sr2c.podman.podman_curl module – Make an HTTP request with curl from inside a running Podman container

Note

This module is part of the sr2c.podman collection (version 0.0.1).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install sr2c.podman.

To use it in a playbook, specify: sr2c.podman.podman_curl.

New in sr2c.podman 0.0.1

Synopsis

  • Runs curl inside a running container with podman exec, so a service that only listens on a container network (for example OpenSearch on https://localhost:9200) can be called without publishing a port on the host.

  • Intended for rootless Podman. Run the task with become=true and become_user set to the user that owns the container.

  • Credentials, headers and the request body are passed to curl as a config file on stdin, never as command-line arguments, so they don’t show up in ps on the host or inside the container.

  • The container image must include curl, version 7.x or later.

  • Reports changed according to HTTP semantics. A successful request with a safe method (GET, HEAD, OPTIONS, TRACE) reports changed=false; any other method reports changed=true. To override this, register the result and use changed_when, for example on status or json.

Parameters

Parameter

Comments

body

any

Request body. With body_format=json, a dict or list is serialised to JSON and a JSON Content-Type header is added unless set in headers.

body_format

string

How to encode body.

Choices:

  • "json" ← (default)

  • "raw"

ca_path

string

Path, inside the container, to a CA bundle to verify the server against.

client_cert

string

Path, inside the container, to a PEM client certificate for TLS client authentication.

For OpenSearch, presenting the admin certificate is the only way to change reserved security resources over the REST API.

client_key

string

Path, inside the container, to the private key for client_cert.

container

string / required

Name or ID of the running container to run curl in.

headers

dictionary

Extra request headers.

Default: {}

method

string

HTTP method.

Default: "GET"

status_code

list / elements=integer

HTTP status codes that count as success.

Default: [200]

timeout

integer

Maximum time in seconds for the whole request.

Default: 30

url

string / required

URL as seen from inside the container, for example https://localhost:9200/_cluster/health.

url_password

string

Password for HTTP Basic authentication.

url_username

string

Username for HTTP Basic authentication.

validate_certs

boolean

Verify the server’s TLS certificate. Set to false to pass --insecure, for example for a self-signed certificate on localhost.

Choices:

  • false

  • true ← (default)

Notes

Note

  • In check mode, only safe methods (GET, HEAD, OPTIONS, TRACE) are sent; other methods are skipped and reported as changed.

Examples

- name: Podman CDR Link | AUDIT | Check OpenSearch cluster health
  sr2c.podman.podman_curl:
    container: zammad-opensearch
    url: https://localhost:9200/_cluster/health
    url_username: admin
    url_password: "{{ podman_link_opensearch_password }}"
    validate_certs: false
  become: true
  become_user: "{{ podman_link_podman_rootless_user }}"
  register: _health

- name: Podman CDR Link | PATCH | Map Link agents to a read-only dashboards role
  sr2c.podman.podman_curl:
    container: zammad-opensearch
    url: https://localhost:9200/_plugins/_security/api/rolesmapping/link_agent
    method: PUT
    url_username: admin
    url_password: "{{ podman_link_opensearch_password }}"
    validate_certs: false
    body:
      backend_roles: ["agent"]
    status_code: [200, 201]
  become: true
  become_user: "{{ podman_link_podman_rootless_user }}"
  no_log: true

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

content

string

Response body as text.

Returned: when a response was received

json

any

Response body parsed as JSON, if it was valid JSON.

Returned: when the response body is JSON

skipped_in_check_mode

boolean

True when the request was not sent because of check mode.

Returned: always

status

integer

HTTP status code returned by the server (0 if no response was received).

Returned: always

Authors