Skip to content

Commit 3548c8c

Browse files
author
DEFERME Bert
committed
Documentation on providers
1 parent f8e69ac commit 3548c8c

File tree

1 file changed

+233
-0
lines changed

1 file changed

+233
-0
lines changed

‎README.md‎

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@
2727
* [zabbix-sender](#usage-zabbix-sender)
2828
* [zabbix-userparameters](#usage-zabbix-userparameters)
2929
* [zabbix-template](#usage-zabbix-template)
30+
* [zabbix-authcfg](#usage-zabbix-authcfg)
31+
* [zabbix-user](#usage-zabbix-user)
32+
* [zabbix-usergroup](#usage-zabbix-usergroup)
33+
* [zabbix-role](#usage-zabbix-role)
3034
6. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
3135
7. [Limitations - OS compatibility, etc.](#limitations)
3236
8. [Development - Contributors](#contributors)
@@ -365,6 +369,235 @@ zabbix::template { 'Template App MySQL':
365369
}
366370
```
367371

372+
### Usage zabbix-authcfg
373+
374+
With the `zabbix_authcfg` resource you can configure authentication via the API.
375+
376+
Please be aware of the following limitations:
377+
- You can only make use of this feature when you have configured the module to make use of exported resources.
378+
- Only '1' is supported as the namevar, this is a Zabbix limitation.
379+
- Only tested on Zabbix 6.0.
380+
- Only LDAP and internal authentication are implemented.
381+
382+
You can configure zabbix to use LDAP with the following example:
383+
``` ruby
384+
zabbix_authcfg { '1':
385+
ensure => present,
386+
authentication_type => 'LDAP',
387+
ldap_host => 'ldaps://ldap.example.com'
388+
ldap_port => 636,
389+
ldap_base_dn => 'dc=example,dc=com',
390+
ldap_bind_dn => 'CN=Manager',
391+
ldap_bind_password => Sensitive('my-bind-password'),
392+
ldap_search_attribute => 'sAMAccountName',
393+
ldap_case_sensitive => true,
394+
}
395+
```
396+
397+
### Usage zabbix-user
398+
399+
With the `zabbix_user` resource you can manage users via the API.
400+
401+
Please be aware of the following limitations:
402+
- You can only make use of this feature when you have configured the module to make use of exported resources.
403+
- Only tested on Zabbix 6.0.
404+
- Usergroups (if defined) must exist (you can use `zabbix_usergroup`)
405+
406+
Example:
407+
408+
``` ruby
409+
# Update admin password
410+
zabbix_user { 'NewUser':
411+
ensure => present,
412+
firstname => 'New,
413+
surname => 'User',
414+
role => 'Admin role',
415+
usrgrps => ['Zabbix administrators'],
416+
passwd => Sensitive('a_password'),
417+
}
418+
```
419+
420+
Other supported params:
421+
- `autologin` (boolean)
422+
423+
When you want to use this resource to change the default admin password you can use the helper fact `zbx_admin_passwd_default`:
424+
425+
``` ruby
426+
# Use default password unless the password was changed already
427+
$_server_api_pass = $facts['zbx_admin_passwd_default'] ? {
428+
true => Sensitive('zabbix'),
429+
false => Sensitive('mynewpassword'),
430+
default => Sensitive('zabbix'),
431+
}
432+
433+
class { 'zabbix':
434+
...
435+
zabbix_api_pass => $_server_api_pass,
436+
...
437+
}
438+
439+
# Update admin password
440+
zabbix_user { 'Admin':
441+
ensure => present,
442+
firstname => 'Zabbix',
443+
role => 'Super admin role',
444+
surname => 'Administrator',
445+
usrgrps => ['Zabbix administrators'],
446+
passwd => Sensitive('mynewpassword'),
447+
}
448+
449+
unless $facts['zbx_admin_passwd_default'] {
450+
# Do other stuff with the API
451+
}
452+
453+
```
454+
455+
### Usage zabbix-usergroup
456+
457+
With the `zabbix_usergroup` resource you can manage usergroups via the API.
458+
459+
Please be aware of the following limitations:
460+
- You can only make use of this feature when you have configured the module to make use of exported resources.
461+
- Only tested on Zabbix 6.0.
462+
463+
Example:
464+
465+
``` ruby
466+
# Make sure 'Zabbix administrators' uses internal authentication and add an LDAP administrators group
467+
zabbix_usergroup {
468+
default:
469+
ensure => present,
470+
;
471+
'Zabbix administrators':
472+
gui_access => 'internal',
473+
;
474+
'LDAP administrators':
475+
gui_access => 'LDAP,
476+
;
477+
}
478+
479+
zabbix_user { 'LDAPAdmin':
480+
ensure => present,
481+
firstname => 'LDAP,
482+
role => 'Super admin role',
483+
surname => 'Administrator',
484+
usrgrps => ['LDAP administrators'],
485+
passwd => Sensitive('mynewpassword'),
486+
require => Zabbix_usergroup['LDAP administrators']
487+
}
488+
```
489+
490+
`gui_access` can be one of:
491+
- default (use the default)
492+
- internal
493+
- LDAP
494+
495+
Other supported parameters:
496+
- debug_mode (boolean - default false)
497+
- users_status (boolean - default true)
498+
499+
### Usage zabbix-role
500+
501+
With the `zabbix_role` resource you can manage Zabbix roles and role rules.
502+
503+
Please be aware of the following limitations:
504+
- You can only make use of this feature when you have configured the module to make use of exported resources.
505+
- Only tested on Zabbix 6.0.
506+
- To avoid having to define enormous hashes when just overriding one default rule the provider will ignore any default rules when comparing rules. This means that if you want a role with just one rule enabled you will have to define a hash that overrides all defaults.
507+
508+
For the role rules syntax (and information on defaults) please refer to the official zabbix documentation: https://www.zabbix.com/documentation/current/en/manual/api/reference/role/object
509+
510+
Example:
511+
``` ruby
512+
# Create custom production role (and its rules)
513+
$_production_role_rules = {
514+
'ui' => [
515+
{
516+
'name' => 'configuration.actions',
517+
'status' => '0'
518+
},
519+
{
520+
'name' => 'configuration.discovery',
521+
'status' => '0'
522+
},
523+
{
524+
'name' => 'configuration.host_groups',
525+
'status' => '0'
526+
},
527+
{
528+
'name' => 'configuration.hosts',
529+
'status' => '0'
530+
},
531+
{
532+
'name' => 'configuration.templates',
533+
'status' => '0'
534+
},
535+
],
536+
'ui.default_access' => '1',
537+
'services.read.mode' => '1',
538+
'services.write.mode' => '0',
539+
'modules.default_access' => '0',
540+
'api.access' => '0',
541+
'actions' => [
542+
{
543+
'name' => 'edit_dashboards',
544+
'status' => '1',
545+
},
546+
{
547+
'name' => 'edit_maps',
548+
'status' => '1',
549+
},
550+
{
551+
'name' => 'acknowledge_problems',
552+
'status' => '1',
553+
},
554+
{
555+
'name' => 'close_problems',
556+
'status' => '1',
557+
},
558+
{
559+
'name' => 'change_severity',
560+
'status' => '1',
561+
},
562+
{
563+
'name' => 'add_problem_comments',
564+
'status' => '1',
565+
},
566+
{
567+
'name' => 'execute_scripts',
568+
'status' => '0',
569+
},
570+
{
571+
'name' => 'edit_maintenance',
572+
'status' => '1',
573+
},
574+
{
575+
'name' => 'manage_scheduled_reports',
576+
'status' => '1',
577+
},
578+
{
579+
'name' => 'manage_sla',
580+
'status' => '1',
581+
},
582+
],
583+
'actions.default_access' => '1',
584+
}
585+
586+
zabbix_role { 'Production role':
587+
ensure => present,
588+
type => 'Admin',
589+
rules => $_production_role_rules,
590+
}
591+
592+
Type can be one of:
593+
- User
594+
- Admin
595+
- Super admin
596+
597+
Other supported params:
598+
- readonly (boolean - default false)
599+
```
600+
368601
## Zabbix Upgrades
369602
370603
It is possible to do upgrades via this module. An example for the zabbix agent:

0 commit comments

Comments
 (0)