☰

如何通过 Ansible 自动化 BigIP 上的 F5 saas_idp 模板

tag-icon • tag-icon ansible f5-big-ip
如何通过 Ansible 自动化 BigIP 上的 F5 saas_idp 模板

我正在根据以下指示，使用 iApps 模板 f5.saas_idp.v1.0.1rc1 在 IdP 发起模式下部署 BigIP IdP SAML 虚拟服务器https://www.f5.com/pdf/deployment-guides/saml-idp-saas-dg.pdf

它可以通过 BigIP 向导很好地运行，但我希望借助 Ansible 剧本实现自动化和记录部署

- name: Deploy {{ idp_host }} with f5.saas_idp iApp template
  bigip_iapp_service:
    name: "saas_idp_{{ idp_host }}"
    template: f5.saas_idp.v1.0.1rc1
    parameters:
      tables:
        - name: saas_apps__saas_choice
          columnNames:
            - app_name
            - app_selection
            - app_sp
            - sp_initiated
          rows:
            - row:
                - "{{ saml_saas_name }}"
                - "/#zendesk#"
                - "{{ saml_saas_sp }}"
                - no # which means "Yes, IdP and SP"
        - name: saas_apps__saas_attributes
          # Empty
      variables:
        - name: options__advanced_mode
          value: yes
        - name: saas_virtual__addr
          value: "{{ idp_address }}"
        - name: saas_virtual__port
          value: 443
        - name: idp_encryption__cert
          value: /Common/{{ idp_host }}_saml_idp_metadata_cert.crt
        - name: idp_encryption__key
          value: /Common/{{ idp_host }}_saml_idp_metadata_cert.key
        - name: saas_virtual__vlan_listening
          value: enabled
        - name: saas_virtual__vlan_selections
          value: /Common/Internal
        - name: saas_virtual__lan_or_wan
          value: LAN
        - name: saas_virtual__tcp_lan_opt
          value: tcp-lan-optimized
        - name: saas_virtual__http
          value: http
        - name: saas_virtual__clientssl
          value: /Common/clientssl_wildcard_2017-2020
        - name: saas_virtual__chainssl
          name: "/#do_not_use#"
        - name: apm__apm_policy
          value: "/#create_new#"
        - name: apm__saml_entity_id_format
          value: url
        - name: apm__saml_entity_id
          value: https://{{ idp_host }}
        - name: apm__aaa_profile
          value: /Common/AAA_myAD
        - name: apm__logging
          value: /Common/default-log-setting
    force: no
    state: present
    strict_updates: no

但是脚本无法满足要求saas_virtual__key，saas_virtual__cert而saas_virtual__chainssl它们并不是预期的，因为我saas_virtual__clientssl在高级模式中提供了现有的：

message":"script did not successfully complete: (can't read "::saas_virtual__key": no such variable
    while executing
"iapp_conf create $cssl_cmd key $::saas_virtual__key cert $::saas_virtual__cert  chain none"
    invoked from within
"subst $substa_out"
    invoked from within
"if { [info exists [set substa_in]] } {
            set substa_out [subst $$substa_in]
            set substa_out [subst $substa_out]
        } else {
..."
    ("uplevel" body line 3)
    invoked from within
"uplevel {
        append ::substa_debug "
$substa_in"
        if { [info exists [set substa_in]] } {
            set substa_out [subst $$substa_in]
 ..."
    (procedure "iapp_substa" line 9)
    invoked from within
"iapp_substa client_ssl_arr($new_client_ssl,$do_chain_cert)"
    invoked from within
"iapp_conf create ltm virtual ${app}_vs  destination [iapp_destination $::saas_virtual__addr $::saas_virtual__port]  ip-protocol tcp  profiles replace-..."

提供这些变量没有帮助，由于我无法提供密钥密码，脚本无法加载：

Error reading key PEM file /Common/wildcard_2017-2020.key
for profile /Common/saas_idp.app/saas_idp_myidphost_client-
ssl: error:0906A068:PEM routines:PEM_do_header:bad password read

因此，从我的角度来看，最好的选择是使用我现有的客户端 sl 配置文件获取模板。如何进行？有没有办法“调试” iApps 模板脚本，至少检查变量？

答案1

我发现了需要避免的陷阱在哪里 - 在提交变量之前，Ansible 用 True python 布尔对象替换了 yes 值 - 因此丢弃了预期的字符串：

variables:
  - name: options__advanced_mode
    value: "yes"

结果，高级模式未启用，这就是 TCL iApps 执行尝试创建新的 clientssl 配置文件的原因：

# Client SSL Profile
set new_client_ssl [expr { !$advanced || [iapp_is ::saas_virtual__clientssl "/#create_new#"] }]
set do_chain_cert  [expr { $advanced && \
    [info exists ::saas_virtual__chainssl] && \
    ![iapp_is ::saas_virtual__chainssl "/#do_not_use#"] }]

所以 iApps 模板肯定很好......但是为了简化 REST 或 Ansible 的自动化，可以改进输入参数验证以在出现错误消息和堆栈跟踪之前提交相关警告。

相关内容