cloudera.services.ranger_role module – Manage roles in Apache Ranger

Note

This module is part of the cloudera.services collection (version 1.0.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install git+https://github.com/cloudera-labs/cloudera.services.git.

To use it in a playbook, specify: cloudera.services.ranger_role.

New in cloudera.services 1.1.0

Synopsis 

Create, update, or delete roles in Apache Ranger.

Parameters 

Parameter	Comments
client_cert path	The path to a client certificate for authenticating to the API endpoint.
client_key path	The path to a client key for authenticating to the API endpoint.
debug aliases: debug_endpoints boolean	A flag to enable debug logging of the module’s execution. Choices: `false` ← (default) `true`
description string	Description of the role.
ensure_members_exist aliases: create_non_exist_user_group boolean	Whether to create users or groups referenced by the role that do not yet exist. Choices: `false` ← (default) `true`
force boolean	A flag to force a refresh of the API request, ignoring any cached results. Choices: `false` ← (default) `true`
force_basic_auth boolean	A flag to force basic authentication for API requests. Choices: `false` ← (default) `true`
groups list / elements=dictionary	List of groups assigned to the role.
is_admin boolean	Whether the group has administrative privileges over the role. Choices: `false` ← (default) `true`
name string / required	Name of the group.
http_agent aliases: user_agent string	The User-Agent string to send with API requests. Default: `"cloudera-services-module"`
is_enabled aliases: enabled boolean	Whether the role is enabled. Choices: `false` `true` ← (default)
name string / required	Name of the Ranger role.
options dictionary	A dictionary of additional role options.
page_size aliases: default_page_size integer	The number of items to return per page in a paginated API response. Default: `100`
roles list / elements=dictionary	List of nested roles assigned to the role.
is_admin boolean	Whether the nested role has administrative privileges over the role. Choices: `false` ← (default) `true`
name string / required	Name of the nested role.
state string	Whether the role should be present or absent. Choices: `"present"` ← (default) `"absent"`
timeout aliases: timeout_seconds integer	The timeout in seconds for any API requests. Default: `60`
url aliases: endpoint, endpoint_url string / required	The base URL of the API endpoint, including the port if necessary.
url_password string	The password for authenticating to the API endpoint.
url_username string	The username for authenticating to the API endpoint.
use_gssapi boolean	A flag to enable or disable GSSAPI authentication for API requests. Choices: `false` ← (default) `true`
use_proxy boolean	A flag to enable or disable the use of a proxy for API requests. Choices: `false` `true` ← (default)
users list / elements=dictionary	List of users assigned to the role.
is_admin boolean	Whether the user has administrative privileges over the role. Choices: `false` ← (default) `true`
name string / required	Name of the user.
validate_certs boolean	A flag to enable or disable SSL certificate validation for API requests. Choices: `false` `true` ← (default)

Attributes 

Attribute	Support	Description
check_mode	Support: full	This module supports check mode.
diff_mode	Support: full	This module supports diff mode.

Examples 

# NOTE: Examples do not include connection and authentication fields

- name: Create a Ranger role with users and groups
  cloudera.services.ranger_role:
    name: "test_role"
    description: "A test role"
    users:
      - name: "admin"
        is_admin: true
      - name: "alice"
    groups:
      - name: "data_engineers"

- name: Create a Ranger role with nested roles
  cloudera.services.ranger_role:
    name: "parent_role"
    description: "A role containing other roles"
    roles:
      - name: "viewer_role"
        is_admin: false
      - name: "editor_role"
        is_admin: true

- name: Create a Ranger role and auto-create non-existent users
  cloudera.services.ranger_role:
    name: "new_role"
    description: "Create non-existent users automatically"
    users:
      - name: "bob"
        is_admin: false
      - name: "charlie"
        is_admin: false
    ensure_members_exist: true

- name: Create a Ranger role and auto-create non-existent users and groups
  cloudera.services.ranger_role:
    name: "comprehensive_role"
    description: "Create non-existent users and groups automatically"
    users:
      - name: "dave"
        is_admin: true
      - name: "john"
        is_admin: false
    groups:
      - name: "analytics_team"
        is_admin: false
      - name: "security_team"
        is_admin: true
    ensure_members_exist: true

- name: Delete a Ranger role
  cloudera.services.ranger_role:
    name: "test_role"
    state: "absent"

Return Values 

Common return values are documented here, the following are the fields unique to this module:

Key	Description
role dictionary	A dictionary containing details about the role. Returned: always
create_time integer	Timestamp of when the role was created (epoch millis). Returned: always
created_by string	Username of the creator of the role. Returned: always
created_by_user string	Username of the role creator, as recorded by Ranger. Returned: sometimes
description string	Description of the role. Returned: always
groups list / elements=dictionary	List of groups assigned to the role. Returned: always
is_admin boolean	Whether the group has administrative privileges over the role. Returned: always
name string	Name of the group. Returned: always
guid string	Globally unique identifier of the role. Returned: always
id integer	Unique numeric ID of the role. Returned: always
is_enabled boolean	Whether the role is enabled. Returned: always
name string	Name of the role. Returned: always
options dictionary	Dictionary of additional role options. Returned: always
roles list / elements=dictionary	List of nested roles assigned to the role. Returned: always
is_admin boolean	Whether the nested role has administrative privileges over the role. Returned: always
name string	Name of the nested role. Returned: always
update_time integer	Timestamp of the last update (epoch millis). Returned: always
updated_by string	Username of the last user who updated the role. Returned: always
users list / elements=dictionary	List of users assigned to the role. Returned: always
is_admin boolean	Whether the user has administrative privileges over the role. Returned: always
name string	Name of the user. Returned: always
version integer	Version number of the role definition. Returned: always

Authors 

Ronald Suplina (@rsuplina)

cloudera.services.ranger_role module – Manage roles in Apache Ranger

Synopsis

Parameters

Attributes

Examples

Return Values

Authors

Collection Links