Registering tags to ip-adresses may fail

[mirakels]

Registering an extra tag to an existing ip-address while specifying both old and new tags fails to add the new tag. See below excerpt:

Show current mappings

    - name: List the IP address to tag mapping to show empty list
      panos_registered_ip_facts:
        provider: "{{ dag }}"
      register: list

    - debug:
        msg: "{{ list | pprint }}"

TASK [List the IP address to tag mapping to show empty list] *************************************************************************************************************************
ok: [localhost]

TASK [debug] *************************************************************************************************************************************************************************

ok: [localhost] => {
    "msg": {
        "changed": false,
        "failed": false,
        "results": {}
    }
}

Register an IP with a single tag

    - name: Register an IP address with 'first-tag'
      panos_registered_ip:
        provider: '{{ dag }}'
        ips: '192.168.1.1'
        tags:  [ 'first_tag' ]
        state: 'present'
      register: list

    - debug:
        msg: "{{ list | pprint }}"

TASK [Register an IP address with 'first-tag'] ***************************************************************************************************************************************
changed: [localhost]

TASK [debug] *************************************************************************************************************************************************************************

ok: [localhost] => {
    "msg": {
        "changed": true,
        "failed": false,
        "results": {
            "192.168.1.1": [
                "first_tag"
            ]
        }
    }
}

Show the mappings again to confirm above result

    - name: List the IP address to tag mapping
      panos_registered_ip_facts:
        provider: "{{ dag }}"
      register: list

    - debug:
        msg: "{{ list | pprint }}"

TASK [List the IP address to tag mapping] ********************************************************************************************************************************************
ok: [localhost]

TASK [debug] *************************************************************************************************************************************************************************

ok: [localhost] => {
    "msg": {
        "changed": false,
        "failed": false,
        "results": {
            "192.168.1.1": [
                "first_tag"
            ]
        }
    }
}

Now register a second tag while also mentioning the first tag. Note that the second tag is not added!!!

    - name: Register same IP address with 'first-tag' and 'second-tag'
      panos_registered_ip:
        provider: '{{ dag }}'
        ips: '192.168.1.1'
        tags:  [ 'first_tag', 'second_tag' ]
        state: 'present'
      register: list

    - debug:
        msg: "{{ list | pprint }}"

TASK [Register same IP address with 'first-tag' and 'second-tag'] ********************************************************************************************************************
ok: [localhost]

TASK [debug] *************************************************************************************************************************************************************************

ok: [localhost] => {
    "msg": {
        "changed": false,
        "failed": false,
        "results": {
            "192.168.1.1": [
                "first_tag"
            ]
        }
    }
}

Verify again

    - name: List the IP address to tag mapping again to show 'second-tag' is not added
      panos_registered_ip_facts:
        provider: "{{ dag }}"
      register: list

    - debug:
        msg: "{{ list | pprint }}"

TASK [List the IP address to tag mapping again to show 'second-tag' is not added] ****************************************************************************************************
ok: [localhost]

TASK [debug] *************************************************************************************************************************************************************************

ok: [localhost] => {
    "msg": {
        "changed": false,
        "failed": false,
        "results": {
            "192.168.1.1": [
                "first_tag"
            ]
        }
    }
}

Only a mapping for the first_tag is listed.
This is probably caused by the comparison of the existing ip-list on the firewall with the ip-list to be changed. The existing list is determined by retrieving ip addresses that have any of the given tags. The proper way may be to determine the existing list by verifying ip-addresses that have all the given tags.

The following code in panos_registered_ip.py may need to be updated:

        registered_ips = device.userid.get_registered_ip(tags=tags)

        if state == 'present':
            # Check to see if IPs actually need to be registered.
            to_add = set(ips) - set(registered_ips.keys())
            if to_add:
                if not module.check_mode:
                    device.userid.register(ips, tags=tags)
                changed = True

In the same way unregistering ip-addresses may fail

[welcome]

🎉 Thanks for opening your first issue here! Welcome to the community!

[github-actions]

🎉 This issue has been resolved in version 2.0.1 🎉

The release is available on Ansible Galaxy and GitHub release

Posted by semantic-release bot