FlashBlade Collection 1.29.0

v1.29.0

Minor Changes

• CI - The artifact job now fails on any symlink in the build, on unreleased fragments or test files being shipped, and when CHANGELOG.rst has no section for the version in galaxy.yml. It also runs ansible-lint against the artifact, not only ansible-test sanity.
• CI - The certification workflow now also builds the collection and runs sanity against the built artifact, not only the source tree, and fails if a non user-facing file is shipped.
• README - Converted the badge block from unbalanced raw HTML to markdown image links, and reconciled the Available Modules list against the collection - it listed 64 of 66 modules, omitting purefb_admin and purefb_tz.
• README - Fixed a typo in the CI badge organisation path, pointed the Release Notes section at the changelog shipped with the collection, dropped the redundant ansible-core requirement which is already declared by requires_ansible in meta/runtime.yml, and changed the author line to a mailto: URL rather than a bare address used as a link target.
• README.rst - Replaced the repository-relative license link with a full URL, so that it resolves when the file is rendered outside the repository.
• collection - Added tests/config.yml declaring python_requires of >=3.9, matching the Python version stated in the README. The 81 entries in tests/sanity/ignore-2.16.txt existed only to suppress the Python 2.7 compile and import tests one file at a time, so the ignore file is no longer needed and has been removed.
• collection - Added a build_ignore section to galaxy.yml so that the published tarball holds only user-facing content. settings.json, .github, pytest.ini, .yamllint, .gitignore, .git-blame-ignore-revs, changelogs/.plugin-cache.yaml, README.rst and the empty .keep placeholders are no longer installed onto customer systems or pulled into execution environment images. changelogs/changelog.yaml still ships alongside the rendered CHANGELOG.rst.
• collection - Added an .ansible-lint file setting the production profile, excluding only non-content directories, and adding no-log-password to the warning list.
• collection - Completed the rebranding from Pure Storage to Everpure. README.rst badge URLs, the .github/CONTRIBUTING.md title and issue link, and a copyright line in the purefb_tls_policy unit test all still referred to the previous identity.
• collection - Fixed the YAML indentation that ansible-lint reports on the built collection. These were suppressed while .yamllint shipped inside the tarball; it is development tooling and no longer ships, so the sequences in meta/runtime.yml and nine module documentation blocks are indented conformantly instead. A documentation formatting change only - every DOCUMENTATION, EXAMPLES and RETURN block parses to exactly the same content as before.
• collection - Removed the playbooks/roles symlink, stopped shipping tests/README.md which documents the excluded tests/unit directory, and narrowed the changelogs exclusion so that only changelog.yaml ships. A symlink is recorded in FILES.json as an ordinary directory with a null checksum, so nothing behind it is verified, and content scanners routinely skip symlinks.
• purefb_info - added smb_share_policies, network_access_policies, worm_data_policies, tls_policies and s3_export_policies (with their rules or members) to the policies subset, object_store_virtual_hosts to buckets, object_store_account_exports to accounts, config.kmip to config, and a new realms subset reporting realms and resource_accesses; each is gated on the REST API version that introduced it.
• purefb_info - the default section reports the login banner so that purefb_banner changes can be read back and the previous text restored.
• purefb_remote_cred - new force option to re-send a secret under an unchanged access key ID, because the secret cannot be read back from the array.

Bugfixes

• purefb_ad - an omitted join_ou no longer forces a change on every run; the OU-with-encryption guard now compares the lists.
• purefb_admin - omitted options leave the setting unchanged instead of resetting min_password to 1, crashing on lockout or reporting a change for max_login.
• purefb_apiclient - hyphens are accepted in client names, the naming error names the API client, and a missing role at creation fails with a clear message.
• purefb_bucket - default_retention, retention_mode, object_lock_enabled and freeze_locked_objects are applied to existing buckets idempotently instead of being ignored; fixed a TypeError when updating a bucket that has a default retention without passing default_retention. hard_limit=false is honoured on create and update.
• purefb_bucket - a bucket created without public-access options no longer gets block_public_access and block_new_public_policies forced to false or a world-readable default access policy rule; array defaults are kept and only requested settings are applied.
• purefb_bucket - eradication config changes were sent in the wrong request field; eradication_mode is now applied on create and update. eradication_delay and manual_eradication are read-only on a bucket at every REST API version (the array rejects them with "Invalid body parameter") and are inherited from the array-wide eradication config, so the module now fails early with a message naming where they are set instead of sending them. Destroy and eradicate failures fail the task instead of only warning. Documented that freeze_locked_objects=true cannot be combined with versioning=enabled and that default_retention is in days.
• purefb_bucket_access - effect=deny is rejected with an error because the FlashBlade REST API only supports allow and silently stored such rules as allow. Changing an existing access or CORS rule in place is applied (the rule is replaced) instead of reporting no change, and deleting a CORS rule by name no longer has its existence check inverted. After creating or replacing a rule the module compares what the array stored with the request and fails, naming the stored rule, when the array kept something else (for example an action other than s3:GetObject); previously such a rule was replaced again on every run.
• purefb_bucket_replica - modifying a replica link without target no longer raises TypeError; creating a link without credential fails with a clear message.
• purefb_certgrp - fixed the status_code typo that broke every group creation, corrected the certificate add/remove calls to the certificate_groups_certificates endpoints, and made adding and removing certificates idempotent.
• purefb_certs - state=present on an existing certificate compares the requested attributes with the certificate on the array and only re-issues it when something differs or generate is true; key_size and key_algorithm are only sent together with generate_new_key. key_algorithm is honoured at creation and the CSR file is written in one piece.
• purefb_connect - state=absent no longer crashes with TypeError (the SDK item iterator was indexed directly), so an array connection can be removed again.
• purefb_connect - fixed a NameError when setting a throttle on an unthrottled connection; the bandwidth range check now rejects out-of-range values.
• purefb_dns - updating a DNS configuration without source no longer sends an empty source reference.
• purefb_ds - state=present no longer crashes for an LDAP-based nfs service, enable=false is applied, force_bind_password without a bind_password is a no-op, bind_password is no longer mandatory alongside uri, and state=test with nfs_server works.
• purefb_dsrole - state=absent no longer reports a change for a role with no group mapping.
• purefb_export - fixed a NameError when creating an export in check mode.
• purefb_fleet - adding a member fails with a clear message when only one of member_url and member_api is supplied instead of crashing.
• purefb_fs - hard_limit, fastremove and snapshot are now applied when modifying an existing filesystem and are idempotent in both directions. smb, http, snapshot, fastremove, hard_limit and safeguard_acls no longer carry a default, so an omitted flag leaves the filesystem alone and an explicit false turns the setting off.
• purefb_fs - policy_state=absent is idempotent; detaching a policy that is not attached no longer fails on the second run. group_ownership and storage_class are applied at creation for filesystems without SMB, and eradicating a realm filesystem uses the qualified name.
• purefb_fs_replica - the module now uses the py-pure-client API (it failed on every run); state=absent with policy removes the policy and without policy deletes the link.
• purefb_hardware - fixed an UnboundLocalError when a connector is named without speed, and omitted enabled or ports no longer report a change.
• purefb_info - Fixed a traceback when gathering the lags or subnets subsets, or all, on a FlashBlade running in Layer 3 (BGP) mode, where the link aggregation groups endpoint returns an error and the data subnets have no LAG. The lag subset is now empty and such subnets report a null lag.
• purefb_info - The drives and servers subsets now apply their API-version check when requested explicitly, not only as part of all.
• purefb_info - gather_subset=fleet now returns the fleet section; previously the data was only produced as part of the policies subset.
• purefb_info - gather_subset=policies (and all) no longer crashes with AttributeError when any bucket has a CORS policy; CORS policies report their rules.
• purefb_info - gather_subset=replication (and all) no longer crashes with AttributeError when a filesystem replica link exists; the link status detail is read from the SDK's status_details attribute.
• purefb_info - network.<interface>.server and .subnet were always null; server now reports the attached server and a new attached_servers list is included. config.dns.<name>.source and the certificate certificate_type and intermediate_certificate values were always null due to misspelt attribute reads.
• purefb_info - share_policies actually contains SMB client policies; it is kept and also available as smb_client_policies, with real SMB share policies under smb_share_policies. multi_protocol.safeguard_acls is added alongside the misspelt safegaurd_acls key.
• purefb_keytabs - state=export reports no change; state=rotate fails cleanly when no AD account exists.
• purefb_lag - LAG creation no longer fails with an AttributeError whenever an existing LAG has ports, the in-use check tests every requested port, debug warnings are gone, and fully qualified CHx.FMy.ETHz port names are accepted.
• purefb_mgmt_policy - policies can be created with rules on REST API 2.19 to 2.25 (Purity//FB 4.6), where the rule list travels inline with the policy; the management policy is treated as built-in. Comparing the inline rule list no longer raises AttributeError for a rule whose role or scope reference is null.
• purefb_ntp - state=absent no longer reports a change when no NTP servers are configured.
• purefb_password_policy - min_character_groups and min_characters_per_group can be cleared with 0 and compare idempotently when disabled.
• purefb_policy - anonuid and anongid are integer options and are sent in the form the array accepts (strings up to REST 2.21, integers from 2.22); NFS export rules that set them no longer fail SDK validation or the array's "invalid value for anonuid" check. Object store access rule effect changes now reach the array (the SDK response model dropped effect from the PATCH body), and SMB share rules are addressed by principal within the policy with a PATCH body limited to the changed permissions; before_rule is rejected for share policies.
• purefb_policy - enabled now works for existing snapshot policies, a snapshot rule is only added when no existing rule matches, and a rule can be added to an empty policy. rename of a snapshot policy is verified after the PATCH and fails with a clear message where Purity//FB ignores it (REST 2.21 has no snapshot policy rename) instead of reporting a change every run.
• purefb_policy - policy_type=network failed on every array that is a member of a fleet with TypeError ... unexpected keyword argument 'context_names', including state=absent on a policy that does not exist. The network-access-policies endpoints take no fleet context, so the context defaulted for fleet members is no longer sent to them.
• purefb_policy - policy_type=network no longer raises AttributeError; the module reports that network access policies cannot be created or deleted by the REST API and manages the rules of the existing policy, with interfaces compared order-insensitively and no fleet context sent.
• purefb_policy - state=copy copies snapshot, NFS, SMB and WORM policies (settings plus rules) to target and fails clearly where a copy is impossible instead of silently doing nothing; copied object store access rules keep their effect.
• purefb_policy - a repeated state=present on an SMB share policy rule no longer crashes with TypeError; permissions are compared as strings and "" clears a permission idempotently. Share permissions are compared as the array stores them (a single effect over the ladder read < change < full_control), so full_control=deny next to read/change allow is "not granted" and repeating the creation task is a no-op instead of turning the rule into deny-all. Deleting an SMB share principal rule that is already gone no longer raises IndexError.
• purefb_policy - an update to an NFS export rule that left security unset sent the stored list back sorted, which can reorder a client's sec= preference. The stored order is now kept.
• purefb_policy - changing effect on an existing object store access policy rule is applied, and rule lists are compared order-insensitively.
• purefb_policy - rule fields not set in a task (permission, access, atime, fileid_32bit, secure, security, smb_encryption, effect) keep their current value on update; defaults apply only when a rule is created. Renaming a WORM data policy no longer raises AttributeError.
• purefb_policy - updating an NFS export rule that has anonuid or anongid failed with invalid value for anonuid, even for a change that only touched another field such as atime. The array accepts the ids as integers on create but only as strings on update, so an update now sends them as strings on every REST version.
• purefb_proxy, purefb_eula - check mode reports whether the setting would change.
• purefb_realm - without_default_access_list now defaults to true because Purity//FB requires it for realm creation; the failure message explains this when false is rejected. Fixed rename (AttributeError on patch_realm) and a crash in the QoS policy update for realms without a QoS policy; repeating a completed rename is a no-op.
• purefb_remote_cred - updating an existing credential is idempotent; the array is only patched when the access key ID differs or the new force option is set.
• purefb_resource_access - documentation lists the resource types a realm scope accepts (subnets, dns) instead of the rejected policies/nfs example.
• purefb_s3_export_policy, purefb_s3acc_export - no longer send a fleet context on arrays that are not in a fleet ("Cannot find array in fleet"); rename is idempotent and rules are reconciled before a rename.
• purefb_s3acc - fixed the user-existence check on delete (stray apostrophe in the user glob).
• purefb_s3user - Added an explicit no_log=False to the access_key and enable_key parameters. Both are switches rather than credentials, but validate-modules treats any option whose name ends in key as a potential secret and raises no-log-needed unless it is marked. Their neighbours imported_key and key_name were already marked.
• purefb_s3user - an imported_key that already exists is no longer re-imported on every run; a rejected key import during user creation now fails the task with the array's error instead of silently deleting the new user and reporting changed; invalid entries in policy no longer cause the following policy to be skipped; documentation no longer claims that pure:policy/full-access is added when policy is omitted.
• purefb_saml - the signing credential is sent as the signing credential on update; state=test reports no change.
• purefb_smtp - encryption="" is idempotent against an array with no encryption mode, and host="" now clears the relay host.
• purefb_snap - state=absent on an already destroyed snapshot no longer eradicates it unless eradicate=true is set. state=restore honours suffix; without one the latest snapshot is used (fixed a crash when sorting snapshots). Fixed the inverted target connection check.
• purefb_snmp_agent, purefb_snmp_mgr - comparison is limited to the readable attributes of the selected SNMP version, so v2c and v3 updates are idempotent; the v2c community string and the v3 passphrases, which the array returns masked, are sent only when the version or another setting changes, and an omitted parameter keeps the current value. Passphrase length validation now works and a failed manager lookup fails cleanly instead of raising IndexError.
• purefb_subnet - mtu and vlan no longer default on modification, so an omitted value leaves the subnet alone and a VLAN ID of 0 can be set; creation still defaults to 1500 and 0.
• purefb_syslog - state=test reports changed=false and returns only the results for the named server.
• purefb_target - changing a target address uses patch_targets instead of a removed 1.x SDK attribute.
• purefb_tls_policy - documented that appliance_certificate is required at creation and that client_certificates_required needs verify_client_certificate_trust; creation without an appliance certificate fails early with a clear message.
• purefb_tz - fixed the HAS_PYTZ typo that hid a missing pytz.
• purefb_user - api=true no longer fails on a user without an existing token, the default timeout of 0 creates a non-expiring token instead of raising Invalid time format, setting public_key at creation no longer calls a non-existent SDK method, state=absent on a missing local user is a no-op, clear_lock unlocks the user, and an omitted role no longer demotes an existing user to readonly.
• purefb_user - public_key is documented and validated as an OpenSSH authorized_keys entry (ssh-rsa/ssh-ed25519, at most two, one per line); a PEM block is rejected with a clear message instead of the array's "At most 2 public keys can be uploaded for a user". Keys are compared by type and key material so re-applying the same key (or a different comment) is not a change, public_key="" only clears a key that is set, and a key the array masks as **** is treated as present.
• purefb_userpolicy - state=show reports changed=false; array-wide show without account and name no longer raises TypeError.
• purefb_userquota, purefb_groupquota - uid/gid 0 is accepted; one of uid/uname (gid/gname) is now required instead of crashing when both are omitted.
• purefb_virtualhost - deleting a virtual host, or re-asserting an existing one, is no longer blocked once 10 hosts exist; hitting the cap on add is now an error.