vshield

VMware vShield puppet module

Project URL RSS Feed

Module Stats

11,002 downloads

9,173 latest version

3.5 quality score

Version information

released Apr 21st 2015

Start using this module

Installation method

Add this module to your Puppetfile:

mod 'vmware-vshield', '0.5.0'

Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add vmware-vshield

Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install vmware-vshield --version 0.5.0

Tags: vmware, vshield

Documentation

vmware/vshield — version 0.5.0 Apr 21st 2015

VMware vShield module

This module manages resources in VMware vCloud Network and Security 5.1 (vCNS), i.e. vShield.

Description

VMware vCloud Network and Security is deployed via a virtual appliance. The module is able to attach vCNS to a vCenter and manages vCNS 5.1 resources via vShield API through REST.

+------------+         +--------+
|            | vSphere |  vCSA  | <-
|   Puppet   | +-----> +--------+  |
| Management |                     | register
|    Host    | vShield +--------+  |
|            | +-----> |  vCNS  | --
+------------+         +--------+

Installation

$ puppet module install vmware/vshield

Usage

Two transport connection is required for managing vShield resources, since vShield is dependent on a vCenter:

transport { 'vshield':
  username => 'admin',
  password => 'default',
  server   => 'vshield.lab'
}

transport { 'vcenter':
  username => 'root',
  password => 'vmware',
  server   => 'vcenter.lab',
  options  => { 'insecure' => true, },
}

Establishing connection to vCenter is specified by vshield_global_config:

vshield_global_config { 'vshield.lab'
  vc_info   => {
    ip_address => 'vcenter.lab',
    user_name  => 'root',
    password   => 'vmware',
  },
  time_info => { 'ntp_server' => 'us.pool.ntp.org', }
  dns_info  => { 'primary_dns' => '8.8.8.8' },
  transport => Transport['vshield'],
}

The vCenter transport server attribute must match vshield_global_config[vc_info][ip_address] returned by the vShield API. Connectivity to vCenter is necessary to translate resource (such as a datacenter, esx host, or folder name) to vSphere Managed Object Reference (MoRef) required by the vShield API.

vshield_edge can be deployed to compute resource in a datacenter:

vshield_edge { 'vshield.lab:edge_dmz':
  ensure           => present,
  datacenter_name  => 'datacenter_1',
  compute          => 'cluster_dmz_1',
  enable_aesni     => false,
  enable_fips      => false,
  enable_tcp_loose => false,
  vse_log_level    => 'info',
  fqdn             => "edge.dmz.lab",
  transport        => Transport['vshield'],
}

See tests folder for additional examples.

Types in this module release

vshield_global_config

Properties
dns_info
host_info
time_info
vc_info

Providers
vshield_global_config

vshield_vxlan_scope

Parameters
cluster_name
datacenter_name
ensure
name	switch name
provider

Properties
clusters	network scope name

vshield_firewall_default_policy

Manage vShield firewall default policy logging_enabled - whether or not to log when this rule is hit action - accept/reject

Parameters
provider
scope_name	scope name which will be used with scope_type to get/set firewall default policy

Properties
action	this is the action to take, can be either accept or deny, default is deny
logging_enabled	whether or not logging is enabled

Providers
default

vshield_vxlan_multicast

Parameters
begin	multicast start range
desc	multicast description
end	multicast end range
ensure
id	multicast id
name	switch name
provider

vshield_loadbalancer

Properties
enabled	whether or not the load balancing service is enabled

vshield_vxlan_map

Parameters
cluster_name
datacenter_name
ensure
provider
vlan_id	vlan id

Properties
switch	switch id

vshield_syslog

Manage vShield syslog config.

Parameters
host	vShield hostname or ip address.
provider
server_info	no longer implemented, please use syslog_server and port instead

Properties
port	syslog port, defaults to 514
protocol	syslog protocol, valid values are UDP/TCP/UDP6/TCP6, defaults to UDP, only available in > 6.x
syslog_server

Providers
vs_syslog

vshield_vxlan_switch

vshield_loadbalancer_vip

Manage vShield loadbalancers vips

Parameters
ensure
name	loadbalancer name
provider
scope_name	scope name which will be used with scope_type to get/set loadbalancers

Properties
application_profile	these are applications that define the protocol/persistence that the vip will use
ip_address	ip address to use for the vip
pool	this is the name of the pool that is used for the vip

Providers
default

vshield_edge_syslog

Manage vShield edge syslog config

Parameters
provider
scope_name	edge name, as listed in vshield manager ( must match exactly )

Properties
enabled	whether or not enabled, since defaulting to true
protocol	udp/tcp
server_addresses	these are the syslog servers which vshield points to

Providers
default

vshield_ipset

Manage vShield ipsets, these are used by fw rules

Parameters
ensure
inclusive	whether the resource value is inclusive
name	ipset name
preserve	whether existing resource values are preserved
provider
scope_name	scope name which will be used with scope_type to get/set ipsets
scope_type	scope type, this can be either edge, datacenter, or global. if not specified, edge is the default

Properties
value	ipset value, this is a string that can consist of ip addresses, networks, and range of addresses seperated with commas

Providers
default

vshield_dhcp

Manage vShield Edge DHCP

Parameters
datacenter_name
provider
scope_name	dhcp name

Properties
dhcp_bindings	static bindings for dhcp
dhcp_enabled	whether or not the DHCP service is enabled
dhcp_logging	manage logging for dhcp
dhcp_pools	these are ip_pools used for dhcp

Providers
default

vshield_loadbalancer_pool

Manage vShield loadbalancers pools, these are then used by vips

Parameters
ensure
name	loadbalancer name
provider
scope_name	scope name which will be used with scope_type to get/set loadbalancers

Properties
member	these are members of the load balancer pool
service_port	these are service_ports that define the protocol/healthcheck/algorithm that the pool will use

Providers
default

vshield_nat

Manage vShield nat rules

Parameters
description	description to be used for the nat rule, this is the namevar, so must be unique
ensure
provider
scope_name	the edge where this nat is to be configured

Properties
action	destination or source nat
enabled	whether or not enabled, since api defaults to true, so are we
icmp_type	icmp_type can be used to specify an icmp sub option, example: echo-request
original_address	original ip/range
original_port	original port, cannot be used with certain protocols or with action: snat
protocol	nat protocol to be used, note: for icmp, the icmp_type can be used to specify sub option ( example: echo-request )
translated_address	translated ip/range
translated_port	translated port, cannot be used with certain protocols or with action: snat
vnic	vnic number to use

Providers
default

vshield_vxlan_udp

Properties
vxlan_udp_port	UDP Port for VXLAN Virtual Wire

vshield_vxlan

Parameters
description	virtual wire description
ensure
name	virtual wire name
provider
tenant_id	virtual wire tenant id

vshield_routes

Manage vShield static routes

Parameters
inclusive	whether the resource value is inclusive
preserve	whether existing resource values are preserved
provider
scope_name	name of the vshield edge to configure route on

Properties
default_route	default route
static_routes	array of static routes

Providers
default

vshield_application_group

Manage vShield application_groups, these are used by fw rules

Parameters
ensure
inclusive	whether the resource application_member and application_group_member is inclusive
name	application_group name
preserve	whether existing resource values are preserved
provider
scope_name	scope name which will be used with scope_type to get/set application_groups
scope_type	scope type, this can be either edge, datacenter, or global. if not specified, edge is the default

Properties
application_group_member	these are application_group(s) that can be members of existing application_groups
application_member	application ( service ) member(s) of the application_group

Providers
default

vshield_firewall

Manage vShield firewall rules, firewall rules consist of: source/destination - consists of vshield_ipset or vshield built-in properties ( example: vnic[0-9], internal, external, vse, etc ), note: source port feature is not currently implemented service - consists of vshield_application ( service_application ) and vshield_application_group ( service_group ) action - accept/reject

note: default policy should be modified using vshield_firewall_default_policy

Parameters
ensure
inclusive	whether the resource value is inclusive
name	firewall name
preserve	whether existing resource values are preserved
provider
scope_name	scope name which will be used with scope_type to get/set firewalls

Properties
action	this is the action to take, can be either accept or deny, default is accept
destination	these are destination ipset(s) / vnics that can be members of firewall rules, the default is any
enabled	whether or not the rule is enabled, can be either true or false, default is true
logging_enabled	this is whether or not the rule will log, can be either true or false, default is false
service_application	these are destination service(s) that are applications only, the default is any, it was decided to split up services into service_application and service_groups since name space conflicts could occur between a service_application and a service_group
service_group	these are destination service(s) that are application groups only, the default is any, see note on service_application about splitting up service into two seperate properties
source	these are source ipset(s) / vnics that can be members of firewall rules, the default is any

Providers
default

vshield_dns

Manage vShield dns service

Parameters
provider
scope_name	name of the vshield edge to enabled the dns service on

Properties
dns_servers	these are the dns servers which vshield points to
enabled	whether or not this service should be enabled

Providers
default

vshield_edge

Manage vShield edge.

Parameters
appliance
appliance_size
datacenter_name
datastore_name
edge_name	vShield edge, derived from namevar, do not specify.
ensure
fqdn
manager	vShield Manager, derived from namevar, do not specify.
name	vShield manager hostname or ip address and vShield edge name seperated with : (i.e. manager:edge).
provider
resource_pool_name
tenant

Properties
cli_settings	cli settings ( remote access )
enable_aesni
enable_fips
enable_tcp_loose
upgrade
vnics
vse_log_level

Providers
vshield_edge

vshield_vxlan_segment

vshield_ha

Manage vShield ha settings

Parameters
datacenter_name	datacenter to be used if setting datastore_name or compute_name
provider
scope_name	name of the vshield edge to enable ha on

Properties
datastore_name	datastores to be used for the appliances. The 2 datastore names specified are assumed in order, so first element is appliance 0 and second element is appliance 1
declare_dead_time	this is value in which vshield will consider the ha node dead if not responsive
enabled	whether or not this service should be enabled
ip_addresses	these are the ips used for the keepalive communication between edge appliances for ha
logging	hash of the the logging settings example: logging => { enable => true, logLevel => error, }
vnic	vnic to be used for the ha communication

Providers
default

vshield_application

Manage vShield applications, these are used by fw rules

Parameters
ensure
inclusive	whether the resource value is inclusive
name	application name
preserve	whether existing resource values are preserved
provider
scope_name	scope name which will be used with scope_type to get/set applications
scope_type	scope type, this can be either edge, datacenter, or global. if not specified, edge is the default

Properties
application_protocol	application protocol, example TCP/UDP/ICMP/IGMP/FTP/etc ( way to many to list, refer to api guide for more available options
value	application value, this is a string that can consist of port number(s) and ranges of ports

Providers
default

Copyright (C) 2013 VMware, Inc.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Modules

Discover

Contribute

Resources

About Forge

Getting Started