From 58e2da1ad6858b69f08a9ccf53ab189324970334 Mon Sep 17 00:00:00 2001 From: ameera Date: Mon, 2 Nov 2026 16:12:09 +0200 Subject: [PATCH 1/2] Add cp_gaia_param and cp_gaia_param_facts modules for Config Point (FMW-133) Add modules for the Gaia API set-param and show-param APIs, so Config Point parameters can be managed from Ansible (Gaia API v1.8, R82 and above). - cp_gaia_param_facts - show parameters by path or prefix, with filter_by and member_id. - cp_gaia_param - set a list of parameters (value, comments, use_default, volatile, per-parameter virtual_system_id), with dry_run and use_regex. changed is taken from the API's changed-params, so a task that sets the current value reports changed=false. Check mode sends the request with dry_run, so nothing is saved. - Both modules send virtual_system_id as a string, as these APIs reject an integer. Also add unit tests and docs, and list the modules in the README. Co-Authored-By: Claude Opus 5.5 --- README.md | 2 + docs/cp_gaia_param.rst | 143 +++++++++++++++ docs/cp_gaia_param_facts.rst | 111 +++++++++++ plugins/modules/cp_gaia_param.py | 172 ++++++++++++++++++ plugins/modules/cp_gaia_param_facts.py | 121 ++++++++++++ tests/unit/modules/test_cp_gaia_param.py | 136 ++++++++++++++ .../unit/modules/test_cp_gaia_param_facts.py | 91 +++++++++ 7 files changed, 776 insertions(+) create mode 100644 docs/cp_gaia_param.rst create mode 100644 docs/cp_gaia_param_facts.rst create mode 100644 plugins/modules/cp_gaia_param.py create mode 100644 plugins/modules/cp_gaia_param_facts.py create mode 100644 tests/unit/modules/test_cp_gaia_param.py create mode 100644 tests/unit/modules/test_cp_gaia_param_facts.py diff --git a/README.md b/README.md index a6bba94..6ed4ada 100644 --- a/README.md +++ b/README.md @@ -156,6 +156,8 @@ Modules * `cp_gaia_maestro_security_groups_facts` - get information about Maestro Security Groups over Web Services API. * `cp_gaia_maestro_sites` - add description to Maestro Sites over Web Services API. * `cp_gaia_maestro_sites_facts` - get information about Maestro Sites over Web Services API. +* `cp_gaia_param` – set Config Point parameters of a Check Point machine over Web Services API. +* `cp_gaia_param_facts` – get Config Point parameters of a Check Point machine over Web Services API. ### Code of Conduct This collection follows the Ansible project's diff --git a/docs/cp_gaia_param.rst b/docs/cp_gaia_param.rst new file mode 100644 index 0000000..b7e1089 --- /dev/null +++ b/docs/cp_gaia_param.rst @@ -0,0 +1,143 @@ +.. _cp_gaia_param_module: + + +cp_gaia_param -- Set Config Point parameters. +============================================= + +.. contents:: + :local: + :depth: 1 + + +Synopsis +-------- + +Set Config Point parameters. + +To see the parameters documentation go to https://\/param\_docs/ on the Gaia machine. + + + +Requirements +------------ +The below requirements are needed on the host that executes this module. + +- supported starting from gaia\_api \>= 1.8 +- supported on Gaia versions R82 and above + + + +Parameters +---------- + + version (False, str, None) + Gaia API version for example 1.8. + + + virtual_system_id (False, str, None) + VSX Virtual System ID which presents the context switch. + + + param_list (True, list, None) + List of parameters to be set. + + + param_path (True, str, None) + Parameter full path. + + + value (optional, raw, None) + Parameter value, can be a string, int, boolean, object or a list of them. + + Can not be used together with :emphasis:`use\_default`. + + + comments (optional, str, None) + Comments to be added to the parameter, length is limited to 256 characters. + + + use_default (optional, bool, None) + Set the parameter back to its default value. + + Can not be used together with :emphasis:`value`. + + + volatile (optional, bool, None) + Set the parameter with the value specified until the next reboot. + + + virtual_system_id (optional, str, None) + VSX Virtual System IDs to set the parameter in, can be :literal:`all` or specific IDs, for example :literal:`2,4,7\-10`. + + + + dry_run (False, bool, False) + Run the request without saving to the database, return only the values that would change. + + + use_regex (False, bool, False) + Indicates that :emphasis:`param\_path` includes :literal:`\*`. + + + wait_for_task (False, bool, True) + Wait for task or return immediately. + + + + + +Notes +----- + +.. note:: + - Supports :literal:`check\_mode`. In check mode the request is sent with :literal:`dry\_run`\ , so nothing is saved. + + + + +Examples +-------- + +.. code-block:: yaml+jinja + + + - name: Set a parameter value and return another one to its default + check_point.gaia.cp_gaia_param: + param_list: + - param_path: gaia.infra.httpd.cp_httpd_configuration.children_core_dumps + value: true + comments: enabled for debugging purpose + - param_path: gaia.infra.rest_api.gunicorn.timeout + use_default: true + + - name: Check which parameters would change, without saving + check_point.gaia.cp_gaia_param: + param_list: + - param_path: gaia.infra.httpd.cp_httpd_configuration.children_core_dumps + value: true + dry_run: true + + + +Return Values +------------- + +set_param (always., dict, ) + The task result of the set\-param request, including the parameters that were set. + + + + + +Status +------ + + + + + +Authors +~~~~~~~ + +- Ameer Asli (@chkp-ameera) + diff --git a/docs/cp_gaia_param_facts.rst b/docs/cp_gaia_param_facts.rst new file mode 100644 index 0000000..248d7db --- /dev/null +++ b/docs/cp_gaia_param_facts.rst @@ -0,0 +1,111 @@ +.. _cp_gaia_param_facts_module: + + +cp_gaia_param_facts -- Show Config Point parameters. +==================================================== + +.. contents:: + :local: + :depth: 1 + + +Synopsis +-------- + +Show Config Point parameters by full path or prefix. + +To see the parameters documentation go to https://\/param\_docs/ on the Gaia machine. + + + +Requirements +------------ +The below requirements are needed on the host that executes this module. + +- supported starting from gaia\_api \>= 1.8 +- supported on Gaia versions R82 and above + + + +Parameters +---------- + + version (False, str, None) + Gaia API version for example 1.8. + + + virtual_system_id (False, str, None) + VSX Virtual System ID which presents the context switch. + + + param_path (True, str, None) + Parameter full path or prefix, for example :literal:`security\-gateway.DLP`. + + + filter_by (False, str, None) + Show only parameters matching the filter, in the format :literal:`\=true`. + + The filter type can be one of :literal:`modified`\ , :literal:`with\-comments` or :literal:`not\-default`\ , for example :literal:`modified=true`. + + + member_id (False, int, None) + SMO member ID of the member to show the data from. Default is the ID of the current login member. + + + wait_for_task (False, bool, True) + Wait for task or return immediately. + + + + + +Notes +----- + +.. note:: + - Supports :literal:`check\_mode`. + + + + +Examples +-------- + +.. code-block:: yaml+jinja + + + - name: Show all DLP parameters + check_point.gaia.cp_gaia_param_facts: + param_path: security-gateway.DLP + + - name: Show only the DLP parameters that were modified + check_point.gaia.cp_gaia_param_facts: + param_path: security-gateway.DLP + filter_by: modified=true + + + +Return Values +------------- + +show_param (always., dict, ) + The task result of the show\-param request. + + The matching parameters are in :literal:`tasks[0].task\-details[0].param\-list`\ , each with its name, current\-value, default\-value, description, comments, pending and last\-modified. + + + + + +Status +------ + + + + + +Authors +~~~~~~~ + +- Ameer Asli (@chkp-ameera) + diff --git a/plugins/modules/cp_gaia_param.py b/plugins/modules/cp_gaia_param.py new file mode 100644 index 0000000..50214a5 --- /dev/null +++ b/plugins/modules/cp_gaia_param.py @@ -0,0 +1,172 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + + +DOCUMENTATION = """ +author: Ameer Asli (@chkp-ameera) +description: +- Set Config Point parameters. +- To see the parameters documentation go to https:///param_docs/ on the Gaia machine. +module: cp_gaia_param +short_description: Set Config Point parameters. +version_added: '7.1.0' +notes: +- Supports C(check_mode). In check mode the request is sent with C(dry_run), so nothing is saved. +requirements: +- supported starting from gaia_api >= 1.8 +- supported on Gaia versions R82 and above +options: + version: + description: Gaia API version for example 1.8. + required: False + type: str + virtual_system_id: + description: VSX Virtual System ID which presents the context switch. + required: False + type: str + param_list: + description: List of parameters to be set. + required: True + type: list + elements: dict + suboptions: + param_path: + description: Parameter full path. + required: True + type: str + value: + description: + - Parameter value, can be a string, int, boolean, object or a list of them. + - Can not be used together with I(use_default). + type: raw + comments: + description: Comments to be added to the parameter, length is limited to 256 characters. + type: str + use_default: + description: + - Set the parameter back to its default value. + - Can not be used together with I(value). + type: bool + volatile: + description: Set the parameter with the value specified until the next reboot. + type: bool + virtual_system_id: + description: VSX Virtual System IDs to set the parameter in, can be C(all) or specific IDs, for example C(2,4,7-10). + type: str + dry_run: + description: Run the request without saving to the database, return only the values that would change. + required: False + default: False + type: bool + use_regex: + description: Indicates that I(param_path) includes C(*). + required: False + default: False + type: bool + wait_for_task: + description: Wait for task or return immediately. + required: False + default: True + type: bool +""" + + +EXAMPLES = """ +- name: Set a parameter value and return another one to its default + check_point.gaia.cp_gaia_param: + param_list: + - param_path: gaia.infra.httpd.cp_httpd_configuration.children_core_dumps + value: true + comments: enabled for debugging purpose + - param_path: gaia.infra.rest_api.gunicorn.timeout + use_default: true + +- name: Check which parameters would change, without saving + check_point.gaia.cp_gaia_param: + param_list: + - param_path: gaia.infra.httpd.cp_httpd_configuration.children_core_dumps + value: true + dry_run: true +""" + + +RETURN = """ +set_param: + description: The task result of the set-param request, including the parameters that were set. + returned: always. + type: dict +""" + + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.gaia.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_all +from ansible_collections.check_point.gaia.plugins.module_utils.checkpoint import chkp_api_operation +from ansible_collections.check_point.gaia.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_async + + +# check if any of the parameters has changed +def has_changed(result): + try: + details = result['set_param']['tasks'][0]['task-details'][0] + except (KeyError, IndexError, TypeError): + # no task details (wait_for_task is false), assume a change + return True + + if 'changed-params' in details: + return details['changed-params'] > 0 + return any(param.get('value-changed') for param in details.get('param-list', [])) + + +def main(): + # arguments for the module: + fields = dict( + param_list=dict(type='list', elements='dict', required=True, options=dict( + param_path=dict(type='str', required=True), + value=dict(type='raw'), + comments=dict(type='str'), + use_default=dict(type='bool'), + volatile=dict(type='bool'), + virtual_system_id=dict(type='str') + ), mutually_exclusive=[['value', 'use_default']]), + dry_run=dict(type='bool', default=False), + use_regex=dict(type='bool', default=False) + ) + fields.update(checkpoint_argument_spec_for_async) + fields.update(checkpoint_argument_spec_for_all) + # this API accepts the Virtual System ID only as a string + fields['virtual_system_id'] = dict(type='str', required=False) + module = AnsibleModule(argument_spec=fields, supports_check_mode=True) + api_call_object = 'set-param' + + # check mode uses the API's own dry run, so nothing is saved + if module.check_mode: + module.params['dry_run'] = True + + res = chkp_api_operation(module, api_call_object, read_only=module.check_mode) + res['changed'] = has_changed(res) + + module.exit_json(**res) + + +if __name__ == "__main__": + main() diff --git a/plugins/modules/cp_gaia_param_facts.py b/plugins/modules/cp_gaia_param_facts.py new file mode 100644 index 0000000..227674b --- /dev/null +++ b/plugins/modules/cp_gaia_param_facts.py @@ -0,0 +1,121 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + + +DOCUMENTATION = """ +author: Ameer Asli (@chkp-ameera) +description: +- Show Config Point parameters by full path or prefix. +- To see the parameters documentation go to https:///param_docs/ on the Gaia machine. +module: cp_gaia_param_facts +short_description: Show Config Point parameters. +version_added: '7.1.0' +notes: +- Supports C(check_mode). +requirements: +- supported starting from gaia_api >= 1.8 +- supported on Gaia versions R82 and above +options: + version: + description: Gaia API version for example 1.8. + required: False + type: str + virtual_system_id: + description: VSX Virtual System ID which presents the context switch. + required: False + type: str + param_path: + description: Parameter full path or prefix, for example C(security-gateway.DLP). + required: True + type: str + filter_by: + description: + - Show only parameters matching the filter, in the format C(=true). + - The filter type can be one of C(modified), C(with-comments) or C(not-default), for example C(modified=true). + required: False + type: str + member_id: + description: SMO member ID of the member to show the data from. Default is the ID of the current login member. + required: False + type: int + wait_for_task: + description: Wait for task or return immediately. + required: False + default: True + type: bool +""" + + +EXAMPLES = """ +- name: Show all DLP parameters + check_point.gaia.cp_gaia_param_facts: + param_path: security-gateway.DLP + +- name: Show only the DLP parameters that were modified + check_point.gaia.cp_gaia_param_facts: + param_path: security-gateway.DLP + filter_by: modified=true +""" + + +RETURN = """ +show_param: + description: + - The task result of the show-param request. + - The matching parameters are in C(tasks[0].task-details[0].param-list), each with its + name, current-value, default-value, description, comments, pending and last-modified. + returned: always. + type: dict +""" + + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.gaia.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_all +from ansible_collections.check_point.gaia.plugins.module_utils.checkpoint import chkp_api_operation +from ansible_collections.check_point.gaia.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_async + + +def main(): + # arguments for the module: + fields = dict( + param_path=dict(type='str', required=True), + filter_by=dict(type='str'), + member_id=dict(type='int') + ) + fields.update(checkpoint_argument_spec_for_async) + fields.update(checkpoint_argument_spec_for_all) + # this API accepts the Virtual System ID only as a string + fields['virtual_system_id'] = dict(type='str', required=False) + module = AnsibleModule(argument_spec=fields, supports_check_mode=True) + api_call_object = 'show-param' + + res = chkp_api_operation(module, api_call_object) + + # this action does not change system configuration + res['changed'] = False + + module.exit_json(**res) + + +if __name__ == "__main__": + main() diff --git a/tests/unit/modules/test_cp_gaia_param.py b/tests/unit/modules/test_cp_gaia_param.py new file mode 100644 index 0000000..d4ccc23 --- /dev/null +++ b/tests/unit/modules/test_cp_gaia_param.py @@ -0,0 +1,136 @@ +#!/usr/bin/env python +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import absolute_import, division, print_function +__metaclass__ = type +import copy +import pytest +from units.modules.utils import set_module_args, exit_json, fail_json, AnsibleExitJson, AnsibleFailJson +from ansible.module_utils import basic +from ansible_collections.check_point.gaia.plugins.modules import cp_gaia_param + +PARAM_PATH = 'gaia.infra.httpd.cp_httpd_configuration.children_core_dumps' + +EXPECTED_RESULT = { + 'tasks': [ + { + 'progress-description': 'succeeded', + 'progress-percentage': 100, + 'status': 'succeeded', + 'status-code': 200, + 'task-details': [ + { + 'changed-params': 1, + 'dry-run': False, + 'matched-params': 1, + 'param-list': [ + { + 'comments': 'enabled for debugging purpose', + 'current-value': True, + 'default-value': False, + 'name': PARAM_PATH, + 'pending': {'action': 'n/a', 'pending_value': 'n/a'}, + 'value-changed': True, + 'virtual-system-id': 0 + } + ], + 'pending-params': 0, + 'sp-members': 'n/a' + } + ], + 'task-name': '/set-param' + } + ] +} + +PAYLOAD = { + 'param_list': [ + { + 'param_path': PARAM_PATH, + 'value': True, + 'comments': 'enabled for debugging purpose' + } + ] +} + +function_path = 'ansible_collections.check_point.gaia.plugins.modules.cp_gaia_param.chkp_api_operation' +api_call_object = 'set-param' + + +def result_with_changed_params(changed_params): + result = copy.deepcopy(EXPECTED_RESULT) + details = result['tasks'][0]['task-details'][0] + details['changed-params'] = changed_params + details['param-list'][0]['value-changed'] = changed_params > 0 + return result + + +class TestCheckpointParam(object): + module = cp_gaia_param + + @pytest.fixture(autouse=True) + def module_mock(self, mocker): + return mocker.patch.multiple(basic.AnsibleModule, exit_json=exit_json, fail_json=fail_json) + + def run_wrapper(self, mocker, changed_params, module_args=None): + api_result = result_with_changed_params(changed_params) + mock_function = mocker.patch(function_path) + # the module computes 'changed' itself, so the operation's value must be ignored + mock_function.side_effect = [{ + "changed": True, + api_call_object.replace('-', '_'): api_result + }] + result = self._run_module(module_args or PAYLOAD) + assert result['changed'] == (changed_params > 0) + assert api_result.items() == result['set_param'].items() + return mock_function + + def test_idempotent(self, mocker): + self.run_wrapper(mocker, 0) + + def test_changed(self, mocker): + self.run_wrapper(mocker, 1) + + def test_check_mode_uses_dry_run(self, mocker): + args = dict(PAYLOAD, _ansible_check_mode=True) + mock_function = self.run_wrapper(mocker, 1, args) + module = mock_function.call_args[0][0] + assert module.params['dry_run'] is True + assert mock_function.call_args[1]['read_only'] is True + + def test_virtual_system_id_is_sent_as_string(self, mocker): + mock_function = self.run_wrapper(mocker, 1, dict(PAYLOAD, virtual_system_id=2)) + # the API rejects a Virtual System ID that is not a string + assert mock_function.call_args[0][0].params['virtual_system_id'] == '2' + + def test_no_task_details_assumes_changed(self, mocker): + mock_function = mocker.patch(function_path) + mock_function.side_effect = [{"changed": True, "set_param": {"task_id": "63c53f94"}}] + result = self._run_module(dict(PAYLOAD, wait_for_task=False)) + assert result['changed'] is True + + def test_value_and_use_default_are_mutually_exclusive(self, mocker): + args = {'param_list': [{'param_path': PARAM_PATH, 'value': True, 'use_default': True}]} + set_module_args(args) + with pytest.raises(AnsibleFailJson): + self.module.main() + + def _run_module(self, module_args): + set_module_args(module_args) + with pytest.raises(AnsibleExitJson) as ex: + self.module.main() + return ex.value.args[0] diff --git a/tests/unit/modules/test_cp_gaia_param_facts.py b/tests/unit/modules/test_cp_gaia_param_facts.py new file mode 100644 index 0000000..728b1b4 --- /dev/null +++ b/tests/unit/modules/test_cp_gaia_param_facts.py @@ -0,0 +1,91 @@ +#!/usr/bin/env python +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import absolute_import, division, print_function +__metaclass__ = type +import pytest +from units.modules.utils import set_module_args, exit_json, fail_json, AnsibleExitJson +from ansible.module_utils import basic +from ansible_collections.check_point.gaia.plugins.modules import cp_gaia_param_facts + +EXPECTED_RESULT = { + 'tasks': [ + { + 'progress-description': 'succeeded', + 'progress-percentage': 100, + 'status': 'succeeded', + 'status-code': 200, + 'task-details': [ + { + 'param-list': [ + { + 'comments': 'n/a', + 'current-value': 30, + 'default-value': 30, + 'description': 'Timeout for Gunicorn workers in seconds', + 'last-modified': 'n/a', + 'name': 'gaia.infra.rest_api.gunicorn.timeout', + 'pending': {'action': 'n/a', 'pending_value': 'n/a'}, + 'virtual-system-id': 0 + } + ] + } + ], + 'task-name': '/show-param' + } + ] +} + +PAYLOAD = { + 'param_path': 'gaia.infra.rest_api.gunicorn.timeout' +} + +function_path = 'ansible_collections.check_point.gaia.plugins.modules.cp_gaia_param_facts.chkp_api_operation' +api_call_object = 'show-param' + + +class TestCheckpointParamFacts(object): + module = cp_gaia_param_facts + + @pytest.fixture(autouse=True) + def module_mock(self, mocker): + return mocker.patch.multiple(basic.AnsibleModule, exit_json=exit_json, fail_json=fail_json) + + def test_show(self, mocker): + mock_function = mocker.patch(function_path) + mock_function.side_effect = [{ + "changed": True, + api_call_object.replace('-', '_'): EXPECTED_RESULT + }] + result = self._run_module(PAYLOAD) + # showing parameters never changes the system + assert result['changed'] is False + assert EXPECTED_RESULT.items() == result['show_param'].items() + assert mock_function.call_args[0][1] == api_call_object + + def test_virtual_system_id_is_sent_as_string(self, mocker): + mock_function = mocker.patch(function_path) + mock_function.side_effect = [{"changed": True, "show_param": EXPECTED_RESULT}] + self._run_module(dict(PAYLOAD, virtual_system_id=2)) + # the API rejects a Virtual System ID that is not a string + assert mock_function.call_args[0][0].params['virtual_system_id'] == '2' + + def _run_module(self, module_args): + set_module_args(module_args) + with pytest.raises(AnsibleExitJson) as ex: + self.module.main() + return ex.value.args[0] From ac431da18920a83e8550252d044247ea91c31847 Mon Sep 17 00:00:00 2001 From: ameera Date: Mon, 2 Nov 2026 16:12:11 +0200 Subject: [PATCH 2/2] Release 7.1.0: update CHANGELOG and version, show task 'errors' field - galaxy.yml: bump the version to 7.1.0. - CHANGELOG.rst: add the 7.1.0 section with all changes since v7.0.0 (new Config Point modules, check mode support, Management Proxy inventory variable, new module parameters and bug fixes). - module_utils: show the error returned in the 'errors' field of a failed task instead of "Look at the logs for more details". - Remove the executable bit from CODEOWNERS.txt; ansible-test sanity (shebang) fails on an executable file without a shebang. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.rst | 47 ++++++++++++++++++++++++++++++ CODEOWNERS.txt | 0 galaxy.yml | 2 +- plugins/module_utils/checkpoint.py | 2 +- 4 files changed, 49 insertions(+), 2 deletions(-) mode change 100755 => 100644 CODEOWNERS.txt diff --git a/CHANGELOG.rst b/CHANGELOG.rst index f4827f4..1f1623b 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -5,6 +5,53 @@ Check_Point.gaia Release Notes .. contents:: Topics +v7.1.0 +====== + +Release Summary +--------------- + +This is release 7.1.0 of ``check_point.gaia``, released on 2026-11-02. + +Major Changes +------------- + +- Check mode (``--check``) is now supported by all modules. Before this release, running a playbook with ``--check`` applied real changes on the machine. Modules now report the change that would be made without making it; read-only operations (``show-`` APIs and ``cp_gaia_simulate_packet``) still run. A diff is also reported outside check mode, so ``--diff`` works on real runs. + +Breaking Changes / Porting Guide +-------------------------------- + +- httpapi - Management Proxy mode is no longer detected by loading ``/etc/ansible/hosts`` (``mgmt_proxy`` host with ``enabled: true``). Set the new inventory variable ``ansible_checkpoint_mgmt_proxy_enabled: true`` instead. + +Minor Changes +------------- + +- cp_gaia_initial_setup - add the ``grub_password`` parameter. +- cp_gaia_ntp - add the ``preferred`` parameter and the ``server`` and ``pool`` server types (Gaia API v1.8 and above). +- cp_gaia_snmp_pre_defined_traps - add the missing ``lowDiskSpace`` trap parameter. +- cp_gaia_ssh_server_settings - add the ``enabled_public_key_algorithms``, ``password_authentication``, ``permit_root_login``, ``use_dns``, ``client_alive_interval`` and ``login_grace_time`` parameters (Gaia API v1.9 and above). +- cp_gaia_banner - document the API limits of the banner message (80 characters per line, 20 lines). +- galaxy.yml - add ``ansible.netcommon`` as a dependency of the collection. +- Add the GPL-3.0 ``LICENSE`` file, matching the module headers and ``galaxy.yml``. + +New Modules +----------- + +- check_point.gaia.cp_gaia_param – set Config Point parameters over Web Services API. +- check_point.gaia.cp_gaia_param_facts – get Config Point parameters over Web Services API. + +Bugfixes +-------- + +- httpapi - fix the connection failing on Python 3.12 and newer ansible-core, and in AAP/AWX, because the plugin loaded the local inventory file. +- module_utils - fix task error reporting: read the correct ``error`` field of a failed task, fail when a succeeded task returns a non-zero ``return-value``, and show a readable message instead of a raw response (with a version hint for 404 errors). +- module_utils - show the error message returned in the ``errors`` field of a failed task instead of a generic message. +- module_utils - fix the idempotency check of lists (order-independent) and of values returned with a different type (for example ``4`` and ``"4"``). +- cp_gaia_run_script - fail and report the script's error when the script returns a non-zero exit code, instead of reporting success. +- cp_gaia_ntp - fix idempotency always reporting ``changed=true``, including on Gaia API versions below v1.8. +- cp_gaia_snmp - fix idempotency of ``contact`` and ``location`` when they contain characters the API returns escaped (``:`` and ``\``). + + v7.0.0 ====== diff --git a/CODEOWNERS.txt b/CODEOWNERS.txt old mode 100755 new mode 100644 diff --git a/galaxy.yml b/galaxy.yml index 89467c7..e672a9b 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -1,7 +1,7 @@ --- namespace: check_point name: gaia -version: 7.0.0 +version: 7.1.0 readme: README.md authors: - Majd Sharkia diff --git a/plugins/module_utils/checkpoint.py b/plugins/module_utils/checkpoint.py index 5348ef2..4ccd59a 100644 --- a/plugins/module_utils/checkpoint.py +++ b/plugins/module_utils/checkpoint.py @@ -64,7 +64,7 @@ def parse_fail_message(code, response): def _task_error_detail(task): details = task.get('task-details') or [] detail = details[0] if details else {} - return detail.get('error') or detail.get('output') or '' + return detail.get('error') or detail.get('errors') or detail.get('output') or '' def _fail_task(module, task, reason='failed', detail=''):