Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
nhfoste
Explorer

ansible_checkpoint_domain does not change while looping through domains

Hello,

I'm using cp_mgmt_install_policy in the Check_Point.Mgmt collection to install policy to a specified list of domains in our MDS environment. 

I've tried specifying ansible_checkpoint_domain in both the inventory file and also within the playbook.

Both solutions work fine on the first domain, but the httpapi session does not honor the updated ansible_checkpoint_domain variable and repeatedly installs policy on the first domain with each loop iteration.

Is there a work around for this?

0 Kudos
5 Replies
PhoneBoy
Admin
Admin

What is your precise playbook?
Keep in mind that each domain requires a separate login/session to execute commands on it.
If your playbook isn’t built with that in mind, then it will probably fail.

0 Kudos
nhfoste
Explorer

Essentially, the main task is:

- name: Set domain
  set_fact:
  domain_names: ["CMA1", "CMA2", "CMA3"]

- include_tasks: ./single_install.yml
  loop: "{{ domain_names }}"
 
And single_install.yml is:
 
- name: verify policy
  cp_mgmt_verify_policy:
    policy_package: standard
 
  vars:
    ansible_checkpoint_domain: {{ item }}
 
It doesn't fail, it just runs on the first domain only, and I do see it log in/out of the same domain for each iteration.
 
Also, I've tried using a list of hosts in the inventory:
[cmas]
cma1 ansible_host=p1lab.corp.com ansible_checkpoint_domain=cma1
cma2 ansible_host=p1lab.corp.com ansible_checkpoint_domain=cma2
cma3 ansible_host=p1lab.corp.com ansible_checkpoint_domain=cma3
 
With the same result, it only runs on the first domain, but 3 times...
 
 
 
 
 
 
 
 
 
0 Kudos
PhoneBoy
Admin
Admin

I don't see anything in your playbook that says you are logging into each domain before you execute the relevant task(s) on that domain.
I'll admit, I'm not familiar with how to do that in Ansible, but this is how it works with the API.

0 Kudos
nhfoste
Explorer

That's the beauty of the collection IMO, login/logout etc is handled by one task that calls the module.

Automate your management server using "Ansible" (checkpoint.com)

The problem though is once the httpapi session is built it doesn't seem possible to modify the ansible_checkpoint_domain setting to switch between domains.

 

 

 

0 Kudos
nhfoste
Explorer

As an update, The key to cycling through domains using the inventory is to specify 'serial=1' before beginning the httpapi session.

But doesn't it resolve the issue when trying to loop through an array of domains within the playbook.

 

 

 

 

0 Kudos