topic Re: ansible_checkpoint_domain does not change while looping through domains in Ansible

ansible_checkpoint_domain does not change while looping through domains

nhfoste — Wed, 01 Jun 2022 20:08:46 GMT

Hello,

I'm using cp_mgmt_install_policy in the Check_Point.Mgmt collection to install policy to a specified list of domains in our MDS environment.

I've tried specifying ansible_checkpoint_domain in both the inventory file and also within the playbook.

Both solutions work fine on the first domain, but the httpapi session does not honor the updated ansible_checkpoint_domain variable and repeatedly installs policy on the first domain with each loop iteration.

Is there a work around for this?

Re: ansible_checkpoint_domain does not change while looping through domains

PhoneBoy — Fri, 03 Jun 2022 04:18:50 GMT

What is your precise playbook?
Keep in mind that each domain requires a separate login/session to execute commands on it.
If your playbook isn’t built with that in mind, then it will probably fail.

Re: ansible_checkpoint_domain does not change while looping through domains

nhfoste — Fri, 03 Jun 2022 14:55:29 GMT

Essentially, the main task is:

- name: Set domain

set_fact:

domain_names: ["CMA1", "CMA2", "CMA3"]

- include_tasks: ./single_install.yml

loop: "{{ domain_names }}"

And single_install.yml is:

- name: verify policy

cp_mgmt_verify_policy:

policy_package: standard

vars:

ansible_checkpoint_domain: {{ item }}

It doesn't fail, it just runs on the first domain only, and I do see it log in/out of the same domain for each iteration.

Also, I've tried using a list of hosts in the inventory:

[cmas]
cma1 ansible_host=p1lab.corp.com ansible_checkpoint_domain=cma1
cma2 ansible_host=p1lab.corp.com ansible_checkpoint_domain=cma2
cma3 ansible_host=p1lab.corp.com ansible_checkpoint_domain=cma3

With the same result, it only runs on the first domain, but 3 times...

Re: ansible_checkpoint_domain does not change while looping through domains

PhoneBoy — Fri, 03 Jun 2022 16:34:24 GMT

I don't see anything in your playbook that says you are logging into each domain before you execute the relevant task(s) on that domain.
I'll admit, I'm not familiar with how to do that in Ansible, but this is how it works with the API.

Re: ansible_checkpoint_domain does not change while looping through domains

nhfoste — Fri, 03 Jun 2022 16:52:56 GMT

That's the beauty of the collection IMO, login/logout etc is handled by one task that calls the module.

Automate your management server using "Ansible" (checkpoint.com)

The problem though is once the httpapi session is built it doesn't seem possible to modify the ansible_checkpoint_domain setting to switch between domains.

Re: ansible_checkpoint_domain does not change while looping through domains

nhfoste — Wed, 15 Jun 2022 19:02:04 GMT

As an update, The key to cycling through domains using the inventory is to specify 'serial=1' before beginning the httpapi session.

But doesn't it resolve the issue when trying to loop through an array of domains within the playbook.