netapp.ontap.na_ontap_mav_rule module – NetApp ONTAP multi-admin verification (MAV) rule

Note

This module is part of the netapp.ontap collection (version 23.5.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install netapp.ontap. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: netapp.ontap.na_ontap_mav_rule.

New in netapp.ontap 23.0.0

Synopsis
Requirements
Parameters
Notes
Examples

Synopsis

Create/modify/delete multi-admin verification (MAV) rule.

Requirements

The below requirements are needed on the host that executes this module.

Ansible 2.9 or later - 2.12 or later is recommended.
Python3 - 3.9 or later is recommended.
netapp-lib only when using ZAPI (install using ‘pip install netapp-lib’), Please note that netapp-lib is deprecated and no longer maintained. Proceed at your own risk.
A physical or virtual clustered Data ONTAP system, the modules support Data ONTAP 9.1 and onward, REST support requires ONTAP 9.6 or later.

Parameters

Parameter	Comments
approval_expiry string	Specifies the time, in ISO-8601 duration format, that the approvers have after a new execution request is submitted to approve or disapprove the request before the request expires. The default value is one hour (PT1H), the minimum supported value is one second (PT1S), and the maximum supported value is 14 days (P14D).
approval_groups list / elements=string	Specifies the list of approval groups that are allowed to approve requests for rules that don’t have approval groups.
auto_request_create boolean	When true, ONTAP automatically creates a request for any failed operation where there is no matching pending request. Defaults to True. Choices: `false` `true`
cert_filepath string added in netapp.ontap 20.6.0	path to SSL client cert file (.pem). not supported with python 2.6.
execution_expiry string	Specifies the time, in ISO-8601 duration format, that the authorized users have after a request is approved to execute the requested operation before the request expires. The default value is one hour (PT1H), the minimum supported value is one second (PT1S), and the maximum supported value is 14 days (P14D).
feature_flags dictionary added in netapp.ontap 20.5.0	Enable or disable a new feature. This can be used to enable an experimental feature or disable a new feature that breaks backward compatibility. Supported keys and values are subject to change without notice. Unknown keys are ignored.
force_ontap_version string added in netapp.ontap 21.23.0	Override the cluster ONTAP version when using REST. The behavior is undefined if the version does not match the target cluster. This is provided as a work-around when the cluster version cannot be read because of permission issues. See https://github.com/ansible-collections/netapp.ontap/wiki/Known-issues. This should be in the form 9.10 or 9.10.1 with each element being an integer number.
hostname string / required	The hostname or IP address of the ONTAP instance.
http_port integer	Override the default port (80 or 443) with this port
https boolean	Enable and disable https. Ignored when using REST as only https is supported. Ignored when using SSL certificate authentication as it requires SSL. Choices: `false` ← (default) `true`
key_filepath string added in netapp.ontap 20.6.0	path to SSL client key file.
operation string / required	Specifies the command that requires one or more approvals.
password aliases: pass string	Password for the specified user.
query string	Specifies the query information which is applied to the subset of objects of ONTAP operation of the rule.
required_approvers integer	Specifies the number of required approvers, excluding the user that made the request. The default and minimum number of required approvers is 1.
state string	Specifies whether to create/modify or delete the specified rule. Choices: `"present"` ← (default) `"absent"`
use_lambda boolean added in netapp.ontap 23.4.0	Specifies if AWS Lambda proxy functionality should be used to connect to the ONTAP system. Supported only with REST. Choices: `false` ← (default) `true`
use_rest string	This module only supports REST. always -- will always use the REST API. A warning is issued if the module does not support REST. Default: `"always"`
username aliases: user string	This can be a Cluster-scoped or SVM-scoped account, depending on whether a Cluster-level or SVM-level API is required. For more information, please read the documentation https://docs.netapp.com/us-en/ontap/authentication/create-svm-user-accounts-task.html. Two authentication methods are supported Basic authentication, using username and password. SSL certificate authentication, using a ssl client cert file, and optionally a private key file. To use a certificate, the certificate must have been installed in the ONTAP cluster, and cert authentication must have been enabled.
validate_certs boolean	If set to `no`, the SSL certificates will not be validated. This should only set to `False` used on personally controlled sites using self-signed certificates. Choices: `false` `true` ← (default)

Notes

Note

Only supported with REST and requires ONTAP 9.11.1 or later.
System rules cannot be deleted or have their query modified.
The modules prefixed with na_ontap are built to support the ONTAP storage platform.
https is enabled by default and recommended. To enable http on the cluster you must run the following commands ‘set -privilege advanced;’ ‘system services web modify -http-enabled true;’

Examples

- name: Create a rule
  netapp.ontap.na_ontap_mav_rule:
    state: present
    auto_request_create: true
    required_approvers: 1
    approval_groups: ["group1", "group2"]
    approval_expiry: "P14D"
    execution_expiry: "P14D"
    operation: "volume delete"
    hostname: "{{ netapp_hostname }}"
    username: "{{ netapp_username }}"
    password: "{{ netapp_password }}"
    https: true
    validate_certs: "{{ validate_certs }}"
    use_rest: always

- name: Update a rule
  netapp.ontap.na_ontap_mav_rule:
    state: present
    query: "-vserver svm1"
    operation: "volume delete"
    hostname: "{{ netapp_hostname }}"
    username: "{{ netapp_username }}"
    password: "{{ netapp_password }}"
    https: true
    validate_certs: "{{ validate_certs }}"
    use_rest: always

- name: Delete a rule
  netapp.ontap.na_ontap_mav_rule:
    state: absent
    operation: "volume delete"
    hostname: "{{ netapp_hostname }}"
    username: "{{ netapp_username }}"
    password: "{{ netapp_password }}"
    https: true
    validate_certs: "{{ validate_certs }}"
    use_rest: always

Authors

NetApp Ansible Team (@carchi8py)

Collection links

© 2012–2018 Michael DeHaan
© 2018–2025 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/projects/ansible/latest/collections/netapp/ontap/na_ontap_mav_rule_module.html