cloudera.services.ranger_policy_info module – Retrieve policy details from Apache Ranger

Note

This module is part of the cloudera.services collection (version 1.0.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install git+https://github.com/cloudera-labs/cloudera.services.git.

To use it in a playbook, specify: cloudera.services.ranger_policy_info.

New in cloudera.services 1.1.0

Synopsis

• Retrieve details of a specific policy by ID or name.

• If no identifier is provided, retrieves all services.

• The module supports check_mode.

Parameters

Parameter	Comments
client_cert path	The path to a client certificate for authenticating to the API endpoint.
client_key path	The path to a client key for authenticating to the API endpoint.
debug aliases: debug_endpoints boolean	A flag to enable debug logging of the module’s execution. Choices: false ← (default) true
force boolean	A flag to force a refresh of the API request, ignoring any cached results. Choices: false ← (default) true
force_basic_auth boolean	A flag to force basic authentication for API requests. Choices: false ← (default) true
http_agent aliases: user_agent string	The User-Agent string to send with API requests. Default: "cloudera-services-module"
name aliases: policy_name string	Name of the Ranger policy. This parameter is mutually exclusive with policy_id.
page_size aliases: default_page_size integer	The number of items to return per page in a paginated API response. Default: 100
policy_id integer	ID of the Ranger policy to retrieve. This parameter is mutually exclusive with name.
service string	Name of the Ranger service associated with the policy. When provided with name, retrieves a specific policy. When provided alone, retrieves all policies for the service.
timeout aliases: timeout_seconds integer	The timeout in seconds for any API requests. Default: 60
url aliases: endpoint, endpoint_url string / required	The base URL of the API endpoint, including the port if necessary.
url_password string	The password for authenticating to the API endpoint.
url_username string	The username for authenticating to the API endpoint.
use_gssapi boolean	A flag to enable or disable GSSAPI authentication for API requests. Choices: false ← (default) true
use_proxy boolean	A flag to enable or disable the use of a proxy for API requests. Choices: false true ← (default)
validate_certs boolean	A flag to enable or disable SSL certificate validation for API requests. Choices: false true ← (default)

Examples

# NOTE: Examples do not include connection and authentication fields

- name: Retrieve policy by ID
  cloudera.services.ranger_policy_info:
    policy_id: 67

- name: Retrieve policy by name and service
  cloudera.services.ranger_policy_info:
    name: "all - global"
    service: "hive"

- name: Retrieve all policies in a specific service
  cloudera.services.ranger_policy_info:
    service: "hive"

- name: Retrieve all policies
  cloudera.services.ranger_policy_info:

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
policies list / elements=dictionary	List of policies matching the given criteria, or all policies if no filter is applied. Returned: always
additional_resources list / elements=dictionary	List of additional resource definitions. Returned: always
is_excludes boolean	Whether the specified values are excluded rather than included. Returned: always
is_recursive boolean	Whether the resource match is applied recursively. Returned: always
values list / elements=string	List of resource values matched by this resource definition. Returned: always
allow_exceptions list / elements=dictionary	List of allow exception policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
conditions list / elements=dictionary	List of policy conditions. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
create_time integer	Epoch timestamp when the policy was created. Returned: always
created_by string	Username of the policy creator. Returned: always
data_mask_policy_items list / elements=dictionary	List of data mask policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
data_mask_info dictionary	The data masking configuration applied by this policy item. Returned: always
condition_expr string	The condition expression controlling when the mask applies. Returned: always
data_mask_type string	The type of data masking to apply. Returned: always
value_expr string	The expression used to compute the masked value. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
deny_exceptions list / elements=dictionary	List of deny exception policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
deny_policy_items list / elements=dictionary	List of deny policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
description string	Optional description of the policy. Returned: always
guid string	Globally unique identifier for the policy. Returned: always
id integer	Unique numeric ID of the policy. Returned: always
is_audit_enabled boolean	Whether auditing is enabled for the policy. Returned: always
is_deny_all_else boolean	Whether the policy denies all accesses not explicitly allowed. Returned: always
is_enabled boolean	Whether the policy is currently enabled. Returned: always
name string	Name of the policy. Returned: always
options dictionary	Dictionary of additional policy options. Returned: always
policy_items list / elements=dictionary	List of allow policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
policy_labels list / elements=string	List of policy labels. Returned: always
policy_priority integer	Priority value for the policy. Returned: always
policy_type integer	Numeric identifier for the type of policy. Returned: always
resource_signature string	Signature hash of the resources in the policy. Returned: always
resources dictionary	Dictionary of resources the policy applies to. Returned: always
is_excludes boolean	Whether the specified values are excluded rather than included. Returned: always
is_recursive boolean	Whether the resource match is applied recursively. Returned: always
values list / elements=string	List of resource values matched by this resource definition. Returned: always
row_filter_policy_items list / elements=dictionary	List of row filter policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
row_filter_info dictionary	The row filter configuration applied by this policy item. Returned: always
filter_expr string	The filter expression applied to rows. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
service string	Name of the service this policy applies to. Returned: always
service_type string	Type of the service (e.g., hive, hdfs) this policy applies to. Returned: always
update_time integer	Epoch timestamp when the policy was last updated. Returned: always
updated_by string	Username of the last person who updated the policy. Returned: always
validity_schedules list / elements=dictionary	List of validity schedules attached to the policy. Returned: always
end_time string	The end time of the validity schedule. Returned: always
recurrences list / elements=dictionary	List of recurrence definitions for the schedule. Returned: always
interval dictionary	The recurrence interval definition. Returned: always
schedule dictionary	The recurrence schedule definition. Returned: always
start_time string	The start time of the validity schedule. Returned: always
time_zone string	The time zone the schedule times are expressed in. Returned: always
version integer	Version number of the policy. Returned: always
zone_name string	Name of the security zone this policy belongs to. Returned: always

Authors

• Ronald Suplina (@rsuplina)

Collection Links

• Issue Tracker
• Repository (Sources)
• Submit a bug report
• Request a feature