Jack CarterandClaude Opus 4.7 27595eee61 fix: raise on unresolved group/peer/posture-check references instead of silent drop ...

The configure role's name resolver previously used dict.get(name, name)
fallbacks, so any unresolvable reference in YAML config was silently
passed through to the API as if it were a valid ID. On the server side,
the reference was discarded — producing half-applied policies whose
rules ended up with sources: null (or destinations/auto_groups wiped).

Common failure mode: a typo in a group name ships a broken firewall
rule that reports changed=true but has no source constraint.

This change makes the resolver strict:

- Unknown name that is ALSO not an existing ID -> AnsibleFilterError
  with a message naming the resource, field, and unresolved value.
- Known name -> resolves to ID (unchanged).
- Value that matches an existing ID -> passes through (preserves
  backward compatibility for YAML configs that use raw IDs).

Applies to groups in policy sources/destinations, setup_key auto_groups,
policy source_posture_checks, peer refs in policy source_resource/
destination_resource, and network router.peer / resource.groups.

Also: the /api/networks/{id}/routers endpoint returns router.peer as
the peer's HOSTNAME rather than its canonical name. The peer_ids map
(configure role) and peer_id_map (export role) now include hostname
aliases so round-trips stay idempotent.

Files:
- plugins/filter/netbird_resolve.py: strict _resolve_names,
  _resolve_resource_ref, new _resolve_peer_id helper
- roles/configure/tasks/main.yml: peer_ids merges hostname->id
  aliases with name->id
- roles/export/tasks/main.yml: peer_id_map merges hostname->name
  aliases with id->name

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-17 16:59:52 +02:00

..

netbird_diff.py

normalization

2026-03-31 23:08:46 +02:00

netbird_resolve.py

fix: raise on unresolved group/peer/posture-check references instead of silent drop

2026-04-17 16:59:52 +02:00