damex.incus.incus_network_acl module – Ensure Incus network ACL

Note

This module is part of the damex.incus collection (version 1.11.7).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install damex.incus.

To use it in a playbook, specify: damex.incus.incus_network_acl.

Synopsis

  • Create, update, and delete Incus network ACLs via the Incus REST API.

  • Network ACLs define traffic rules that control access between instances connected to the same network, and access to and from other networks.

  • Rules are automatically ordered by action priority (drop, reject, allow-stateless, allow).

Parameters

Parameter

Comments

client_cert

string

Client certificate content for remote authentication.

Requires url and client_key. Mutually exclusive with token and client_cert_path.

client_cert_path

string

Client certificate path for remote authentication.

Requires url and client_key_path. Mutually exclusive with token and client_cert.

client_key

string

Client key content for remote authentication.

Requires url and client_cert. Mutually exclusive with client_key_path.

client_key_path

string

Client key path for remote authentication.

Requires url and client_cert_path. Mutually exclusive with client_key.

config

list / elements=dictionary

User-defined configuration entries.

Each entry is flattened to a user.<name> config key.

name

string / required

Configuration key name (without the user. prefix).

value

string / required

Configuration value.

description

string

Description of the network ACL.

Default: ""

egress

list / elements=dictionary

List of egress (outbound) traffic rules.

Rules are order-independent and automatically sorted by action priority.

action

string / required

Action to perform on rule match.

Choices:

  • "allow"

  • "allow-stateless"

  • "reject"

  • "drop"

description

string

Description of the rule.

destination

string

Destination address (CIDR, IP range, or selector).

destination_port

string

Destination port or port range for TCP/UDP.

icmp_code

string

ICMP code number.

icmp_type

string

ICMP type number.

protocol

string

Network protocol to match.

Choices:

  • "icmp4"

  • "icmp6"

  • "tcp"

  • "udp"

source

string

Source address (CIDR, IP range, or selector).

source_port

string

Source port or port range for TCP/UDP.

state

string

State of the rule.

Choices:

  • "enabled" ← (default)

  • "disabled"

  • "logged"

ingress

list / elements=dictionary

List of ingress (inbound) traffic rules.

Rules are order-independent and automatically sorted by action priority.

action

string / required

Action to perform on rule match.

Choices:

  • "allow"

  • "allow-stateless"

  • "reject"

  • "drop"

description

string

Description of the rule.

destination

string

Destination address (CIDR, IP range, or selector).

destination_port

string

Destination port or port range for TCP/UDP.

icmp_code

string

ICMP code number.

icmp_type

string

ICMP type number.

protocol

string

Network protocol to match.

Choices:

  • "icmp4"

  • "icmp6"

  • "tcp"

  • "udp"

source

string

Source address (CIDR, IP range, or selector).

source_port

string

Source port or port range for TCP/UDP.

state

string

State of the rule.

Choices:

  • "enabled" ← (default)

  • "disabled"

  • "logged"

name

string / required

Name of the network ACL.

project

string

Incus project to query.

Default: "default"

server_cert

string

Server certificate content for remote verification.

Requires url. Mutually exclusive with server_cert_path.

server_cert_path

string

Server certificate path for remote verification.

Requires url. Mutually exclusive with server_cert.

socket_path

string

Incus Unix socket path for local connections.

Default: "/var/lib/incus/unix.socket"

state

string

Desired state of the network ACL.

Choices:

  • "present" ← (default)

  • "absent"

token

string

Token for remote authentication.

Requires url. Mutually exclusive with client_cert.

url

string

Remote Incus server URL (e.g. https://host:8443).

If specified, connects via HTTPS instead of Unix socket.

validate_certs

boolean

Server TLS certificate validation.

Choices:

  • false

  • true ← (default)

wait

boolean

Async operation completion wait.

Set to false for fire-and-forget behaviour.

Choices:

  • false

  • true ← (default)

Examples

- name: Ensure network ACL allowing web traffic
  damex.incus.incus_network_acl:
    name: web
    description: Web server ACL
    ingress:
      - action: allow
        source: "@internal"
        protocol: tcp
        destination_port: 80,443
        description: Allow HTTP and HTTPS
    egress:
      - action: allow
        destination: 8.8.8.8/32,8.8.4.4/32
        protocol: udp
        destination_port: "53"
        description: Allow DNS queries to Google DNS

- name: Ensure network ACL blocking all traffic
  damex.incus.incus_network_acl:
    name: deny-all
    ingress:
      - action: drop
    egress:
      - action: drop

- name: Ensure network ACL is absent
  damex.incus.incus_network_acl:
    name: web
    state: absent

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

changed

boolean

Resource state change indicator.

Returned: always

changed_keys

list / elements=string

Configuration keys that changed.

Returned: always

diff

dictionary

Before and after state for diff mode.

Returned: changed

after

dictionary

State after the change.

Returned: success

before

dictionary

State before the change.

Returned: success

Authors

  • Roman Kuzmitskii (@damex)