Skip to content

Commit cc5fca3

Browse files
DEFERME BertValantin
DEFERME Bert
authored and
Valantin
committed
Documentation on providers
Documentation to pass lint and update references
1 parent adb0fac commit cc5fca3

File tree

10 files changed

+557
-0
lines changed

10 files changed

+557
-0
lines changed

‎README.md‎

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@
2727
* [zabbix-sender](#usage-zabbix-sender)
2828
* [zabbix-userparameters](#usage-zabbix-userparameters)
2929
* [zabbix-template](#usage-zabbix-template)
30+
* [zabbix-authcfg](#usage-zabbix-authcfg)
31+
* [zabbix-user](#usage-zabbix-user)
32+
* [zabbix-usergroup](#usage-zabbix-usergroup)
33+
* [zabbix-role](#usage-zabbix-role)
3034
6. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
3135
7. [Limitations - OS compatibility, etc.](#limitations)
3236
8. [Development - Contributors](#contributors)
@@ -355,6 +359,235 @@ zabbix::template { 'Template App MySQL':
355359
}
356360
```
357361

362+
### Usage zabbix-authcfg
363+
364+
With the `zabbix_authcfg` resource you can configure authentication via the API.
365+
366+
Please be aware of the following limitations:
367+
- You can only make use of this feature when you have configured the module to make use of exported resources.
368+
- Only '1' is supported as the namevar, this is a Zabbix limitation.
369+
- Only tested on Zabbix 6.0.
370+
- Only LDAP and internal authentication are implemented.
371+
372+
You can configure zabbix to use LDAP with the following example:
373+
``` ruby
374+
zabbix_authcfg { '1':
375+
ensure => present,
376+
authentication_type => 'LDAP',
377+
ldap_host => 'ldaps://ldap.example.com'
378+
ldap_port => 636,
379+
ldap_base_dn => 'dc=example,dc=com',
380+
ldap_bind_dn => 'CN=Manager',
381+
ldap_bind_password => Sensitive('my-bind-password'),
382+
ldap_search_attribute => 'sAMAccountName',
383+
ldap_case_sensitive => true,
384+
}
385+
```
386+
387+
### Usage zabbix-user
388+
389+
With the `zabbix_user` resource you can manage users via the API.
390+
391+
Please be aware of the following limitations:
392+
- You can only make use of this feature when you have configured the module to make use of exported resources.
393+
- Only tested on Zabbix 6.0.
394+
- Usergroups (if defined) must exist (you can use `zabbix_usergroup`)
395+
396+
Example:
397+
398+
``` ruby
399+
# Update admin password
400+
zabbix_user { 'NewUser':
401+
ensure => present,
402+
firstname => 'New,
403+
surname => 'User',
404+
role => 'Admin role',
405+
usrgrps => ['Zabbix administrators'],
406+
passwd => Sensitive('a_password'),
407+
}
408+
```
409+
410+
Other supported params:
411+
- `autologin` (boolean)
412+
413+
When you want to use this resource to change the default admin password you can use the helper fact `zbx_admin_passwd_default`:
414+
415+
``` ruby
416+
# Use default password unless the password was changed already
417+
$_server_api_pass = $facts['zbx_admin_passwd_default'] ? {
418+
true => Sensitive('zabbix'),
419+
false => Sensitive('mynewpassword'),
420+
default => Sensitive('zabbix'),
421+
}
422+
423+
class { 'zabbix':
424+
...
425+
zabbix_api_pass => $_server_api_pass,
426+
...
427+
}
428+
429+
# Update admin password
430+
zabbix_user { 'Admin':
431+
ensure => present,
432+
firstname => 'Zabbix',
433+
role => 'Super admin role',
434+
surname => 'Administrator',
435+
usrgrps => ['Zabbix administrators'],
436+
passwd => Sensitive('mynewpassword'),
437+
}
438+
439+
unless $facts['zbx_admin_passwd_default'] {
440+
# Do other stuff with the API
441+
}
442+
443+
```
444+
445+
### Usage zabbix-usergroup
446+
447+
With the `zabbix_usergroup` resource you can manage usergroups via the API.
448+
449+
Please be aware of the following limitations:
450+
- You can only make use of this feature when you have configured the module to make use of exported resources.
451+
- Only tested on Zabbix 6.0.
452+
453+
Example:
454+
455+
``` ruby
456+
# Make sure 'Zabbix administrators' uses internal authentication and add an LDAP administrators group
457+
zabbix_usergroup {
458+
default:
459+
ensure => present,
460+
;
461+
'Zabbix administrators':
462+
gui_access => 'internal',
463+
;
464+
'LDAP administrators':
465+
gui_access => 'LDAP,
466+
;
467+
}
468+
469+
zabbix_user { 'LDAPAdmin':
470+
ensure => present,
471+
firstname => 'LDAP,
472+
role => 'Super admin role',
473+
surname => 'Administrator',
474+
usrgrps => ['LDAP administrators'],
475+
passwd => Sensitive('mynewpassword'),
476+
require => Zabbix_usergroup['LDAP administrators']
477+
}
478+
```
479+
480+
`gui_access` can be one of:
481+
- default (use the default)
482+
- internal
483+
- LDAP
484+
485+
Other supported parameters:
486+
- debug_mode (boolean - default false)
487+
- users_status (boolean - default true)
488+
489+
### Usage zabbix-role
490+
491+
With the `zabbix_role` resource you can manage Zabbix roles and role rules.
492+
493+
Please be aware of the following limitations:
494+
- You can only make use of this feature when you have configured the module to make use of exported resources.
495+
- Only tested on Zabbix 6.0.
496+
- To avoid having to define enormous hashes when just overriding one default rule the provider will ignore any default rules when comparing rules. This means that if you want a role with just one rule enabled you will have to define a hash that overrides all defaults.
497+
498+
For the role rules syntax (and information on defaults) please refer to the official zabbix documentation: https://www.zabbix.com/documentation/current/en/manual/api/reference/role/object
499+
500+
Example:
501+
``` ruby
502+
# Create custom production role (and its rules)
503+
$_production_role_rules = {
504+
'ui' => [
505+
{
506+
'name' => 'configuration.actions',
507+
'status' => '0'
508+
},
509+
{
510+
'name' => 'configuration.discovery',
511+
'status' => '0'
512+
},
513+
{
514+
'name' => 'configuration.host_groups',
515+
'status' => '0'
516+
},
517+
{
518+
'name' => 'configuration.hosts',
519+
'status' => '0'
520+
},
521+
{
522+
'name' => 'configuration.templates',
523+
'status' => '0'
524+
},
525+
],
526+
'ui.default_access' => '1',
527+
'services.read.mode' => '1',
528+
'services.write.mode' => '0',
529+
'modules.default_access' => '0',
530+
'api.access' => '0',
531+
'actions' => [
532+
{
533+
'name' => 'edit_dashboards',
534+
'status' => '1',
535+
},
536+
{
537+
'name' => 'edit_maps',
538+
'status' => '1',
539+
},
540+
{
541+
'name' => 'acknowledge_problems',
542+
'status' => '1',
543+
},
544+
{
545+
'name' => 'close_problems',
546+
'status' => '1',
547+
},
548+
{
549+
'name' => 'change_severity',
550+
'status' => '1',
551+
},
552+
{
553+
'name' => 'add_problem_comments',
554+
'status' => '1',
555+
},
556+
{
557+
'name' => 'execute_scripts',
558+
'status' => '0',
559+
},
560+
{
561+
'name' => 'edit_maintenance',
562+
'status' => '1',
563+
},
564+
{
565+
'name' => 'manage_scheduled_reports',
566+
'status' => '1',
567+
},
568+
{
569+
'name' => 'manage_sla',
570+
'status' => '1',
571+
},
572+
],
573+
'actions.default_access' => '1',
574+
}
575+
576+
zabbix_role { 'Production role':
577+
ensure => present,
578+
type => 'Admin',
579+
rules => $_production_role_rules,
580+
}
581+
582+
Type can be one of:
583+
- User
584+
- Admin
585+
- Super admin
586+
587+
Other supported params:
588+
- readonly (boolean - default false)
589+
```
590+
358591
## Zabbix Upgrades
359592
360593
It is possible to do upgrades via this module. An example for the zabbix agent:

0 commit comments

Comments
 (0)