cisco.catalystcenter.compliance_policys_rules_conditions module -- Resource module for Compliance Policys Rules Conditions

Note

This module is part of the cisco.catalystcenter collection (version 2.12.0).

To install it, use: ansible-galaxy collection install cisco.catalystcenter. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: cisco.catalystcenter.compliance_policys_rules_conditions.

New in cisco.catalystcenter 2.3.0

Synopsis 

Manage operations create, update and delete of the resource Compliance Policys Rules Conditions.
This API operation creates a new condition within the specified compliance policy and rule.
Deletes a specific condition within the specified compliance policy and rule.
Updates an existing compliance condition within the specified compliance policy and rule.

Note

This module has a corresponding action plugin.

Requirements 

The below requirements are needed on the host that executes this module.

catalystcentersdk >= 3.2.3.0.0
python >= 3.12

Parameters 

Parameter	Comments
action dictionary	Specifies actions based on condition outcomes, guiding subsequent operational steps.
doesNotMatchAction string	Action to take when the condition does not match. The choice of action influences whether a violation is logged and whether further conditions are evaluated. Options include - `DO_NOT_RAISE_VIOLATION_AND_CONTINUE` No violation is raised, and processing continues. - `DO_NOT_RAISE_VIOLATION_AND_STOP` No violation is raised, and processing stops. - `RAISE_VIOLATION_AND_CONTINUE` A violation is raised, but processing continues. - `RAISE_VIOLATION_AND_STOP` A violation is raised, and processing stops. Additionally, depending on `matchAction`, value must satisfy following criteria - `doesNotMatchAction` cannot be same as `matchAction`. - Both `doesNotMatchAction` and `matchAction` cannot raise violation in a single condition.
doesNotMatchViolationMessage string	Specify the custom violation message to be used to report violations when the condition does not match and raises violation. This field is applicable and required when `doesNotMatchViolationMessageType` is `CUSTOM_MESSAGE`. Custom variables and automatically generated regular expression group variables can both be used in this field, similar to how they are used in the `value` field.
doesNotMatchViolationMessageType string	The type of message to display when the condition does not match and results in a violation. This provides context about the violation. This field is applicable and required when `doesNotMatchAction` is either `RAISE_VIOLATION_AND_CONTINUE` or ` RAISE_VIOLATION_AND_STOP`. Options include - `DEFAULT_MESSAGE` Use the automatic violation message generated by the system based on condition scope, operator, and value. - `CUSTOM_MESSAGE` Use the violation message specified by the user in `matchViolationMessage` field.
doesNotMatchViolationSeverity string	The severity level of the violation.
matchAction string	Action to take when the condition matches. The choice of action influences whether a violation is logged and whether further conditions are evaluated. Options include - `DO_NOT_RAISE_VIOLATION_AND_CONTINUE` No violation is raised, and processing continues. - `DO_NOT_RAISE_VIOLATION_AND_STOP` No violation is raised, and processing stops. - `RAISE_VIOLATION_AND_CONTINUE` A violation is raised, but processing continues. - `RAISE_VIOLATION_AND_STOP` A violation is raised, and processing stops.
matchViolationMessage string	Specify the custom violation message to be used to report violations when the condition matches and raises violation. This field is applicable and required when `matchViolationMessageType` is `CUSTOM_MESSAGE`. Custom variables and automatically generated regular expression group variables can both be used in this field, similar to how they are used in the `value` field.
matchViolationMessageType string	The type of message to display when the condition matches and results in a violation. This provides context about the violation. This field is applicable and required when `matchAction` is either `RAISE_VIOLATION_AND_CONTINUE` or ` RAISE_VIOLATION_AND_STOP`. Options include - `DEFAULT_MESSAGE` Use the automatic violation message generated by the system based on condition scope, operator, and value. - `CUSTOM_MESSAGE` Use the violation message specified by the user in `matchViolationMessage` field.
matchViolationSeverity string	The severity level of the violation.
blockEndExpression string	The regular expression defining the end of a block. If not specified, block parsing will continue until new section starts in the configuration. This is applicable only when `parseAsBlocks` is set. This is an optional field. The value, when provided, must be a valid regular expression.
blockStartExpression string	The regular expression defining the start of a block. This is used to identify the beginning of relevant configuration sections. This is applicable and required only when `parseAsBlocks` is set. The value must be a valid regular expression.
blockViolationCriteria string	Criteria determining when a violation is raised based on block evaluation results. This allows for flexible compliance checks depending on whether a single failure or all failures should trigger a violation. Options are - `RAISE_FOR_EACH_VIOLATION` Violations are raised for each block that fails the evaluation criteria. - `RAISE_SINGLE_FOR_ANY_VIOLATION` A single violation is raised if any one of the blocks fails the evaluation criteria. Further processing of blocks is stopped as soon as a violation is detected and raised. - `RAISE_IF_ALL_VIOLATED` A single violation is raised only if all the blocks fail the evaluation criteria.
catalystcenter_debug aliases: dnac_debug boolean	Flag for Cisco Catalyst Center SDK to enable debugging. Choices: :ansible-option-choices-entry-default:`false` ← (default) :ansible-option-choices-entry:`true`
catalystcenter_host aliases: dnac_host string / required	The Cisco Catalyst Center hostname.
catalystcenter_password aliases: dnac_password string	The Cisco Catalyst Center password to authenticate.
catalystcenter_port aliases: dnac_port, catalystcenter_api_port integer	The Cisco Catalyst Center port. Default: :ansible-option-default:`443`
catalystcenter_username aliases: dnac_username, user string	The Cisco Catalyst Center username to authenticate. Default: :ansible-option-default:`"admin"`
catalystcenter_verify aliases: dnac_verify boolean	Flag to enable or disable SSL certificate verification. Choices: :ansible-option-choices-entry:`false` :ansible-option-choices-entry-default:`true` ← (default)
catalystcenter_version aliases: dnac_version string	Informs the SDK which version of Cisco Catalyst Center to use. Default: :ansible-option-default:`"3.1.6.0"`
deviceProperty string	The specific device property to consider as source for the condition. This is applicable and required when scope is `DEVICE_PROPERTIES`. Possible values include - `DEVICE_NAME` Hostname of the device. - `IP_ADDRESS` IP address of the device. - `OS_NAME` Name of the operating system of the device. - `OS_VERSION` Version of the operating system running on the device.
id string	Id path parameter. The `id` of the condition.
name string	The auto-generated name of the condition, summarizing its scope, operator, and value.
operator string	The operation used to evaluate the condition. String, regular expression, and expressions required for the operator to work are provided in `value` attribute. Options include - `CONTAINS_STRING` Checks if the specified string is present within the source of the condition. - `DOES_NOT_CONTAIN_STRING` Ensures the string is absent from the source of the condition. - `MATCHES_EXPRESSION` Evaluates whether there is a match for the regular expression within the source of the condition. - `DOES_NOT_MATCH_EXPRESSION` Ensures there is no match for the regular expression within the source of the condition. - `EVALUATE_EXPRESSION` Performs custom expression evaluation. When this is selected, the `value` field must contain three parts separated by a space `<left-hand-operand> <evaluate-operator> <right-hand-operand>` Available evaluation operators are `>`, `>=`, `<`, `<=`, `==`, and `matches`. Use `matches` to find case-sensitive exact match for string and IP address values. Example - To check if the custom variable `_STRING` is matching `TestString` use `<_STRING> matches TestString` in the `value` field. - Similarly, `<_IP_ADDR> matches 3.3.3.3` will check if the custom variable `_IP_ADDR` has the value `3.3.3.3`.
parseAsBlocks boolean	An optional param that indicates whether to parse the configuration as discrete blocks for evaluation. Useful for conditions that apply to specific sections of a configuration file. This is applicable for all condition scopes except `DEVICE_PROPERTIES`. When scope is `PREVIOUSLY_MATCHED_BLOCKS`, this helps extract sub-blocks or portion of the blocks. When this is set, `blockStartExpression` must be provided. Optionally, `blockEndExpression` can be provided to customise blocks further. Choices: :ansible-option-choices-entry:`false` :ansible-option-choices-entry:`true`
policyId string	PolicyId path parameter. The `id` of the compliance policy.
regexViolationCriteria string	Criteria determining when a violation is raised based on regular expression evaluation results. This allows for flexible compliance checks depending on whether a single failure or all failures should trigger a violation. Options are - `RAISE_FOR_EACH_VIOLATION` Violations are raised for each regular expression match instance that fails the evaluation criteria. - `RAISE_SINGLE_FOR_ANY_VIOLATION` A single violation is raised if any one of the regular expression match instances fails the evaluation criteria. Further processing of match instances is stopped as soon as a violation is detected and raised. - `RAISE_IF_ALL_VIOLATED` A single violation is raised only if all the regular expression match instances fail the evaluation criteria.
ruleId string	RuleId path parameter. The `id` of the rule within the compliance policy.
scope string	The source of data for the evaluation of the condition. Possible values include - `CONFIGURATION` Evaluates conditions against the running configuration of the device. - `DEVICE_PROPERTIES` Checks the condition based on specific properties of the device. Device property is specified using the `deviceProperty` attribute. - `DEVICE_COMMAND_OUTPUT` Evaluates based on custom command output. Custom command is specified using the `showCommand` attribute. - `PREVIOUSLY_MATCHED_BLOCKS` Evaluates the current condition only on passed configuration blocks from previous condition. First condition within the rule cannot have this as scope. The condition previous to the one being created must either have `parseAsBlocks` set or must use `PREVIOUSLY_MATCHED_BLOCKS` as scope.
sequenceNumber integer	The sequence number of the condition, indicating its order in the evaluation process.
showCommand string	The command executed on the device to retrieve output for evaluation. This is applicable and required when the scope is `DEVICE_COMMAND_OUTPUT`.
validate_response_schema boolean	Flag for Cisco Catalyst Center SDK to enable the validation of request bodies against a JSON schema. Choices: :ansible-option-choices-entry:`false` :ansible-option-choices-entry-default:`true` ← (default)
value string	The value or pattern used in the condition evaluation. Custom variables and automatically generated regular expression group variables can both be used in this field. To use variables, enclose the variable identifiers within `<` and `>`. During compliance check, these will be replaced with their corresponding values. If an invalid variable is specified, it will not be replaced and considered as a string. Example - To use custom variable with identifier _snmp_community_name, input `<_snmp_community_name>` in the value field. - To use the value of fourth matching group from second condition, input `<2.4>` in the value field. The value must satisfy the following requirements - When the `operator` is `MATCHES_EXPRESSION` or `DOES_NOT_MATCH_EXPRESSION`, the value must be a valid regular expression. - When the `operator` is `EVALUATE_EXPRESSION`, the value must contain a valid expression as mentioned in `EVALUATE_EXPRESSION` description.

Notes 

Note

SDK Method used are compliance.Compliance.create_a_new_condition, compliance.Compliance.delete_a_specific_condition, compliance.Compliance.update_an_existing_condition,
Paths used are post /dna/intent/api/v1/compliancePolicys/{policyId}/rules/{ruleId}/conditions, delete /dna/intent/api/v1/compliancePolicys/{policyId}/rules/{ruleId}/conditions/{id}, put /dna/intent/api/v1/compliancePolicys/{policyId}/rules/{ruleId}/conditions/{id},
Does not support check_mode
The plugin runs on the control node and does not use any ansible connection plugins,
but instead uses the embedded connection manager from Cisco CATALYST SDK
Requires Python >= 3.10, matching the controller Python versions supported by the collection's minimum ansible-core version (see the collection README for the current ansible-core / Python compatibility range)

Examples 

---
- name: Delete by id
  cisco.catalystcenter.compliance_policys_rules_conditions:
    catalystcenter_host: "{{catalystcenter_host}}"
    catalystcenter_username: "{{catalystcenter_username}}"
    catalystcenter_password: "{{catalystcenter_password}}"
    catalystcenter_verify: "{{catalystcenter_verify}}"
    catalystcenter_port: "{{catalystcenter_port}}"
    catalystcenter_version: "{{catalystcenter_version}}"
    catalystcenter_debug: "{{catalystcenter_debug}}"
    state: absent
    id: 1d78e50b-acd7-423b-bc5e-5f4c106eaa8f
    policyId: c9eef5e2-1eab-426c-be77-97ee81dcba05
    ruleId: e8eef5e2-1eab-426c-be77-97ee81dcba06
- name: Update by id
  cisco.catalystcenter.compliance_policys_rules_conditions:
    catalystcenter_host: "{{catalystcenter_host}}"
    catalystcenter_username: "{{catalystcenter_username}}"
    catalystcenter_password: "{{catalystcenter_password}}"
    catalystcenter_verify: "{{catalystcenter_verify}}"
    catalystcenter_port: "{{catalystcenter_port}}"
    catalystcenter_version: "{{catalystcenter_version}}"
    catalystcenter_debug: "{{catalystcenter_debug}}"
    state: present
    action:
      doesNotMatchAction: string
      doesNotMatchViolationMessage: string
      doesNotMatchViolationMessageType: string
      doesNotMatchViolationSeverity: {}
      matchAction: string
      matchViolationMessage: string
      matchViolationMessageType: string
      matchViolationSeverity: {}
    blockEndExpression: string
    blockStartExpression: string
    blockViolationCriteria: string
    deviceProperty: string
    id: string
    name: string
    operator: string
    parseAsBlocks: true
    policyId: c9eef5e2-1eab-426c-be77-97ee81dcba05
    regexViolationCriteria: string
    ruleId: e8eef5e2-1eab-426c-be77-97ee81dcba06
    scope: string
    sequenceNumber: 0
    showCommand: string
    value: string
- name: Create
  cisco.catalystcenter.compliance_policys_rules_conditions:
    catalystcenter_host: "{{catalystcenter_host}}"
    catalystcenter_username: "{{catalystcenter_username}}"
    catalystcenter_password: "{{catalystcenter_password}}"
    catalystcenter_verify: "{{catalystcenter_verify}}"
    catalystcenter_port: "{{catalystcenter_port}}"
    catalystcenter_version: "{{catalystcenter_version}}"
    catalystcenter_debug: "{{catalystcenter_debug}}"
    state: present
    action:
      doesNotMatchAction: string
      doesNotMatchViolationMessage: string
      doesNotMatchViolationMessageType: string
      doesNotMatchViolationSeverity: {}
      matchAction: string
      matchViolationMessage: string
      matchViolationMessageType: string
      matchViolationSeverity: {}
    blockEndExpression: string
    blockStartExpression: string
    blockViolationCriteria: string
    deviceProperty: string
    id: string
    name: string
    operator: string
    parseAsBlocks: true
    policyId: c9eef5e2-1eab-426c-be77-97ee81dcba05
    regexViolationCriteria: string
    ruleId: e8eef5e2-1eab-426c-be77-97ee81dcba06
    scope: string
    sequenceNumber: 0
    showCommand: string
    value: string

Return Values 

Common return values are documented here, the following are the fields unique to this module:

Key	Description
catalystcenter_response dictionary	A dictionary or list with the response returned by the Cisco Catalyst Center Python SDK Returned: always Sample: :ansible-rv-sample-value:`{"response": {"taskId": "string", "url": "string"}, "version": "string"}`

Authors

Bryan Vargas (@bvargasre)

Collection links

Issue Tracker Repository (Sources)

cisco.catalystcenter.compliance_policys_rules_conditions module -- Resource module for Compliance Policys Rules Conditions

Synopsis

Requirements

Parameters

Notes

See Also

Examples

Return Values

Authors

Collection links

Synopsis 

Requirements 

Parameters 

Notes 

See Also 

Examples 

Return Values 