internet/ansible-collections-openstack
3
0
Fork 0
mirror of https://opendev.org/openstack/ansible-collections-openstack.git synced 2026-03-26 21:43:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactored security_group{,_info} modules

Browse Source 
Change-Id: I8ae38c038e24ae53704224adb614b98e2e56a271
This commit is contained in:
Jakob Meng
2022-12-14 20:55:24 +01:00
parent 647ffef375
commit 4cf6842222
10 changed files with 375 additions and 280 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ci/roles/port/defaults/main.yml
View File

@@ -43,5 +43,4 @@ network_external: true
network_name: ansible_port_network
no_security_groups: True
port_name: ansible_port
secgroup_name: ansible_port_secgroup
subnet_name: ansible_port_subnet

10
ci/roles/port/tasks/main.yml
View File

@@ -86,7 +86,7 @@
openstack.cloud.security_group:
cloud: "{{ cloud }}"
state: present
name: "{{ secgroup_name }}"
name: ansible_security_group
description: Test group
register: security_group
@@ -99,7 +99,7 @@
fixed_ips:
- ip_address: 10.5.5.69
security_groups:
- "{{ secgroup_name }}"
- ansible_security_group
register: port
- debug: var=port
@@ -221,7 +221,7 @@
name: "{{ port_name }}"
network: "{{ network_name }}"
security_groups:
- "{{ secgroup_name }}"
- ansible_security_group
state: present
register: port_updated
@@ -242,7 +242,7 @@
- port_updated.port.fixed_ips[0].ip_address == "10.5.5.70"
- port_updated.port.fixed_ips[0].subnet_id == subnet.subnet.id
- port_updated.port.security_group_ids|length == 1
- port_updated.port.security_group_ids[0] == security_group.secgroup.id
- port_updated.port.security_group_ids[0] == security_group.security_group.id
- name: Delete updated port
openstack.cloud.port:
@@ -254,7 +254,7 @@
openstack.cloud.security_group:
cloud: "{{ cloud }}"
state: absent
name: "{{ secgroup_name }}"
name: ansible_security_group
- name: Create port (with binding profile)
openstack.cloud.port:

23
ci/roles/security_group/defaults/main.yml
View File

@@ -1,13 +1,12 @@
expected_fields:
- created_at
- description
- name
- project_id
- security_group_rules
- stateful
- tenant_id
- updated_at
- revision_number
- id
- tags
secgroup_name: shade_secgroup
- created_at
- description
- name
- project_id
- security_group_rules
- stateful
- tenant_id
- updated_at
- revision_number
- id
- tags

72
ci/roles/security_group/tasks/main.yml
View File

@@ -1,75 +1,73 @@
---
- name: Ensure security group does not exist before tests
openstack.cloud.security_group:
cloud: "{{ cloud }}"
name: "{{ secgroup_name }}"
state: absent
- name: Create security group
openstack.cloud.security_group:
cloud: "{{ cloud }}"
name: "{{ secgroup_name }}"
name: ansible_security_group
state: present
description: Created from Ansible playbook
description: 'Created from Ansible playbook'
register: security_group
- name: List all security groups of a project
openstack.cloud.security_group_info:
cloud: "{{ cloud }}"
register: test_sec_groups
- name: Check list all security groups of a project
- name: Assert return values of security_group module
assert:
that:
- test_sec_groups.security_groups | length > 0
- security_group.security_group.name == 'ansible_security_group'
- security_group.security_group.description == 'Created from Ansible playbook'
# allow new fields to be introduced but prevent fields from being removed
- expected_fields|difference(security_group.security_group.keys())|length == 0
- name: Assert fields returned by security_group_info
assert:
that:
- item in test_sec_groups.security_groups[0]
loop: "{{ expected_fields }}"
- name: Filter security group by name
- name: List all security groups
openstack.cloud.security_group_info:
cloud: "{{ cloud }}"
name: "{{ secgroup_name }}"
register: test_sec_group
register: security_groups
- name: Assert return values of security_group_info module
assert:
that:
- security_groups.security_groups | length > 0
# allow new fields to be introduced but prevent fields from being removed
- expected_fields|difference(security_groups.security_groups[0].keys())|length == 0
- name: Find security group by name
openstack.cloud.security_group_info:
cloud: "{{ cloud }}"
name: ansible_security_group
register: security_groups
- name: Check filter security group by name
assert:
that:
- test_sec_group.security_groups | length == 1
- test_sec_group.security_groups[0]['id'] == security_group.id
- security_groups.security_groups | length == 1
- security_groups.security_groups.0.id == security_group.security_group.id
- name: Filter security group by description
openstack.cloud.security_group_info:
cloud: "{{ cloud }}"
description: Created from Ansible playbook
register: test_sec_group
description: 'Created from Ansible playbook'
register: security_groups
- name: Check filter security group by description
assert:
that:
- test_sec_group.security_groups | length == 1
- test_sec_group.security_groups[0]['id'] == security_group.id
- security_groups.security_groups | length == 1
- security_groups.security_groups.0.id == security_group.security_group.id
- name: Filter security group by not_tags
openstack.cloud.security_group_info:
cloud: "{{ cloud }}"
name: "{{ secgroup_name }}"
name: ansible_security_group
not_tags:
- ansibletag1
- ansibletag2
register: test_sec_group
- ansibletag1
- ansibletag2
register: security_groups
- name: Check filter security group by not_tags
assert:
that:
- test_sec_group.security_groups | length == 1
- test_sec_group.security_groups[0]['id'] == security_group.id
- security_groups.security_groups | length == 1
- security_groups.security_groups.0.id == security_group.security_group.id
- name: Delete security group
openstack.cloud.security_group:
cloud: "{{ cloud }}"
name: "{{ secgroup_name }}"
name: ansible_security_group
state: absent

1
ci/roles/security_group_rule/defaults/main.yml
View File

@@ -17,4 +17,3 @@ expected_fields:
- tags
- tenant_id
- updated_at
secgroup_name: shade_secgroup

126
ci/roles/security_group_rule/tasks/main.yml
View File

@@ -1,161 +1,157 @@
---
- name: Ensure security group does not exist before tests
openstack.cloud.security_group:
cloud: "{{ cloud }}"
name: "{{ secgroup_name }}"
state: absent
description: Created from Ansible playbook
- name: Create security group
openstack.cloud.security_group:
cloud: "{{ cloud }}"
name: "{{ secgroup_name }}"
name: ansible_security_group
state: present
description: Created from Ansible playbook
- name: Create empty ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
register: rule
register: security_group_rule
- name: Assert return fields for security_group_rule
- name: Assert return values of security_group_rule module
assert:
that: item in rule.rule
loop: "{{ expected_fields }}"
that:
# allow new fields to be introduced but prevent fields from being removed
- expected_fields|difference(security_group_rule.rule.keys())|length == 0
- name: Assert changed
assert:
that: security_group_rule is changed
- name: Fetch all security group rule
openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}"
register: all_rules
register: security_group_rules
- name: Assert return fields security_group_rule_info
- name: Assert return values of security_group_rule_info module
assert:
that: item in all_rules.security_group_rules[0]
loop: "{{ expected_fields }}"
that:
- security_group_rules.security_group_rules | length > 0
# allow new fields to be introduced but prevent fields from being removed
- expected_fields|difference(security_group_rules.security_group_rules.0.keys())|length == 0
- name: Fetch security group rule based on rule
openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}"
id: "{{ rule.rule.id }}"
register: filter_by_rule
id: "{{ security_group_rule.rule.id }}"
register: security_group_rules
- name: Assert return fields security_group_rule_info
assert:
that: filter_by_rule.security_group_rules|length != 0
- name: Assert changed
assert:
that: rule is changed
that: security_group_rules.security_group_rules | length > 0
- name: Create empty ICMP rule again
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
register: rule
register: security_group_rule
- name: Assert not changed
assert:
that: rule is not changed
that: security_group_rule is not changed
- name: Create -1 ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: icmp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
register: rule
register: security_group_rule
- name: Assert not changed
assert:
that: rule is not changed
that: security_group_rule is not changed
- name: Create -1 ICMP rule again
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: icmp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
register: rule
register: security_group_rule
- name: Assert not changed
assert:
that: rule is not changed
that: security_group_rule is not changed
- name: Create empty TCP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: tcp
remote_ip_prefix: 0.0.0.0/0
register: rule
register: security_group_rule
- name: Assert changed
assert:
that: rule is changed
that: security_group_rule is changed
- name: Create TCP rule again with port range (1, 65535)
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 1
port_range_max: 65535
remote_ip_prefix: 0.0.0.0/0
register: rule
register: security_group_rule
- name: Assert changed
assert:
that: rule is not changed
that: security_group_rule is not changed
- name: Create TCP rule again with port range (-1, -1)
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
register: rule
register: security_group_rule
- name: Assert changed
assert:
that: rule is not changed
that: security_group_rule is not changed
- name: Create TCP rule again with defined range
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 8000
port_range_max: 9000
remote_ip_prefix: 0.0.0.0/0
register: rule
register: security_group_rule
- name: Assert changed
assert:
that: rule is changed
that: security_group_rule is changed
- name: Create empty UDP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: udp
remote_ip_prefix: 0.0.0.0/0
@@ -163,7 +159,7 @@
- name: Create UDP rule again with port range (1, 65535)
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: udp
port_range_min: 1
@@ -173,7 +169,7 @@
- name: Create UDP rule again with port range (-1, -1)
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: udp
port_range_min: -1
@@ -183,7 +179,7 @@
- name: Create HTTP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 80
@@ -193,7 +189,7 @@
- name: Create egress rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 30000
@@ -204,41 +200,37 @@
- name: List all available rules of all security groups in a project
openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}"
when: sdk_version is version("0.32", '>=')
register: test_sec_rules
register: security_group_rules
- name: Check - List all available rules of all security groups in a project
assert:
that:
- test_sec_rules.security_group_rules | length > 0
when: sdk_version is version("0.32", '>=')
- security_group_rules.security_group_rules | length > 0
- name: List all available rules of a specific security group
openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
register: test_sec_rule1
security_group: ansible_security_group
register: security_group_rules
- name: Check - List all available rules of a specific security group
assert:
that:
- test_sec_rule1.security_group_rules | length > 0
- security_group_rules.security_group_rules | length > 0
- name: List all available rules with filters
openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
protocol: tcp
port_range_min: 80
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
when: sdk_version is version("0.32", '>=')
register: test_sec_rule
- name: Delete empty ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: absent
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
@@ -246,7 +238,7 @@
- name: Delete -1 ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: absent
protocol: icmp
port_range_min: -1
@@ -256,7 +248,7 @@
- name: Delete empty TCP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: absent
protocol: tcp
remote_ip_prefix: 0.0.0.0/0
@@ -264,7 +256,7 @@
- name: Delete empty UDP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: absent
protocol: udp
remote_ip_prefix: 0.0.0.0/0
@@ -272,7 +264,7 @@
- name: Delete HTTP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: absent
protocol: tcp
port_range_min: 80
@@ -282,7 +274,7 @@
- name: Delete egress rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: "{{ secgroup_name }}"
security_group: ansible_security_group
state: absent
protocol: tcp
port_range_min: 30000
@@ -293,5 +285,5 @@
- name: Delete security group
openstack.cloud.security_group:
cloud: "{{ cloud }}"
name: "{{ secgroup_name }}"
name: ansible_security_group
state: absent

4
ci/roles/server/tasks/main.yml
View File

@@ -469,8 +469,8 @@
- server_updated.server.metadata['key2'] == 'value2'
- server_updated.server.metadata['key3'] == 'value3'
- server_updated.server.security_groups|map(attribute='name')|unique|length == 2
- security_group.secgroup.name in server_updated.server.security_groups|map(attribute='name')
- security_group_alt.secgroup.name in server_updated.server.security_groups|map(attribute='name')
- security_group.security_group.name in server_updated.server.security_groups|map(attribute='name')
- security_group_alt.security_group.name in server_updated.server.security_groups|map(attribute='name')
- server_network in server_updated.server.addresses.keys()|list|sort
- server_updated.server.addresses[server_network]|length == 2
- port.port.fixed_ips[0].ip_address in