status_achieved = False for x in range(0, max_retries): try: self.elb_conn.get_all_lb_attributes(self.name) except (boto.exception.BotoServerError, Exception) as e: if "LoadBalancerNotFound" in e.code: status_achieved = True break else: time.sleep(polling_increment_secs) return status_achieved @_throttleable_operation(_THROTTLING_RETRIES) def _wait_for_elb_interface_removed(self): polling_increment_secs = 15 max_retries = (self.wait_timeout // polling_increment_secs) status_achieved = False elb_interfaces = self.ec2_conn.get_all_network_interfaces( filters={'attachment.instance-owner-id': 'amazon-elb', 'description': 'ELB {0}'.format(self.name)}) for x in range(0, max_retries): for interface in elb_interfaces: try: result = self.ec2_conn.get_all_network_interfaces(interface.id) if result == []: status_achieved = True break else: time.sleep(polling_increment_secs) except (boto.exception.BotoServerError, Exception) as e: if 'InvalidNetworkInterfaceID' in e.code: status_achieved = True break else: self.module.fail_json(msg=to_native(e), exception=traceback.format_exc()) return status_achieved @_throttleable_operation(_THROTTLING_RETRIES) def _get_elb(self): elbs = self.elb_conn.get_all_load_balancers() for elb in elbs: if self.name == elb.name: self.status = 'ok' return elb def _get_elb_connection(self): try: return connect_to_aws(boto.ec2.elb, self.region, **self.aws_connect_params) except (boto.exception.NoAuthHandlerFound, AnsibleAWSError) as e: self.module.fail_json(msg=str(e)) def _get_ec2_connection(self): try: return connect_to_aws(boto.ec2, self.region, **self.aws_connect_params) except (boto.exception.NoAuthHandlerFound, Exception) as e: self.module.fail_json(msg=to_native(e), exception=traceback.format_exc()) @_throttleable_operation(_THROTTLING_RETRIES) def _delete_elb(self): # True if succeeds, exception raised if not result = self.elb_conn.delete_load_balancer(name=self.name) if result: self.changed = True self.status = 'deleted' def _create_elb(self): listeners = [self._listener_as_tuple(l) for l in self.listeners] self.elb = self.elb_conn.create_load_balancer(name=self.name, zones=self.zones, security_groups=self.security_group_ids, complex_listeners=listeners, subnets=self.subnets, scheme=self.scheme) if self.elb: # HACK: Work around a boto bug in which the listeners attribute is # always set to the listeners argument to create_load_balancer, and # not the complex_listeners # We're not doing a self.elb = self._get_elb here because there # might be eventual consistency issues and it doesn't necessarily # make sense to wait until the ELB gets returned from the EC2 API. # This is necessary in the event we hit the throttling errors and # need to retry ensure_ok # See https://github.com/boto/boto/issues/3526 self.elb.listeners = self.listeners self.changed = True self.status = 'created' def _create_elb_listeners(self, listeners): """Takes a list of listener tuples and creates them""" # True if succeeds, exception raised if not self.changed = self.elb_conn.create_load_balancer_listeners(self.name, complex_listeners=listeners) def _delete_elb_listeners(self, listeners): """Takes a list of listener tuples and deletes them from the elb""" ports = [l[0] for l in listeners] # True if succeeds, exception raised if not self.changed = self.elb_conn.delete_load_balancer_listeners(self.name, ports) def _set_elb_listeners(self): """ Creates listeners specified by self.listeners; overwrites existing listeners on these ports; removes extraneous listeners """ listeners_to_add = [] listeners_to_remove = [] listeners_to_keep = [] # Check for any listeners we need to create or overwrite for listener in self.listeners: listener_as_tuple = self._listener_as_tuple(listener) # First we loop through existing listeners to see if one is # already specified for this port existing_listener_found = None for existing_listener in self.elb.listeners: # Since ELB allows only one listener on each incoming port, a # single match on the incoming port is all we're looking for if existing_listener[0] == int(listener['load_balancer_port']): existing_listener_found = self._api_listener_as_tuple(existing_listener) break if existing_listener_found: # Does it match exactly? if listener_as_tuple != existing_listener_found: # The ports are the same but something else is different, # so we'll remove the existing one and add the new one listeners_to_remove.append(existing_listener_found) listeners_to_add.append(listener_as_tuple) else: # We already have this listener, so we're going to keep it listeners_to_keep.append(existing_listener_found) else: # We didn't find an existing listener, so just add the new one listeners_to_add.append(listener_as_tuple) # Check for any extraneous listeners we need to remove, if desired if self.purge_listeners: for existing_listener in self.elb.listeners: existing_listener_tuple = self._api_listener_as_tuple(existing_listener) if existing_listener_tuple in listeners_to_remove: # Already queued for removal continue if existing_listener_tuple in listeners_to_keep: # Keep this one around continue # Since we're not already removing it and we don't need to keep # it, let's get rid of it listeners_to_remove.append(existing_listener_tuple) if listeners_to_remove: self._delete_elb_listeners(listeners_to_remove) if listeners_to_add: self._create_elb_listeners(listeners_to_add) def _api_listener_as_tuple(self, listener): """Adds ssl_certificate_id to ELB API tuple if present""" base_tuple = listener.get_complex_tuple() if listener.ssl_certificate_id and len(base_tuple) < 5: return base_tuple + (listener.ssl_certificate_id,) return base_tuple def _listener_as_tuple(self, listener): """Formats listener as a 4- or 5-tuples, in the order specified by the ELB API""" # N.B. string manipulations on protocols below (str(), upper()) is to # ensure format matches output from ELB API listener_list = [ int(listener['load_balancer_port']), int(listener['instance_port']), str(listener['protocol'].upper()), ] # Instance protocol is not required by ELB API; it defaults to match # load balancer protocol. We'll mimic that behavior here if 'instance_protocol' in listener: listener_list.append(str(listener['instance_protocol'].upper())) else: listener_list.append(str(listener['protocol'].upper())) if 'ssl_certificate_id' in listener: listener_list.append(str(listener['ssl_certificate_id'])) return tuple(listener_list) def _enable_zones(self, zones): try: self.elb.enable_zones(zones) except boto.exception.BotoServerError as e: self.module.fail_json(msg='unable to enable zones: %s' % e.message, exception=traceback.format_exc()) self.changed = True def _disable_zones(self, zones): try: self.elb.disable_zones(zones) except boto.exception.BotoServerError as e: self.module.fail_json(msg='unable to disable zones: %s' % e.message, exception=traceback.format_exc()) self.changed = True def _attach_subnets(self, subnets): self.elb_conn.attach_lb_to_subnets(self.name, subnets) self.changed = True def _detach_subnets(self, subnets): self.elb_conn.detach_lb_from_subnets(self.name, subnets) self.changed = True def _set_subnets(self): """Determine which subnets need to be attached or detached on the ELB""" if self.subnets: if self.purge_subnets: subnets_to_detach = list(set(self.elb.subnets) - set(self.subnets)) subnets_to_attach = list(set(self.subnets) - set(self.elb.subnets)) else: subnets_to_detach = None subnets_to_attach = list(set(self.subnets) - set(self.elb.subnets)) if subnets_to_attach: self._attach_subnets(subnets_to_attach) if subnets_to_detach: self._detach_subnets(subnets_to_detach) def _get_scheme(self): """Determine if the current scheme is different than the scheme of the ELB""" if self.scheme: if self.elb.scheme != self.scheme: if not self.wait: self.module.fail_json(msg="Unable to modify scheme without using the wait option") return True return False def _set_zones(self): """Determine which zones need to be enabled or disabled on the ELB""" if self.zones: if self.purge_zones: zones_to_disable = list(set(self.elb.availability_zones) - set(self.zones)) zones_to_enable = list(set(self.zones) - set(self.elb.availability_zones)) else: zones_to_disable = None zones_to_enable = list(set(self.zones) - set(self.elb.availability_zones)) if zones_to_enable: self._enable_zones(zones_to_enable) # N.B. This must come second, in case it would have removed all zones if zones_to_disable: self._disable_zones(zones_to_disable) def _set_security_groups(self): if self.security_group_ids is not None and set(self.elb.security_groups) != set(self.security_group_ids): self.elb_conn.apply_security_groups_to_lb(self.name, self.security_group_ids) self.changed = True def _set_health_check(self): """Set health check values on ELB as needed""" if self.health_check: # This just makes it easier to compare each of the attributes # and look for changes. Keys are attributes of the current # health_check; values are desired values of new health_check health_check_config = { "target": self._get_health_check_target(), "timeout": self.health_check['response_timeout'], "interval": self.health_check['interval'], "unhealthy_threshold": self.health_check['unhealthy_threshold'], "healthy_threshold": self.health_check['healthy_threshold'], } update_health_check = False # The health_check attribute is *not* set on newly created # ELBs! So we have to create our own. if not self.elb.health_check: self.elb.health_check = HealthCheck() for attr, desired_value in health_check_config.items(): if getattr(self.elb.health_check, attr) != desired_value: setattr(self.elb.health_check, attr, desired_value) update_health_check = True if update_health_check: self.elb.configure_health_check(self.elb.health_check) self.changed = True def _check_attribute_support(self, attr): return hasattr(boto.ec2.elb.attributes.LbAttributes(), attr) def _set_cross_az_load_balancing(self): attributes = self.elb.get_attributes() if self.cross_az_load_balancing: if not attributes.cross_zone_load_balancing.enabled: self.changed = True attributes.cross_zone_load_balancing.enabled = True else: if attributes.cross_zone_load_balancing.enabled: self.changed = True attributes.cross_zone_load_balancing.enabled = False self.elb_conn.modify_lb_attribute(self.name, 'CrossZoneLoadBalancing', attributes.cross_zone_load_balancing.enabled) def _set_access_log(self): attributes = self.elb.get_attributes() if self.access_logs: if 's3_location' not in self.access_logs: self.module.fail_json(msg='s3_location information required') access_logs_config = { "enabled": True, "s3_bucket_name": self.access_logs['s3_location'], "s3_bucket_prefix": self.access_logs.get('s3_prefix', ''), "emit_interval": self.access_logs.get('interval', 60), } update_access_logs_config = False for attr, desired_value in access_logs_config.items(): if getattr(attributes.access_log, attr) != desired_value: setattr(attributes.access_log, attr, desired_value) update_access_logs_config = True if update_access_logs_config: self.elb_conn.modify_lb_attribute(self.name, 'AccessLog', attributes.access_log) self.changed = True elif attributes.access_log.enabled: attributes.access_log.enabled = False self.changed = True self.elb_conn.modify_lb_attribute(self.name, 'AccessLog', attributes.access_log) def _set_connection_draining_timeout(self): attributes = self.elb.get_attributes() if self.connection_draining_timeout is not None: if not attributes.connection_draining.enabled or \ attributes.connection_draining.timeout != self.connection_draining_timeout: self.changed = True attributes.connection_draining.enabled = True attributes.connection_draining.timeout = self.connection_draining_timeout self.elb_conn.modify_lb_attribute(self.name, 'ConnectionDraining', attributes.connection_draining) else: if attributes.connection_draining.enabled: self.changed = True attributes.connection_draining.enabled = False self.elb_conn.modify_lb_attribute(self.name, 'ConnectionDraining', attributes.connection_draining) def _set_idle_timeout(self): attributes = self.elb.get_attributes() if self.idle_timeout is not None: if attributes.connecting_settings.idle_timeout != self.idle_timeout: self.changed = True attributes.connecting_settings.idle_timeout = self.idle_timeout self.elb_conn.modify_lb_attribute(self.name, 'ConnectingSettings', attributes.connecting_settings) def _policy_name(self, policy_type): return 'elb-classic-lb-{0}'.format(to_native(policy_type, errors='surrogate_or_strict')) def _create_policy(self, policy_param, policy_meth, policy): getattr(self.elb_conn, policy_meth)(policy_param, self.elb.name, policy) def _delete_policy(self, elb_name, policy): self.elb_conn.delete_lb_policy(elb_name, policy) def _update_policy(self, policy_param, policy_meth, policy_attr, policy): self._delete_policy(self.elb.name, policy) self._create_policy(policy_param, policy_meth, policy) def _set_listener_policy(self, listeners_dict, policy=None): policy = [] if policy is None else policy for listener_port in listeners_dict: if listeners_dict[listener_port].startswith('HTTP'): self.elb_conn.set_lb_policies_of_listener(self.elb.name, listener_port, policy) def _set_stickiness_policy(self, elb_info, listeners_dict, policy, **policy_attrs): for p in getattr(elb_info.policies, policy_attrs['attr']): if str(p.__dict__['policy_name']) == str(policy[0]): if str(p.__dict__[policy_attrs['dict_key']]) != str(policy_attrs['param_value'] or 0): self._set_listener_policy(listeners_dict) self._update_policy(policy_attrs['param_value'], policy_attrs['method'], policy_attrs['attr'], policy[0]) self.changed = True break else: self._create_policy(policy_attrs['param_value'], policy_attrs['method'], policy[0]) self.changed = True self._set_listener_policy(listeners_dict, policy) def select_stickiness_policy(self): if self.stickiness: if 'cookie' in self.stickiness and 'expiration' in self.stickiness: self.module.fail_json(msg='\'cookie\' and \'expiration\' can not be set at the same time') elb_info = self.elb_conn.get_all_load_balancers(self.elb.name)[0] d = {} for listener in elb_info.listeners: d[listener[0]] = listener[2] listeners_dict = d if self.stickiness['type'] == 'loadbalancer': policy = [] policy_type = 'LBCookieStickinessPolicyType' if self.module.boolean(self.stickiness['enabled']): if 'expiration' not in self.stickiness: self.module.fail_json(msg='expiration must be set when type is loadbalancer') try: expiration = self.stickiness['expiration'] if int(self.stickiness['expiration']) else None except ValueError: self.module.fail_json(msg='expiration must be set to an integer') policy_attrs = { 'type': policy_type, 'attr': 'lb_cookie_stickiness_policies', 'method': 'create_lb_cookie_stickiness_policy', 'dict_key': 'cookie_expiration_period', 'param_value': expiration } policy.append(self._policy_name(policy_attrs['type'])) self._set_stickiness_policy(elb_info, listeners_dict, policy, **policy_attrs) elif not self.module.boolean(self.stickiness['enabled']): if len(elb_info.policies.lb_cookie_stickiness_policies): if elb_info.policies.lb_cookie_stickiness_policies[0].policy_name == self._policy_name(policy_type): self.changed = True else: self.changed = False self._set_listener_policy(listeners_dict) self._delete_policy(self.elb.name, self._policy_name(policy_type)) elif self.stickiness['type'] == 'application': policy = [] policy_type = 'AppCookieStickinessPolicyType' if self.module.boolean(self.stickiness['enabled']): if 'cookie' not in self.stickiness: self.module.fail_json(msg='cookie must be set when type is application') policy_attrs = { 'type': policy_type, 'attr': 'app_cookie_stickiness_policies', 'method': 'create_app_cookie_stickiness_policy', 'dict_key': 'cookie_name', 'param_value': self.stickiness['cookie'] } policy.append(self._policy_name(policy_attrs['type'])) self._set_stickiness_policy(elb_info, listeners_dict, policy, **policy_attrs) elif not self.module.boolean(self.stickiness['enabled']): if len(elb_info.policies.app_cookie_stickiness_policies): if elb_info.policies.app_cookie_stickiness_policies[0].policy_name == self._policy_name(policy_type): self.changed = True self._set_listener_policy(listeners_dict) self._delete_policy(self.elb.name, self._policy_name(policy_type)) else: self._set_listener_policy(listeners_dict) def _get_backend_policies(self): """Get a list of backend policies""" policies = [] if self.elb.backends is not None: for backend in self.elb.backends: if backend.policies is not None: for policy in backend.policies: policies.append(str(backend.instance_port) + ':' + policy.policy_name) return policies def _set_backend_policies(self): """Sets policies for all backends""" ensure_proxy_protocol = False replace = [] backend_policies = self._get_backend_policies() # Find out what needs to be changed for listener in self.listeners: want = False if 'proxy_protocol' in listener and listener['proxy_protocol']: ensure_proxy_protocol = True want = True if str(listener['instance_port']) + ':ProxyProtocol-policy' in backend_policies: if not want: replace.append({'port': listener['instance_port'], 'policies': []}) elif want: replace.append({'port': listener['instance_port'], 'policies': ['ProxyProtocol-policy']}) # enable or disable proxy protocol if ensure_proxy_protocol: self._set_proxy_protocol_policy() # Make the backend policies so for item in replace: self.elb_conn.set_lb_policies_of_backend_server(self.elb.name, item['port'], item['policies']) self.changed = True def _get_proxy_protocol_policy(self): """Find out if the elb has a proxy protocol enabled""" if self.elb.policies is not None and self.elb.policies.other_policies is not None: for policy in self.elb.policies.other_policies: if policy.policy_name == 'ProxyProtocol-policy': return policy.policy_name return None def _set_proxy_protocol_policy(self): """Install a proxy protocol policy if needed""" proxy_policy = self._get_proxy_protocol_policy() if proxy_policy is None: self.elb_conn.create_lb_policy( self.elb.name, 'ProxyProtocol-policy', 'ProxyProtocolPolicyType', {'ProxyProtocol': True} ) self.changed = True # TODO: remove proxy protocol policy if not needed anymore? There is no side effect to leaving it there def _diff_list(self, a, b): """Find the entries in list a that are not in list b""" b = set(b) return [aa for aa in a if aa not in b] def _get_instance_ids(self): """Get the current list of instance ids installed in the elb""" instances = [] if self.elb.instances is not None: for instance in self.elb.instances: instances.append(instance.id) return instances def _set_instance_ids(self): """Register or deregister instances from an lb instance""" assert_instances = self.instance_ids or [] has_instances = self._get_instance_ids() add_instances = self._diff_list(assert_instances, has_instances) if add_instances: self.elb_conn.register_instances(self.elb.name, add_instances) self.changed = True if self.purge_instance_ids: remove_instances = self._diff_list(has_instances, assert_instances) if remove_instances: self.elb_conn.deregister_instances(self.elb.name, remove_instances) self.changed = True def _set_tags(self): """Add/Delete tags""" if self.tags is None: return params = {'LoadBalancerNames.member.1': self.name} tagdict = dict() # get the current list of tags from the ELB, if ELB exists if self.elb: current_tags = self.elb_conn.get_list('DescribeTags', params, [('member', Tag)]) tagdict = dict((tag.Key, tag.Value) for tag in current_tags if hasattr(tag, 'Key')) # Add missing tags dictact = dict(set(self.tags.items()) - set(tagdict.items())) if dictact: for i, key in enumerate(dictact): params['Tags.member.%d.Key' % (i + 1)] = key params['Tags.member.%d.Value' % (i + 1)] = dictact[key] self.elb_conn.make_request('AddTags', params) self.changed = True # Remove extra tags dictact = dict(set(tagdict.items()) - set(self.tags.items())) if dictact: for i, key in enumerate(dictact): params['Tags.member.%d.Key' % (i + 1)] = key self.elb_conn.make_request('RemoveTags', params) self.changed = True def _get_health_check_target(self): """Compose target string from healthcheck parameters""" protocol = self.health_check['ping_protocol'].upper() path = "" if protocol in ['HTTP', 'HTTPS'] and 'ping_path' in self.health_check: path = self.health_check['ping_path'] return "%s:%s%s" % (protocol, self.health_check['ping_port'], path) def main(): argument_spec = ec2_argument_spec() argument_spec.update(dict( state={'required': True, 'choices': ['present', 'absent']}, name={'required': True}, listeners={'default': None, 'required': False, 'type': 'list'}, purge_listeners={'default': True, 'required': False, 'type': 'bool'}, instance_ids={'default': None, 'required': False, 'type': 'list'}, purge_instance_ids={'default': False, 'required': False, 'type': 'bool'}, zones={'default': None, 'required': False, 'type': 'list'}, purge_zones={'default': False, 'required': False, 'type': 'bool'}, security_group_ids={'default': None, 'required': False, 'type': 'list'}, security_group_names={'default': None, 'required': False, 'type': 'list'}, health_check={'default': None, 'required': False, 'type': 'dict'}, subnets={'default': None, 'required': False, 'type': 'list'}, purge_subnets={'default': False, 'required': False, 'type': 'bool'}, scheme={'default': 'internet-facing', 'required': False, 'choices': ['internal', 'internet-facing']}, connection_draining_timeout={'default': None, 'required': False, 'type': 'int'}, idle_timeout={'default': None, 'type': 'int', 'required': False}, cross_az_load_balancing={'default': None, 'type': 'bool', 'required': False}, stickiness={'default': None, 'required': False, 'type': 'dict'}, access_logs={'default': None, 'required': False, 'type': 'dict'}, wait={'default': False, 'type': 'bool', 'required': False}, wait_timeout={'default': 60, 'type': 'int', 'required': False}, tags={'default': None, 'required': False, 'type': 'dict'} ) ) module = AnsibleModule( argument_spec=argument_spec, mutually_exclusive=[['security_group_ids', 'security_group_names']] ) if not HAS_BOTO: module.fail_json(msg='boto required for this module') region, ec2_url, aws_connect_params = get_aws_connection_info(module) if not region: module.fail_json(msg="Region must be specified as a parameter, in EC2_REGION or AWS_REGION environment variables or in boto configuration file") name = module.params['name'] state = module.params['state'] listeners = module.params['listeners'] purge_listeners = module.params['purge_listeners'] instance_ids = module.params['instance_ids'] purge_instance_ids = module.params['purge_instance_ids'] zones = module.params['zones'] purge_zones = module.params['purge_zones'] security_group_ids = module.params['security_group_ids'] security_group_names = module.params['security_group_names'] health_check = module.params['health_check'] access_logs = module.params['access_logs'] subnets = module.params['subnets'] purge_subnets = module.params['purge_subnets'] scheme = module.params['scheme'] connection_draining_timeout = module.params['connection_draining_timeout'] idle_timeout = module.params['idle_timeout'] cross_az_load_balancing = module.params['cross_az_load_balancing'] stickiness = module.params['stickiness'] wait = module.params['wait'] wait_timeout = module.params['wait_timeout'] tags = module.params['tags'] if state == 'present' and not listeners: module.fail_json(msg="At least one listener is required for ELB creation") if state == 'present' and not (zones or subnets): module.fail_json(msg="At least one availability zone or subnet is required for ELB creation") if wait_timeout > 600: module.fail_json(msg='wait_timeout maximum is 600 seconds') if security_group_names: security_group_ids = [] try: ec2 = connect_to_aws(boto.ec2, region, **aws_connect_params) if subnets: # We have at least one subnet, ergo this is a VPC vpc_conn = _get_vpc_connection(module=module, region=region, aws_connect_params=aws_connect_params) vpc_id = vpc_conn.get_all_subnets([subnets[0]])[0].vpc_id filters = {'vpc_id': vpc_id} else: filters = None grp_details = ec2.get_all_security_groups(filters=filters) for group_name in security_group_names: if isinstance(group_name, string_types): group_name = [group_name] group_id = [str(grp.id) for grp in grp_details if str(grp.name) in group_name] security_group_ids.extend(group_id) except boto.exception.NoAuthHandlerFound as e: module.fail_json(msg=str(e)) elb_man = ElbManager(module, name, listeners, purge_listeners, zones, purge_zones, security_group_ids, health_check, subnets, purge_subnets, scheme, connection_draining_timeout, idle_timeout, cross_az_load_balancing, access_logs, stickiness, wait, wait_timeout, tags, region=region, instance_ids=instance_ids, purge_instance_ids=purge_instance_ids, **aws_connect_params) # check for unsupported attributes for this version of boto if cross_az_load_balancing and not elb_man._check_attribute_support('cross_zone_load_balancing'): module.fail_json(msg="You must install boto >= 2.18.0 to use the cross_az_load_balancing attribute") if connection_draining_timeout and not elb_man._check_attribute_support('connection_draining'): module.fail_json(msg="You must install boto >= 2.28.0 to use the connection_draining_timeout attribute") if idle_timeout and not elb_man._check_attribute_support('connecting_settings'): module.fail_json(msg="You must install boto >= 2.33.0 to use the idle_timeout attribute") if state == 'present': elb_man.ensure_ok() elif state == 'absent': elb_man.ensure_gone() ansible_facts = {'ec2_elb': 'info'} ec2_facts_result = dict(changed=elb_man.changed, elb=elb_man.get_info(), ansible_facts=ansible_facts) module.exit_json(**ec2_facts_result) if __name__ == '__main__': main()