Horizon inventory plugin

Note

This inventory plugin is part of the evertrust.horizon collection (version 2.0.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install evertrust.horizon.

To use it in a playbook, specify: evertrust.horizon.horizon_inventory.

Synopsis

  • Generate hosts inventory from Horizon using an HCQL query.

  • Use a YAML configuration file that ends with horizon_inventory.(yml|yaml).

Parameters

Parameter

Comments

ca_bundle

path

Path of a CA bundle used to validate the Horizon instance SSL certificate.

client_cert

path

Path of a client certificate.

Required if you use certificate based authentication

client_key

path

Path to the private key used for client-certificate authentication.

Required if you use certificate based authentication.

Restrict access to the key and inventory configuration files.

connect_timeout

float

Maximum number of seconds to wait for the controller to establish a connection to Horizon.

Default: 10.0

endpoint

string / required

Your Horizon instance base endpoint.

It must include the protocol (https://) and no trailing slash nor path.

fields

list / elements=string

Fields to be retrieved from Horizon.

If omitted, all fields will be returned.

Choices:

  • "_id"

  • "certificate"

  • "discoveredTrusted"

  • "dn"

  • "holderId"

  • "issuer"

  • "keyType"

  • "labels"

  • "metadata"

  • "module"

  • "notAfter"

  • "notBefore"

  • "owner"

  • "profile"

  • "revocationDate"

  • "revocationReason"

  • "serial"

  • "signingAlgorithm"

  • "subjectAlternateNames"

  • "thirdPartyData"

hostnames

list / elements=string

A list in order of precedence for hostname variables.

To use labels as hostnames use the syntax label.<key>.

Default: []

query

string

HCQL query to filter the results.

read_timeout

float

Maximum number of seconds to wait between response reads by the controller after connecting to Horizon.

Default: 60.0

x_api_id

string

Horizon identifier

Required if you use credentials authentication

x_api_key

string

Secret API key used for Horizon credential authentication.

Required if you use credentials authentication.

Store this value with Ansible Vault.

Tasks containing lookup expressions with this value should use no_log=true.

Examples

plugin: evertrust.horizon.horizon_inventory

endpoint: "https://<horizon-endpoint>"
x_api_id: "<horizon-id>"
x_api_key: "<horizon-password>"

query: "status is valid"
fields:
  - labels
  - module
  - subjectAlternateNames

# Possible values: san.ip, san.dns, discoveryData.ip, discoveryData.Hostname, label.<key>
# To use your host IPs as inventory hostnames, the correct syntax would be label.ansible_host
hostnames:
  - label.ansible_host
  - san.dns

Authors

  • Evertrust R&D (@EverTrust)