Details

ID	`AnsibleKubernetes`
Provider	IBM
Category	IT Services
From Version	6.0.0
Docker Image	`demisto/ansible-runner:1.0.0.10189215`
Supported Modules	Agentix XSIAM

README

This integration enables the management of Kubernetes environments using Ansible modules. The Ansible engine is self-contained and pre-configured as part of this pack onto your XSOAR server, all you need to do is provide credentials you are ready to use the feature rich commands.

Authorize Cortex XSOAR for Ansible Kubernetes

This integration supports API Token, and Username/Password authentication. It is recommended to use API tokens.

To create a service account with API token use the following kubectl commands.

Create a service account

kubectl apply -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: xsoar
  namespace: kube-system
EOF

Create secret for the above service account.

kubectl apply -f - <<EOF
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: xsoar-secret
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: xsoar
EOF

Grant the service account an appropriate role. Refer to Kubernetes RBAC docs if granting more fine grain or scoped access.

kubectl apply -f - <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: xsoar-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: xsoar
  namespace: kube-system
EOF

Generate the service account token.

kubectl create token xsoar -n kube-system

Copy the output token and paste it into the API field.

Configure Ansible Kubernetes on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Ansible Kubernetes.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
K8s Host URL	Provide a URL for accessing the API.	True
Username	Provide a username for authenticating with the API.	False
Password	Provide a password for authenticating with the API.	False
API Key	Token used to authenticate with the API.	False
Validate Certs	Allows connection when SSL certificates are not valid. Set to `false` when certificates are not trusted.	True

Testing

This integration does not support testing from the integration management screen. Instead it is recommended to use the !k8s-info command querying a object kind allowed by the RBAC assigned. For example !k8s-info kind="svc"

Idempotence

The action commands in this integration are idempotent. This means that the result of performing it once is exactly the same as the result of performing it repeatedly without any intervening actions.

State Arguement

Some of the commands in this integration take a state argument. These define the desired end state of the object being managed. As a result these commands are able to perform multiple management operations depending on the desired state value. Common state values are:

State	Result
present	Object should exist. If not present, the object will be created with the provided parameters. If present but not with correct parameters, it will be modified to met provided parameters.
running	Object should be running not stopped.
stopped	Object should be stopped not running.
restarted	Object will be restarted.
absent	Object should not exist. If it it exists it will be deleted.

Complex Command Inputs

Some commands may require structured input arguments such as lists or dictionary, these can be provided in standard JSON notation wrapped in double curly braces. For example a argument called dns_servers that accepts a list of server IPs 8.8.8.8 and 8.8.4.4 would be entered as dns_servers="{{ ['8.8.8.8', '8.8.4.4'] }}".

Other more advanced data manipulation tools such as Ansible/Jinja2 filters can also be used in-line. For example to get a random number between 0 and 60 you can use {{ 60 | random }}.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

k8s-k8s

Manage Kubernetes (K8s) objects
Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_module.html

Base Command

k8s-k8s

Input

Argument Name	Description	Required
merge_type	Whether to override the default patch merge approach with a specific type. By default, the strategic merge will typically be used. For example, Custom Resource Definitions typically aren’t updatable by the usual strategic merge. You may want to use `merge` if you see “strategic merge patch format is not supported” See `https://kubernetes.io/docs/tasks/run-application/update-api-object-kubectl-patch/#use-a-json-merge-patch-to-update-a-deployment` Requires openshift >= 0.6.2 If more than one merge_type is given, the merge_types will be tried in order If openshift >= 0.6.2, this defaults to `['strategic-merge', 'merge']`, which is ideal for using the same parameters on resource kinds that combine Custom Resources and built-in resources. For openshift < 0.6.2, the default is simply `strategic-merge`. mutually exclusive with `apply`. Possible values are: json, merge, strategic-merge.	Optional
wait	Whether to wait for certain resource kinds to end up in the desired state. By default the module exits once Kubernetes has received the request Implemented for `state=present` for `Deployment`, `DaemonSet` and `Pod`, and for `state=absent` for all resource kinds. For resource kinds without an implementation, `wait` returns immediately unless `wait_condition` is set. Possible values are: Yes, No. Default is No.	Optional
wait_sleep	Number of seconds to sleep between checks. Default is 5.	Optional
wait_timeout	How long in seconds to wait for the resource to end up in the desired state. Ignored if `wait` is not set. Default is 120.	Optional
wait_condition	Specifies a custom condition on the status to wait for. Ignored if `wait` is not set or is set to False.	Optional
validate	how (if at all) to validate the resource definition against the kubernetes schema. Requires the kubernetes-validate python module and openshift >= 0.8.0.	Optional
append_hash	Whether to append a hash to a resource name for immutability purposes Applies only to ConfigMap and Secret resources The parameter will be silently ignored for other resource kinds The full definition of an object is needed to generate the hash - this means that deleting an object created with append_hash will only work if the same object is passed with state=absent (alternatively, just use state=absent with the name including the generated hash and append_hash=no) Requires openshift >= 0.7.2.	Optional
apply	`apply` compares the desired resource definition with the previously supplied resource definition, ignoring properties that are automatically generated `apply` works better with Services than ‘force=yes’ Requires openshift >= 0.9.2 mutually exclusive with `merge_type`.	Optional
state	Determines if an object should be created, patched, or deleted. When set to `present`, an object will be created, if it does not already exist. If set to `absent`, an existing object will be deleted. If set to `present`, an existing object will be patched, if its attributes differ from those specified using `resource_definition` or `src`. Possible values are: absent, present. Default is present.	Optional
force	If set to `yes`, and `state` is `present`, an existing object will be replaced. Possible values are: Yes, No. Default is No.	Optional
api_version	Use to specify the API version. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `kind`, `name`, and `namespace` to identify a specific object. If `resource definition` is provided, the `apiVersion` from the `resource_definition` will override this option. Default is v1.	Optional
kind	Use to specify an object model. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `api_version`, `name`, and `namespace` to identify a specific object. If `resource definition` is provided, the `kind` from the `resource_definition` will override this option.	Optional
name	Use to specify an object name. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `api_version`, `kind` and `namespace` to identify a specific object. If `resource definition` is provided, the `metadata.name` value from the `resource_definition` will override this option.	Optional
namespace	Use to specify an object namespace. Useful when creating, deleting, or discovering an object without providing a full resource definition. Use in conjunction with `api_version`, `kind`, and `name` to identify a specfic object. If `resource definition` is provided, the `metadata.namespace` value from the `resource_definition` will override this option.	Optional
resource_definition	Provide a valid YAML definition (either as a string, list, or dict) for an object when creating or updating. NOTE: `kind`, `api_version`, `name`, and `namespace` will be overwritten by corresponding values found in the provided `resource_definition`.	Optional

Context Output

Path	Type	Description
Kubernetes.K8s.result	unknown	The created, patched, or otherwise present object. Will be empty in the case of a deletion.

Command Example

!k8s-k8s name="testing" kind="Namespace" state="present"

Context Example

{
    "Kubernetes": {
        "K8S": [
            {
                "changed": false,
                "method": "patch",
                "result": {
                    "apiVersion": "v1",
                    "kind": "Namespace",
                    "metadata": {
                        "creationTimestamp": "2021-07-04T16:08:41Z",
                        "managedFields": [
                            {
                                "apiVersion": "v1",
                                "fieldsType": "FieldsV1",
                                "fieldsV1": {
                                    "f:status": {
                                        "f:phase": {}
                                    }
                                },
                                "manager": "OpenAPI-Generator",
                                "operation": "Update",
                                "time": "2021-07-04T16:08:41Z"
                            }
                        ],
                        "name": "testing",
                        "resourceVersion": "34538",
                        "uid": "44296a6f-af82-45bf-af3e-e3a7327d7a30"
                    },
                    "spec": {
                        "finalizers": [
                            "Kubernetes"
                        ]
                    },
                    "status": {
                        "phase": "Active"
                    }
                },
                "status": "SUCCESS"
            }
        ]
    }
}

Human Readable Output

SUCCESS

changed: False

method: patch

Result

apiVersion: v1

kind: Namespace

Metadata

creationTimestamp: 2021-07-04T16:08:41Z

name: testing

resourceVersion: 34538

uid: 44296a6f-af82-45bf-af3e-e3a7327d7a30

Managedfields

List

apiVersion: v1

fieldsType: FieldsV1

manager: OpenAPI-Generator

operation: Update

time: 2021-07-04T16:08:41Z

Fieldsv1

F:Status

####### F:Phase

Spec

Finalizers

0: kubernetes

Status

phase: Active

k8s-info

Describe Kubernetes (K8s) objects
Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_info_module.html

Base Command

k8s-info

Input

Argument Name	Description	Required
api_version	Use to specify the API version. in conjunction with `kind`, `name`, and `namespace` to identify a specific object. Default is v1.	Optional
kind	Use to specify an object model. Use in conjunction with `api_version`, `name`, and `namespace` to identify a specific object.	Required
name	Use to specify an object name. Use in conjunction with `api_version`, `kind` and `namespace` to identify a specific object.	Optional
namespace	Use to specify an object namespace. Use in conjunction with `api_version`, `kind`, and `name` to identify a specific object.	Optional
label_selectors	List of label selectors to use to filter results.	Optional
field_selectors	List of field selectors to use to filter results.	Optional

Context Output

Path	Type	Description
Kubernetes.K8sInfo.resources	unknown	The object(s) that exists

Command Example

!k8s-info kind="namespace" name="testing"

Context Example

{
    "Kubernetes": {
        "K8SInfo": [
            {
                "changed": false,
                "resources": [
                    {
                        "apiVersion": "v1",
                        "kind": "Namespace",
                        "metadata": {
                            "creationTimestamp": "2021-07-04T16:08:41Z",
                            "managedFields": [
                                {
                                    "apiVersion": "v1",
                                    "fieldsType": "FieldsV1",
                                    "fieldsV1": {
                                        "f:status": {
                                            "f:phase": {}
                                        }
                                    },
                                    "manager": "OpenAPI-Generator",
                                    "operation": "Update",
                                    "time": "2021-07-04T16:08:41Z"
                                }
                            ],
                            "name": "testing",
                            "resourceVersion": "34538",
                            "uid": "44296a6f-af82-45bf-af3e-e3a7327d7a30"
                        },
                        "spec": {
                            "finalizers": [
                                "Kubernetes"
                            ]
                        },
                        "status": {
                            "phase": "Active"
                        }
                    }
                ],
                "status": "SUCCESS"
            }
        ]
    }
}

Human Readable Output

SUCCESS

changed: False

Resources

List

apiVersion: v1

kind: Namespace

Metadata

creationTimestamp: 2021-07-04T16:08:41Z

name: testing

resourceVersion: 34538

uid: 44296a6f-af82-45bf-af3e-e3a7327d7a30

Managedfields

List

apiVersion: v1

fieldsType: FieldsV1

manager: OpenAPI-Generator

operation: Update

time: 2021-07-04T16:08:41Z

Fieldsv1

F:Status

####### F:Phase

Spec

Finalizers

0: kubernetes

Status

phase: Active

k8s-scale

Set a new size for a Deployment, ReplicaSet, Replication Controller, or Job.
Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_scale_module.html

Base Command

k8s-scale

Input

Argument Name	Description	Required
api_version	Use to specify the API version. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `kind`, `name`, and `namespace` to identify a specific object. If `resource definition` is provided, the `apiVersion` from the `resource_definition` will override this option. Default is v1.	Optional
kind	Use to specify an object model. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `api_version`, `name`, and `namespace` to identify a specific object. If `resource definition` is provided, the `kind` from the `resource_definition` will override this option.	Optional
name	Use to specify an object name. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `api_version`, `kind` and `namespace` to identify a specific object. If `resource definition` is provided, the `metadata.name` value from the `resource_definition` will override this option.	Optional
namespace	Use to specify an object namespace. Useful when creating, deleting, or discovering an object without providing a full resource definition. Use in conjunction with `api_version`, `kind`, and `name` to identify a specfic object. If `resource definition` is provided, the `metadata.namespace` value from the `resource_definition` will override this option.	Optional
resource_definition	Provide a valid YAML definition (either as a string, list, or dict) for an object when creating or updating. NOTE: `kind`, `api_version`, `name`, and `namespace` will be overwritten by corresponding values found in the provided `resource_definition`.	Optional
replicas	The desired number of replicas.	Optional
current_replicas	For Deployment, ReplicaSet, Replication Controller, only scale, if the number of existing replicas matches. In the case of a Job, update parallelism only if the current parallelism value matches.	Optional
resource_version	Only attempt to scale, if the current object version matches.	Optional
wait	For Deployment, ReplicaSet, Replication Controller, wait for the status value of `ready_replicas` to change to the number of `replicas`. In the case of a Job, this option is ignored. Possible values are: Yes, No. Default is Yes.	Optional
wait_timeout	When `wait` is `True`, the number of seconds to wait for the `ready_replicas` status to equal `replicas`. If the status is not reached within the allotted time, an error will result. In the case of a Job, this option is ignored. Default is 20.	Optional

Context Output

Path	Type	Description
Kubernetes.K8sScale.result	unknown	If a change was made, will return the patched object, otherwise returns the existing object.

Command Example

!k8s-scale kind="Deployment" name="nginx-deployment" namespace="testing" replicas="2" wait_timeout="60"

Context Example

{
    "Kubernetes": {
        "K8SScale": [
            {
                "changed": true,
                "duration": 5,
                "result": {
                    "apiVersion": "apps/v1",
                    "kind": "Deployment",
                    "metadata": {
                        "annotations": {
                            "deployment.kubernetes.io/revision": "1",
                            "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"apps/v1\",\"kind\":\"Deployment\",\"metadata\":{\"annotations\":{},\"labels\":{\"app\":\"nginx\"},\"name\":\"nginx-deployment\",\"namespace\":\"testing\"},\"spec\":{\"replicas\":3,\"selector\":{\"matchLabels\":{\"app\":\"nginx\"}},\"template\":{\"metadata\":{\"labels\":{\"app\":\"nginx\"}},\"spec\":{\"containers\":[{\"image\":\"nginx:1.14.2\",\"name\":\"nginx\",\"ports\":[{\"containerPort\":80}]}]}}}}\n"
                        },
                        "creationTimestamp": "2021-07-04T16:42:43Z",
                        "generation": 2,
                        "labels": {
                            "app": "nginx"
                        },
                        "managedFields": [
                            {
                                "apiVersion": "apps/v1",
                                "fieldsType": "FieldsV1",
                                "fieldsV1": {
                                    "f:metadata": {
                                        "f:annotations": {
                                            ".": {},
                                            "f:kubectl.kubernetes.io/last-applied-configuration": {}
                                        },
                                        "f:labels": {
                                            ".": {},
                                            "f:app": {}
                                        }
                                    },
                                    "f:spec": {
                                        "f:progressDeadlineSeconds": {},
                                        "f:replicas": {},
                                        "f:revisionHistoryLimit": {},
                                        "f:selector": {},
                                        "f:strategy": {
                                            "f:rollingUpdate": {
                                                ".": {},
                                                "f:maxSurge": {},
                                                "f:maxUnavailable": {}
                                            },
                                            "f:type": {}
                                        },
                                        "f:template": {
                                            "f:metadata": {
                                                "f:labels": {
                                                    ".": {},
                                                    "f:app": {}
                                                }
                                            },
                                            "f:spec": {
                                                "f:containers": {
                                                    "k:{\"name\":\"nginx\"}": {
                                                        ".": {},
                                                        "f:image": {},
                                                        "f:imagePullPolicy": {},
                                                        "f:name": {},
                                                        "f:ports": {
                                                            ".": {},
                                                            "k:{\"containerPort\":80,\"protocol\":\"TCP\"}": {
                                                                ".": {},
                                                                "f:containerPort": {},
                                                                "f:protocol": {}
                                                            }
                                                        },
                                                        "f:resources": {},
                                                        "f:terminationMessagePath": {},
                                                        "f:terminationMessagePolicy": {}
                                                    }
                                                },
                                                "f:dnsPolicy": {},
                                                "f:restartPolicy": {},
                                                "f:schedulerName": {},
                                                "f:securityContext": {},
                                                "f:terminationGracePeriodSeconds": {}
                                            }
                                        }
                                    }
                                },
                                "manager": "kubectl-client-side-apply",
                                "operation": "Update",
                                "time": "2021-07-04T16:42:43Z"
                            }
                        ],
                        "name": "nginx-deployment",
                        "namespace": "testing",
                        "resourceVersion": "38764",
                        "uid": "364a24b7-211d-4f9d-8573-9310f5850e50"
                    },
                    "spec": {
                        "progressDeadlineSeconds": 600,
                        "replicas": 2,
                        "revisionHistoryLimit": 10,
                        "selector": {
                            "matchLabels": {
                                "app": "nginx"
                            }
                        },
                        "strategy": {
                            "rollingUpdate": {
                                "maxSurge": "25%",
                                "maxUnavailable": "25%"
                            },
                            "type": "RollingUpdate"
                        },
                        "template": {
                            "metadata": {
                                "creationTimestamp": null,
                                "labels": {
                                    "app": "nginx"
                                }
                            },
                            "spec": {
                                "containers": [
                                    {
                                        "image": "nginx:1.14.2",
                                        "imagePullPolicy": "IfNotPresent",
                                        "name": "nginx",
                                        "ports": [
                                            {
                                                "containerPort": 80,
                                                "protocol": "TCP"
                                            }
                                        ],
                                        "resources": {},
                                        "terminationMessagePath": "/dev/termination-log",
                                        "terminationMessagePolicy": "File"
                                    }
                                ],
                                "dnsPolicy": "ClusterFirst",
                                "restartPolicy": "Always",
                                "schedulerName": "default-scheduler",
                                "securityContext": {},
                                "terminationGracePeriodSeconds": 30
                            }
                        }
                    },
                    "status": {
                        "availableReplicas": 2,
                        "conditions": [
                            {
                                "lastTransitionTime": "2021-07-04T16:42:52Z",
                                "lastUpdateTime": "2021-07-04T16:42:52Z",
                                "message": "Deployment has minimum availability.",
                                "reason": "MinimumReplicasAvailable",
                                "status": "True",
                                "type": "Available"
                            }
                        ],
                        "observedGeneration": 2,
                        "readyReplicas": 2,
                        "replicas": 2,
                        "updatedReplicas": 2
                    }
                },
                "status": "CHANGED"
            }
        ]
    }
}

Human Readable Output

CHANGED

changed: True

duration: 5

Result

apiVersion: apps/v1

kind: Deployment

Metadata

creationTimestamp: 2021-07-04T16:42:43Z

generation: 2

name: nginx-deployment

namespace: testing

resourceVersion: 38764

uid: 364a24b7-211d-4f9d-8573-9310f5850e50

Annotations

deployment.kubernetes.io/revision: 1

kubectl.kubernetes.io/last-applied-configuration: {“apiVersion”:”apps/v1”,”kind”:”Deployment”,”metadata”:{“annotations”:{},”labels”:{“app”:”nginx”},”name”:”nginx-deployment”,”namespace”:”testing”},”spec”:{“replicas”:3,”selector”:{“matchLabels”:{“app”:”nginx”}},”template”:{“metadata”:{“labels”:{“app”:”nginx”}},”spec”:{“containers”:[{“image”:”nginx:1.14.2”,”name”:”nginx”,”ports”:[{“containerPort”:80}]}]}}}}

Labels

app: nginx

Managedfields

List

apiVersion: apps/v1

fieldsType: FieldsV1

manager: kubectl-client-side-apply

operation: Update

time: 2021-07-04T16:42:43Z

Fieldsv1

F:Metadata

####### F:Annotations

######## .

######## F:Kubectl.Kubernetes.Io/Last-Applied-Configuration

####### F:Labels

######## .

######## F:App

F:Spec

####### F:Progressdeadlineseconds

####### F:Replicas

####### F:Revisionhistorylimit

####### F:Selector

####### F:Strategy

######## F:Rollingupdate

######### .

######### F:Maxsurge

######### F:Maxunavailable

######## F:Type

####### F:Template

######## F:Metadata

######### F:Labels

########## .

########## F:App

######## F:Spec

######### F:Containers

########## K:{“Name”:”Nginx”}

########### .

########### F:Image

########### F:Imagepullpolicy

########### F:Name

########### F:Ports

############ .

############ K:{“Containerport”:80,”Protocol”:”Tcp”}

############# .

############# F:Containerport

############# F:Protocol

########### F:Resources

########### F:Terminationmessagepath

########### F:Terminationmessagepolicy

######### F:Dnspolicy

######### F:Restartpolicy

######### F:Schedulername

######### F:Securitycontext

######### F:Terminationgraceperiodseconds

List

apiVersion: apps/v1

fieldsType: FieldsV1

manager: kube-controller-manager

operation: Update

time: 2021-07-04T16:42:52Z

Fieldsv1

F:Metadata

####### F:Annotations

######## F:Deployment.Kubernetes.Io/Revision

F:Status

####### F:Availablereplicas

####### F:Conditions

######## .

######## K:{“Type”:”Available”}

######### .

######### F:Lasttransitiontime

######### F:Lastupdatetime

######### F:Message

######### F:Reason

######### F:Status

######### F:Type

####### F:Observedgeneration

####### F:Readyreplicas

####### F:Replicas

####### F:Updatedreplicas

Spec

progressDeadlineSeconds: 600

replicas: 2

revisionHistoryLimit: 10

Selector

Matchlabels

app: nginx

Strategy

type: RollingUpdate

Rollingupdate

maxSurge: 25%

maxUnavailable: 25%

Template

Metadata

creationTimestamp: None

Labels

app: nginx

Spec

dnsPolicy: ClusterFirst

restartPolicy: Always

schedulerName: default-scheduler

terminationGracePeriodSeconds: 30

Containers

Nginx

image: nginx:1.14.2

imagePullPolicy: IfNotPresent

name: nginx

terminationMessagePath: /dev/termination-log

terminationMessagePolicy: File

####### Ports

####### List

containerPort: 80

protocol: TCP

####### Resources

Securitycontext

Status

availableReplicas: 2

observedGeneration: 2

readyReplicas: 2

replicas: 2

updatedReplicas: 2

Conditions

List

lastTransitionTime: 2021-07-04T16:42:52Z

lastUpdateTime: 2021-07-04T16:42:52Z

message: Deployment has minimum availability.

reason: MinimumReplicasAvailable

status: True

type: Available

List

lastTransitionTime: 2021-07-04T16:42:43Z

lastUpdateTime: 2021-07-04T16:42:52Z

message: ReplicaSet “nginx-deployment-66b6c48dd5” has successfully progressed.

reason: NewReplicaSetAvailable

status: True

type: Progressing

k8s-service

Manage Services on Kubernetes
Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_service_module.html

Base Command

k8s-service

Input

Argument Name	Description	Required
resource_definition	A partial YAML definition of the Service object being created/updated. Here you can define Kubernetes Service Resource parameters not covered by this module’s parameters. NOTE: `resource_definition` has lower priority than module parameters. If you try to define e.g. `metadata.namespace` here, that value will be ignored and `metadata` used instead.	Optional
state	Determines if an object should be created, patched, or deleted. When set to `present`, an object will be created, if it does not already exist. If set to `absent`, an existing object will be deleted. If set to `present`, an existing object will be patched, if its attributes differ from those specified using module options and `resource_definition`. Possible values are: present, absent. Default is present.	Optional
force	If set to `True`, and `state` is `present`, an existing object will be replaced. Possible values are: Yes, No. Default is No.	Optional
merge_type	Whether to override the default patch merge approach with a specific type. By default, the strategic merge will typically be used. For example, Custom Resource Definitions typically aren’t updatable by the usual strategic merge. You may want to use `merge` if you see “strategic merge patch format is not supported” See `https://kubernetes.io/docs/tasks/run-application/update-api-object-kubectl-patch/#use-a-json-merge-patch-to-update-a-deployment` Requires openshift >= 0.6.2 If more than one merge_type is given, the merge_types will be tried in order If openshift >= 0.6.2, this defaults to `['strategic-merge', 'merge']`, which is ideal for using the same parameters on resource kinds that combine Custom Resources and built-in resources. For openshift < 0.6.2, the default is simply `strategic-merge`. Possible values are: json, merge, strategic-merge.	Optional
name	Use to specify a Service object name.	Required
namespace	Use to specify a Service object namespace.	Required
type	Specifies the type of Service to create. See `https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types`. Possible values are: NodePort, ClusterIP, LoadBalancer, ExternalName.	Optional
ports	A list of ports to expose. `https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services`.	Optional
selector	Label selectors identify objects this Service should apply to. `https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/`.	Optional

Context Output

Path	Type	Description
Kubernetes.K8sService.result	unknown	The created, patched, or otherwise present Service object. Will be empty in the case of a deletion.

Command Example

!k8s-service state="present" name="test-https" namespace="testing" ports="{{ [{'port': 443, 'protocol': 'TCP'}] }}" selector="{'app': 'nginx'}"

Context Example

{
    "Kubernetes": {
        "K8SService": [
            {
                "changed": true,
                "method": "create",
                "result": {
                    "apiVersion": "v1",
                    "kind": "Service",
                    "metadata": {
                        "creationTimestamp": "2021-07-04T16:49:51Z",
                        "managedFields": [
                            {
                                "apiVersion": "v1",
                                "fieldsType": "FieldsV1",
                                "fieldsV1": {
                                    "f:spec": {
                                        "f:ports": {
                                            ".": {},
                                            "k:{\"port\":443,\"protocol\":\"TCP\"}": {
                                                ".": {},
                                                "f:port": {},
                                                "f:protocol": {},
                                                "f:targetPort": {}
                                            }
                                        },
                                        "f:selector": {
                                            ".": {},
                                            "f:app": {}
                                        },
                                        "f:sessionAffinity": {},
                                        "f:type": {}
                                    }
                                },
                                "manager": "OpenAPI-Generator",
                                "operation": "Update",
                                "time": "2021-07-04T16:49:51Z"
                            }
                        ],
                        "name": "test-https",
                        "namespace": "testing",
                        "resourceVersion": "38785",
                        "uid": "71dd0d2d-9c84-497f-b900-6ba4357a325d"
                    },
                    "spec": {
                        "clusterIP": "1.1.1.1",
                        "clusterIPs": [
                            "1.1.1.1"
                        ],
                        "ports": [
                            {
                                "port": 443,
                                "protocol": "TCP",
                                "targetPort": 443
                            }
                        ],
                        "selector": {
                            "app": "nginx"
                        },
                        "sessionAffinity": "None",
                        "type": "ClusterIP"
                    },
                    "status": {
                        "loadBalancer": {}
                    }
                },
                "status": "CHANGED"
            }
        ]
    }
}

Human Readable Output

CHANGED

changed: True

method: create

Result

apiVersion: v1

kind: Service

Metadata

creationTimestamp: 2021-07-04T16:49:51Z

name: test-https

namespace: testing

resourceVersion: 38785

uid: 71dd0d2d-9c84-497f-b900-6ba4357a325d

Managedfields

List

apiVersion: v1

fieldsType: FieldsV1

manager: OpenAPI-Generator

operation: Update

time: 2021-07-04T16:49:51Z

Fieldsv1

F:Spec

####### F:Ports

######## .

######## K:{“Port”:443,”Protocol”:”Tcp”}

######### .

######### F:Port

######### F:Protocol

######### F:Targetport

####### F:Selector

######## .

######## F:App

####### F:Sessionaffinity

####### F:Type

Spec

clusterIP: 1.1.1.1

sessionAffinity: None

type: ClusterIP

Clusterips

0: 1.1.1.1

Ports

List

port: 443

protocol: TCP

targetPort: 443

Selector

app: nginx

Status

Loadbalancer

Troubleshooting

The Ansible-Runner container is not suitable for running as a non-root user.
Therefore, the Ansible integrations will fail if you follow the instructions in Docker hardening guide (Cortex XSOAR 6.13) or Docker hardening guide (Cortex XSOAR 8 Cloud) or Docker hardening guide (Cortex XSOAR 8.7 On-prem).

The docker.run.internal.asuser server configuration causes the software that is run inside of the Docker containers utilized by Cortex XSOAR to run as a non-root user account inside the container.

The Ansible-Runner software is required to run as root as it applies its own isolation via bwrap to the Ansible execution environment.

This is a limitation of the Ansible-Runner software itself https://github.com/ansible/ansible-runner/issues/611.

A workaround is to use the docker.run.internal.asuser.ignore server setting and to configure Cortex XSOAR to ignore the Ansible container image by setting the value of demisto/ansible-runner and afterwards running /reset_containers to reload any containers that might be running to ensure they receive the configuration.

See step 2 of this Docker hardening guide (Cortex XSOAR 6.13). For Cortex XSOAR 8 Cloud see step 3 in Run Docker with non-root internal users of this Docker hardening guide (Cortex XSOAR 8 Cloud). For Cortex XSOAR 8.7 On-prem see step 3 in Run Docker with non-root internal users of this Docker hardening guide (Cortex XSOAR 8.7 On-prem) for complete instructions.

Configuration parameters

host — K8s Host URL (required)
creds — Username
api_key — API Key
validate_certs — Validate Certs (required)

Commands (4)

k8s-info
Describe Kubernetes (K8s) objects Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_info_module.html
k8s-k8s
Manage Kubernetes (K8s) objects Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_module.html
k8s-scale
Set a new size for a Deployment, ReplicaSet, Replication Controller, or Job. Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_scale_module.html
k8s-service
Manage Services on Kubernetes Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_service_module.html

Source

AnsibleKubernetes.py AnsibleKubernetes.yml AnsibleKubernetes_description.md command_examples.txt

Download History Raw

category: IT Services
provider: IBM
commonfields:
  id: AnsibleKubernetes
  version: -1
configuration:
- additionalinfo: Provide a URL for accessing the API.
  display: K8s Host URL
  name: host
  required: true
  type: 0
- additionalinfo: Provide a username for authenticating with the API.
  display: Username
  displaypassword: Password
  name: creds
  type: 9
  required: false
- additionalinfo: Token used to authenticate with the API.
  display: API Key
  name: api_key
  type: 4
  required: false
- additionalinfo: Allows connection when SSL certificates are not valid. Set to `false` when certificates are not trusted.
  defaultvalue: 'False'
  display: Validate Certs
  name: validate_certs
  required: true
  type: 15
  options:
  - "False"
  - "True"
description: Manage Kubernetes.
display: Ansible Kubernetes
fromversion: 6.0.0
name: AnsibleKubernetes
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: 'Whether to override the default patch merge approach with a specific type. By default, the strategic merge will typically be used. For example, Custom Resource Definitions typically aren''t updatable by the usual strategic merge. You may want to use `merge` if you see "strategic merge patch format is not supported" See `https://kubernetes.io/docs/tasks/run-application/update-api-object-kubectl-patch/#use-a-json-merge-patch-to-update-a-deployment` Requires openshift >= 0.6.2 If more than one merge_type is given, the merge_types will be tried in order If openshift >= 0.6.2, this defaults to `[''strategic-merge'', ''merge'']`, which is ideal for using the same parameters on resource kinds that combine Custom Resources and built-in resources. For openshift < 0.6.2, the default is simply `strategic-merge`. mutually exclusive with `apply`.'
      isArray: true
      name: merge_type
      predefined:
      - json
      - merge
      - strategic-merge
    - auto: PREDEFINED
      defaultValue: 'No'
      description: 'Whether to wait for certain resource kinds to end up in the desired state. By default the module exits once Kubernetes has received the request Implemented for `state=present` for `Deployment`, `DaemonSet` and `Pod`, and for `state=absent` for all resource kinds. For resource kinds without an implementation, `wait` returns immediately unless `wait_condition` is set.'
      name: wait
      predefined:
      - 'Yes'
      - 'No'
    - defaultValue: '5'
      description: Number of seconds to sleep between checks.
      name: wait_sleep
    - defaultValue: '120'
      description: How long in seconds to wait for the resource to end up in the desired state. Ignored if `wait` is not set.
      name: wait_timeout
    - description: Specifies a custom condition on the status to wait for. Ignored if `wait` is not set or is set to False.
      name: wait_condition
    - description: how (if at all) to validate the resource definition against the kubernetes schema. Requires the kubernetes-validate python module and openshift >= 0.8.0.
      name: validate
    - description: 'Whether to append a hash to a resource name for immutability purposes Applies only to ConfigMap and Secret resources The parameter will be silently ignored for other resource kinds The full definition of an object is needed to generate the hash - this means that deleting an object created with append_hash will only work if the same object is passed with state=absent (alternatively, just use state=absent with the name including the generated hash and append_hash=no) Requires openshift >= 0.7.2.'
      name: append_hash
    - description: '`apply` compares the desired resource definition with the previously supplied resource definition, ignoring properties that are automatically generated `apply` works better with Services than ''force=yes'' Requires openshift >= 0.9.2 mutually exclusive with `merge_type`.'
      name: apply
    - auto: PREDEFINED
      defaultValue: present
      description: Determines if an object should be created, patched, or deleted. When set to `present`, an object will be created, if it does not already exist. If set to `absent`, an existing object will be deleted. If set to `present`, an existing object will be patched, if its attributes differ from those specified using `resource_definition` or `src`.
      name: state
      predefined:
      - absent
      - present
    - auto: PREDEFINED
      defaultValue: 'No'
      description: If set to `yes`, and `state` is `present`, an existing object will be replaced.
      name: force
      predefined:
      - 'Yes'
      - 'No'
    - defaultValue: v1
      description: Use to specify the API version. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `kind`, `name`, and `namespace` to identify a specific object. If `resource definition` is provided, the `apiVersion` from the `resource_definition` will override this option.
      name: api_version
    - description: Use to specify an object model. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `api_version`, `name`, and `namespace` to identify a specific object. If `resource definition` is provided, the `kind` from the `resource_definition` will override this option.
      name: kind
    - description: Use to specify an object name. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `api_version`, `kind` and `namespace` to identify a specific object. If `resource definition` is provided, the `metadata.name` value from the `resource_definition` will override this option.
      name: name
    - description: Use to specify an object namespace. Useful when creating, deleting, or discovering an object without providing a full resource definition. Use in conjunction with `api_version`, `kind`, and `name` to identify a specfic object. If `resource definition` is provided, the `metadata.namespace` value from the `resource_definition` will override this option.
      name: namespace
    - description: 'Provide a valid YAML definition (either as a string, list, or dict) for an object when creating or updating. NOTE: `kind`, `api_version`, `name`, and `namespace` will be overwritten by corresponding values found in the provided `resource_definition`.'
      name: resource_definition
    description: "Manage Kubernetes (K8s) objects\n Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_module.html"
    name: k8s-k8s
    outputs:
    - contextPath: Kubernetes.K8s.result
      description: The created, patched, or otherwise present object. Will be empty in the case of a deletion.
      type: unknown
  - arguments:
    - defaultValue: v1
      description: Use to specify the API version. in conjunction with `kind`, `name`, and `namespace` to identify a specific object.
      name: api_version
    - description: Use to specify an object model. Use in conjunction with `api_version`, `name`, and `namespace` to identify a specific object.
      name: kind
      required: true
    - description: Use to specify an object name.  Use in conjunction with `api_version`, `kind` and `namespace` to identify a specific object.
      name: name
    - description: Use to specify an object namespace. Use in conjunction with `api_version`, `kind`, and `name` to identify a specific object.
      name: namespace
    - description: List of label selectors to use to filter results.
      name: label_selectors
    - description: List of field selectors to use to filter results.
      name: field_selectors
    description: "Describe Kubernetes (K8s) objects\n Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_info_module.html"
    name: k8s-info
    outputs:
    - contextPath: Kubernetes.K8sInfo.resources
      description: The object(s) that exists.
      type: unknown
  - arguments:
    - defaultValue: v1
      description: Use to specify the API version. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `kind`, `name`, and `namespace` to identify a specific object. If `resource definition` is provided, the `apiVersion` from the `resource_definition` will override this option.
      name: api_version
    - description: Use to specify an object model. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `api_version`, `name`, and `namespace` to identify a specific object. If `resource definition` is provided, the `kind` from the `resource_definition` will override this option.
      name: kind
    - description: Use to specify an object name. Use to create, delete, or discover an object without providing a full resource definition. Use in conjunction with `api_version`, `kind` and `namespace` to identify a specific object. If `resource definition` is provided, the `metadata.name` value from the `resource_definition` will override this option.
      name: name
    - description: Use to specify an object namespace. Useful when creating, deleting, or discovering an object without providing a full resource definition. Use in conjunction with `api_version`, `kind`, and `name` to identify a specfic object. If `resource definition` is provided, the `metadata.namespace` value from the `resource_definition` will override this option.
      name: namespace
    - description: 'Provide a valid YAML definition (either as a string, list, or dict) for an object when creating or updating. NOTE: `kind`, `api_version`, `name`, and `namespace` will be overwritten by corresponding values found in the provided `resource_definition`.'
      name: resource_definition
    - description: The desired number of replicas.
      name: replicas
    - description: For Deployment, ReplicaSet, Replication Controller, only scale, if the number of existing replicas matches. In the case of a Job, update parallelism only if the current parallelism value matches.
      name: current_replicas
    - description: Only attempt to scale, if the current object version matches.
      name: resource_version
    - auto: PREDEFINED
      defaultValue: 'Yes'
      description: For Deployment, ReplicaSet, Replication Controller, wait for the status value of `ready_replicas` to change to the number of `replicas`. In the case of a Job, this option is ignored.
      name: wait
      predefined:
      - 'Yes'
      - 'No'
    - defaultValue: '20'
      description: When `wait` is `True`, the number of seconds to wait for the `ready_replicas` status to equal  `replicas`. If the status is not reached within the allotted time, an error will result. In the case of a Job, this option is ignored.
      name: wait_timeout
    description: "Set a new size for a Deployment, ReplicaSet, Replication Controller, or Job.\n Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_scale_module.html"
    name: k8s-scale
    outputs:
    - contextPath: Kubernetes.K8sScale.result
      description: If a change was made, will return the patched object, otherwise returns the existing object.
      type: unknown
  - arguments:
    - description: 'A partial YAML definition of the Service object being created/updated. Here you can define Kubernetes Service Resource parameters not covered by this module''s parameters. NOTE: `resource_definition` has lower priority than module parameters. If you try to define e.g. `metadata.namespace` here, that value will be ignored and `metadata` used instead.'
      isArray: true
      name: resource_definition
    - auto: PREDEFINED
      defaultValue: present
      description: Determines if an object should be created, patched, or deleted. When set to `present`, an object will be created, if it does not already exist. If set to `absent`, an existing object will be deleted. If set to `present`, an existing object will be patched, if its attributes differ from those specified using module options and `resource_definition`.
      name: state
      predefined:
      - present
      - absent
    - auto: PREDEFINED
      defaultValue: 'No'
      description: If set to `True`, and `state` is `present`, an existing object will be replaced.
      name: force
      predefined:
      - 'Yes'
      - 'No'
    - auto: PREDEFINED
      description: 'Whether to override the default patch merge approach with a specific type. By default, the strategic merge will typically be used. For example, Custom Resource Definitions typically aren''t updatable by the usual strategic merge. You may want to use `merge` if you see "strategic merge patch format is not supported" See `https://kubernetes.io/docs/tasks/run-application/update-api-object-kubectl-patch/#use-a-json-merge-patch-to-update-a-deployment` Requires openshift >= 0.6.2 If more than one merge_type is given, the merge_types will be tried in order If openshift >= 0.6.2, this defaults to `[''strategic-merge'', ''merge'']`, which is ideal for using the same parameters on resource kinds that combine Custom Resources and built-in resources. For openshift < 0.6.2, the default is simply `strategic-merge`.'
      isArray: true
      name: merge_type
      predefined:
      - json
      - merge
      - strategic-merge
    - description: Use to specify a Service object name.
      name: name
      required: true
    - description: Use to specify a Service object namespace.
      name: namespace
      required: true
    - auto: PREDEFINED
      description: 'Specifies the type of Service to create. See `https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types`.'
      name: type
      predefined:
      - NodePort
      - ClusterIP
      - LoadBalancer
      - ExternalName
    - description: 'A list of ports to expose. `https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services`.'
      isArray: true
      name: ports
    - description: 'Label selectors identify objects this Service should apply to. `https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/`.'
      isArray: true
      name: selector
    description: "Manage Services on Kubernetes\n Further documentation available at https://docs.ansible.com/ansible/2.9/modules/k8s_service_module.html"
    name: k8s-service
    outputs:
    - contextPath: Kubernetes.K8sService.result
      description: The created, patched, or otherwise present Service object. Will be empty in the case of a deletion.
      type: unknown
  dockerimage: demisto/ansible-runner:1.0.0.10189215
  script: ''
  subtype: python3
  type: python
tests:
- Test-AnsibleKubernetes