ansible_checkpoint_domain does not change while looping through domains

[nhfoste]

Hello,

I'm using cp_mgmt_install_policy in the Check_Point.Mgmt collection to install policy to a specified list of domains in our MDS environment. 

I've tried specifying ansible_checkpoint_domain in both the inventory file and also within the playbook.

Both solutions work fine on the first domain, but the httpapi session does not honor the updated ansible_checkpoint_domain variable and repeatedly installs policy on the first domain with each loop iteration.

Is there a work around for this?

[PhoneBoy]

What is your precise playbook?
Keep in mind that each domain requires a separate login/session to execute commands on it.
If your playbook isn’t built with that in mind, then it will probably fail.

[nhfoste]

Essentially, the main task is:

- name: Set domain

  set_fact:

  domain_names: ["CMA1", "CMA2", "CMA3"]

- include_tasks: ./single_install.yml

  loop: "{{ domain_names }}"

And single_install.yml is:

- name: verify policy

  cp_mgmt_verify_policy:

    policy_package: standard

  vars:

    ansible_checkpoint_domain: {{ item }}

It doesn't fail, it just runs on the first domain only, and I do see it log in/out of the same domain for each iteration.

Also, I've tried using a list of hosts in the inventory:

[cmas]
cma1 ansible_host=p1lab.corp.com ansible_checkpoint_domain=cma1
cma2 ansible_host=p1lab.corp.com ansible_checkpoint_domain=cma2
cma3 ansible_host=p1lab.corp.com ansible_checkpoint_domain=cma3

With the same result, it only runs on the first domain, but 3 times...

[PhoneBoy]

I don't see anything in your playbook that says you are logging into each domain before you execute the relevant task(s) on that domain.
I'll admit, I'm not familiar with how to do that in Ansible, but this is how it works with the API.

[nhfoste]

That's the beauty of the collection IMO, login/logout etc is handled by one task that calls the module.

Automate your management server using "Ansible" (checkpoint.com)

The problem though is once the httpapi session is built it doesn't seem possible to modify the ansible_checkpoint_domain setting to switch between domains.

[nhfoste]

As an update, The key to cycling through domains using the inventory is to specify 'serial=1' before beginning the httpapi session.

But doesn't it resolve the issue when trying to loop through an array of domains within the playbook.