Refactored identity_group{,_info} modules

Change-Id: I72dce1278a7623d4f68cabcceafcdfefda900195

ci/roles/identity_group/defaults/main.yml

@@ -1,5 +1,3 @@
-group_name: ansible_group
-domain_name: ansible_domain
 expected_fields:
   - description
   - domain_id

ci/roles/identity_group/tasks/main.yml

@@ -1,138 +1,220 @@
 ---
-- name: Create domain
-  openstack.cloud.identity_domain:
-     cloud: "{{ cloud }}"
-     state: present
-     name: "{{ domain_name }}"
-  register: domain
-
 - name: Create group
   openstack.cloud.identity_group:
-     cloud: "{{ cloud }}"
+    cloud: "{{ cloud }}"
-     state: present
+    state: present
-     name: "{{ group_name }}"
+    description: "ansible group"
-  register: group_result
+    name: ansible_group
+  register: group
 
-- name: Assert changed
+- name: Assert return values of identity_group module
   assert:
-    that: group_result is changed
+    that:
-
+      - group.group.name == 'ansible_group'
-- name: Assert returned fields
+      - group.group.description == "ansible group"
-  assert:
+      # allow new fields to be introduced but prevent fields from being removed
-    that: item in group_result.group
+      - expected_fields|difference(group.group.keys())|length == 0
-  loop: "{{ expected_fields }}"
 
 - name: Create group again
   openstack.cloud.identity_group:
-     cloud: "{{ cloud }}"
+    cloud: "{{ cloud }}"
-     state: present
+    state: present
-     name: "{{ group_name }}"
+    description: "ansible group"
-  register: group_result
+    name: ansible_group
+  register: group
 
-- name: Assert not changed
+- name: Assert group did not change
   assert:
-    that: group_result is not changed
+    that:
+      - group is not changed
 
 - name: Update group
   openstack.cloud.identity_group:
-     cloud: "{{ cloud }}"
+    cloud: "{{ cloud }}"
-     state: present
+    state: present
-     name: "{{ group_name }}"
+    name: ansible_group
-     description: "updated description"
+    description: "updated description"
-  register: group_result
+  register: group
 
 - name: Assert changed
   assert:
     that:
-      - group_result is changed
+      - group is changed
-      - group_result.group.description == "updated description"
+      - group.group.description == "updated description"
+
+- name: Fetch all groups
+  openstack.cloud.identity_group_info:
+    cloud: "{{ cloud }}"
+  register: _groups
+
+- name: Assert return values of identity_group_info module
+  assert:
+    that:
+      - _groups.groups | length > 0
+      # allow new fields to be introduced but prevent fields from being removed
+      - expected_fields|difference(_groups.groups.0.keys())|length == 0
+
+- name: List group with filters
+  openstack.cloud.identity_group_info:
+    cloud: "{{ cloud }}"
+    domain: default
+    filters:
+      name: ansible_group
+  register: _groups
+
+- name: Assert group with filters
+  assert:
+    that:
+      - _groups.groups | length == 1
+      - _groups.groups.0.id == group.group.id
+
+- name: Create domain
+  openstack.cloud.identity_domain:
+    cloud: "{{ cloud }}"
+    state: present
+    name: ansible_domain
+  register: domain
 
 - name: Create group in specific domain
   openstack.cloud.identity_group:
-     cloud: "{{ cloud }}"
+    cloud: "{{ cloud }}"
-     state: present
+    state: present
-     name: "{{ group_name }}"
+    name: ansible_group
-     domain_id: "{{ domain.domain.id }}"
+    domain_id: "{{ domain.domain.id }}"
-  register: group_result
+  register: group
 
 - name: Assert results
   assert:
     that:
-      - group_result is changed
+      - group is changed
-      - group_result.group.domain_id == domain.domain.id
+      - group.group.domain_id == domain.domain.id
+
+- name: List group by group name
+  openstack.cloud.identity_group_info:
+    cloud: "{{ cloud }}"
+    name: ansible_group
+  register: _groups
+
+- name: Assert groups by group name
+  assert:
+    that:
+      - _groups.groups | length == 2
+
+- name: List group by domain_id
+  openstack.cloud.identity_group_info:
+    cloud: "{{ cloud }}"
+    domain: ansible_domain
+  register: _groups
+
+- name: Assert groups by domain_id
+  assert:
+    that:
+      - _groups.groups | length == 1
+      - _groups.groups.0.id == group.group.id
+      - _groups.groups.0.domain_id == domain.domain.id
+
+- name: List group by domain_id and group name
+  openstack.cloud.identity_group_info:
+    cloud: "{{ cloud }}"
+    domain: ansible_domain
+    name: ansible_group
+  register: _groups
+
+- name: Assert groups by domain_id and group name
+  assert:
+    that:
+      - _groups.groups | length == 1
+      - _groups.groups.0.id == group.group.id
 
 - name: Create group in specific domain again
   openstack.cloud.identity_group:
-     cloud: "{{ cloud }}"
+    cloud: "{{ cloud }}"
-     state: present
+    state: present
-     name: "{{ group_name }}"
+    name: ansible_group
-     domain_id: "{{ domain.domain.id }}"
+    domain_id: "{{ domain.domain.id }}"
-  register: group_result
+  register: group
 
 - name: Assert not changed
   assert:
-    that: group_result is not changed
+    that:
+      - group is not changed
 
-- name: Delete ambiguous domain
+- name: Delete ambiguous group
   openstack.cloud.identity_group:
-     cloud: "{{ cloud }}"
+    cloud: "{{ cloud }}"
-     state: absent
+    state: absent
-     name: "{{ group_name }}"
+    name: ansible_group
   ignore_errors: true
-  register: group_result
+  register: group
 
 - name: Assert failed
   assert:
-    that: group_result is failed
+    that:
+      - group is failed
 
 - name: Delete group in specific domain
   openstack.cloud.identity_group:
-     cloud: "{{ cloud }}"
+    cloud: "{{ cloud }}"
-     state: absent
+    state: absent
-     name: "{{ group_name }}"
+    name: ansible_group
-     domain_id: "{{ domain.domain.id }}"
+    domain_id: "{{ domain.domain.id }}"
-  register: group_result
+  register: group
 
 - name: Assert changed
   assert:
-    that: group_result is changed
+    that:
+      - group is changed
 
 - name: Delete group in specific domain again
   openstack.cloud.identity_group:
-     cloud: "{{ cloud }}"
+    cloud: "{{ cloud }}"
-     state: absent
+    state: absent
-     name: "{{ group_name }}"
+    name: ansible_group
-     domain_id: "{{ domain.domain.id }}"
+    domain_id: "{{ domain.domain.id }}"
-  register: group_result
+  register: group
 
 - name: Assert not changed
   assert:
-    that: group_result is not changed
+    that:
-
+      - group is not changed
-- name: Delete group
-  openstack.cloud.identity_group:
-     cloud: "{{ cloud }}"
-     state: absent
-     name: "{{ group_name }}"
-  register: group_result
-
-- name: Assert changed
-  assert:
-    that: group_result is changed
-
-- name: Delete group again
-  openstack.cloud.identity_group:
-     cloud: "{{ cloud }}"
-     state: absent
-     name: "{{ group_name }}"
-  register: group_result
-
-- name: Assert not changed
-  assert:
-    that: group_result is not changed
 
 - name: Delete domain
   openstack.cloud.identity_domain:
     cloud: "{{ cloud }}"
     state: absent
-    name: "{{ domain_name }}"
+    name: ansible_domain
+
+- name: Delete group
+  openstack.cloud.identity_group:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: ansible_group
+  register: group
+
+- name: Assert changed
+  assert:
+    that:
+      - group is changed
+
+- name: Delete group again
+  openstack.cloud.identity_group:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: ansible_group
+  register: group
+
+- name: Assert not changed
+  assert:
+    that:
+      - group is not changed
+
+- name: List group
+  openstack.cloud.identity_group_info:
+    cloud: "{{ cloud }}"
+    name: ansible_group
+  register: _groups
+
+- name: Assert group does not exist
+  assert:
+    that:
+      - _groups.groups | length == 0

ci/roles/identity_group_info/tasks/main.yml

@@ -1,74 +0,0 @@
----
-- name: List group by domain_id
-  openstack.cloud.identity_group_info:
-    cloud: "{{ cloud }}"
-    domain: default
-  register: group_domain
-
-- name: Assert groups were returned
-  assert:
-    that:
-      - group_domain.groups | length > 0
-      - group_domain.groups[0].domain_id == 'default'
-      - group_domain.groups[0].id is defined
-      - group_domain.groups[0].description is defined
-      - group_domain.groups[0].name is defined
-
-- name: List group by domain_id and group
-  openstack.cloud.identity_group_info:
-    cloud: "{{ cloud }}"
-    domain: default
-    name: admins
-  register: groups_info
-
-- name: Assert groups by domain_id and grouph returned
-  assert:
-    that:
-      - groups_info.groups | length > 0
-      - groups_info.groups[0].domain_id == 'default'
-      - groups_info.groups[0].id is defined
-      - groups_info.groups[0].description is defined
-      - groups_info.groups[0].name is defined
-
-- name: List group by filter
-  openstack.cloud.identity_group_info:
-    cloud: "{{ cloud }}"
-    domain: default
-    filters:
-      name: admins
-  register: groups_filter
-
-- name: Assert group by filter returned
-  assert:
-    that:
-      - groups_filter.groups | length > 0
-      - groups_filter.groups[0].domain_id == 'default'
-      - groups_filter.groups[0].id is defined
-      - groups_filter.groups[0].description is defined
-      - groups_filter.groups[0].name is defined
-
-- name: Verify returned values of group info
-  assert:
-    that:
-      - item in groups_info.groups[0]
-  loop:
-    - description
-    - domain_id
-    - id
-    - name
-
-- name: List group by group name
-  openstack.cloud.identity_group_info:
-    cloud: "{{ cloud }}"
-    name: admins
-  register: groups_name
-
-- name: Assert group by name returned
-  assert:
-    that:
-      - groups_name.groups | length > 0
-      - groups_name.groups[0].domain_id == 'default'
-      - groups_name.groups[0].id is defined
-      - groups_name.groups[0].description is defined
-      - groups_name.groups[0].name is defined
-      - groups_name.groups[0].name == 'admins'

ci/run-collection.yml

@@ -20,7 +20,6 @@
     - { role: host_aggregate, tags: host_aggregate }
     - { role: identity_domain, tags: identity_domain }
     - { role: identity_group, tags: identity_group }
-    - { role: identity_group_info, tags: identity_group_info }
     - { role: identity_user, tags: identity_user }
     - { role: identity_user_info, tags: identity_user_info }
     - { role: identity_role, tags: identity_role }

plugins/modules/identity_group.py

@@ -4,94 +4,94 @@
 # Copyright (c) 2016 IBM
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
-DOCUMENTATION = '''
+DOCUMENTATION = r'''
 ---
 module: identity_group
-short_description: Manage OpenStack Identity Groups
+short_description: Manage a OpenStack identity (Keystone) group
 author: OpenStack Ansible SIG
 description:
-    - Manage OpenStack Identity Groups. Groups can be created, deleted or
+  - Create, update or delete an OpenStack identity (Keystone) group.
-      updated. Only the I(description) value can be updated.
 options:
-   description:
+  description:
-     description:
+    description:
-        - Group description
+      - Group description.
-     type: str
+    type: str
-   domain_id:
+  domain_id:
-     description:
+    description:
-        - Domain id to create the group in if the cloud supports domains.
+      - Domain id to create the group in.
-     type: str
+    type: str
-   name:
+  name:
-     description:
+    description:
-        - Group name
+      - Group name
-     required: true
+    required: true
-     type: str
+    type: str
-   state:
+  state:
-     description:
+    description:
-       - Should the resource be present or absent.
+      - Should the resource be present or absent.
-     choices: [present, absent]
+    choices: ['present', 'absent']
-     default: present
+    default: present
-     type: str
+    type: str
 extends_documentation_fragment:
-- openstack.cloud.openstack
+  - openstack.cloud.openstack
 '''
 
-EXAMPLES = '''
+EXAMPLES = r'''
-# Create a group named "demo"
+- name: Create a group named "demo"
-- openstack.cloud.identity_group:
+  openstack.cloud.identity_group:
     cloud: mycloud
     state: present
     name: demo
     description: "Demo Group"
     domain_id: demoid
 
-# Update the description on existing "demo" group
+- name: Update the description on existing demo group
-- openstack.cloud.identity_group:
+  openstack.cloud.identity_group:
     cloud: mycloud
     state: present
     name: demo
     description: "Something else"
     domain_id: demoid
 
-# Delete group named "demo"
+- name: Delete group named demo
-- openstack.cloud.identity_group:
+  openstack.cloud.identity_group:
     cloud: mycloud
     state: absent
     name: demo
 '''
 
-RETURN = '''
+RETURN = r'''
 group:
-    description: Dictionary describing the group.
+  description: Dictionary describing the identity group.
-    returned: On success when I(state) is 'present'.
+  returned: On success when I(state) is C(present).
-    type: dict
+  type: dict
-    contains:
+  contains:
-        description:
+    description:
-            description: Group description
+      description: Group description
-            type: str
+      type: str
-            sample: "Demo Group"
+      sample: "Demo Group"
-        domain_id:
+    domain_id:
-            description: Domain for the group
+      description: Domain for the group
-            type: str
+      type: str
-            sample: "default"
+      sample: "default"
-        id:
+    id:
-            description: Unique group ID
+      description: Unique group ID
-            type: str
+      type: str
-            sample: "ee6156ff04c645f481a6738311aea0b0"
+      sample: "ee6156ff04c645f481a6738311aea0b0"
-        name:
+    name:
-            description: Group name
+      description: Group name
-            type: str
+      type: str
-            sample: "demo"
+      sample: "demo"
 '''
 
 from ansible_collections.openstack.cloud.plugins.module_utils.openstack import OpenStackModule
+from ansible_collections.openstack.cloud.plugins.module_utils.resource import StateMachine
 
 
 class IdentityGroupModule(OpenStackModule):
     argument_spec = dict(
-        name=dict(required=True),
         description=dict(),
         domain_id=dict(),
+        name=dict(required=True),
         state=dict(default='present', choices=['absent', 'present']),
     )
 
@@ -99,57 +99,40 @@ class IdentityGroupModule(OpenStackModule):
         supports_check_mode=True
     )
 
-    def _system_state_change(self, state, group):
+    class _StateMachine(StateMachine):
-        if state == 'present' and not group:
+        def _find(self, attributes, **kwargs):
-            return True
+            kwargs = dict((k, attributes[k])
-        if state == 'present' and self._build_update(group):
+                          for k in ['domain_id']
-            return True
+                          if k in attributes and attributes[k] is not None)
-        if state == 'absent' and group:
-            return True
-        return False
 
-    def _build_update(self, group):
+            return self.find_function(attributes['name'], **kwargs)
-        update = {}
-        desc = self.params['description']
-        if desc is not None and desc != group.description:
-            update['description'] = desc
-        return update
 
     def run(self):
-        name = self.params['name']
+        sm = self._StateMachine(connection=self.conn,
-        description = self.params['description']
+                                service_name='identity',
-        state = self.params['state']
+                                type_name='group',
-        domain_id = self.params['domain_id']
+                                sdk=self.sdk)
 
-        group_filters = {}
+        kwargs = dict((k, self.params[k])
-        if domain_id is not None:
+                      for k in ['state', 'timeout']
-            group_filters['domain_id'] = domain_id
+                      if self.params[k] is not None)
 
-        group = self.conn.identity.find_group(name, **group_filters)
+        kwargs['attributes'] = \
+            dict((k, self.params[k])
+                 for k in ['description', 'domain_id', 'name']
+                 if self.params[k] is not None)
 
-        if self.ansible.check_mode:
+        group, is_changed = sm(check_mode=self.ansible.check_mode,
-            self.exit_json(changed=self._system_state_change(state, group))
+                               updateable_attributes=None,
+                               non_updateable_attributes=['domain_id'],
+                               wait=False,
+                               **kwargs)
 
-        changed = False
+        if group is None:
-        if state == 'present':
+            self.exit_json(changed=is_changed)
-            if group is None:
+        else:
-                kwargs = dict(description=description, domain_id=domain_id)
+            self.exit_json(changed=is_changed,
-                kwargs = {k: v for k, v in kwargs.items() if v is not None}
+                           group=group.to_dict(computed=False))
-                group = self.conn.identity.create_group(
-                    name=name, **kwargs)
-                changed = True
-            else:
-                update = self._build_update(group)
-                if update:
-                    group = self.conn.identity.update_group(group, **update)
-                    changed = True
-            group = group.to_dict(computed=False)
-            self.exit_json(changed=changed, group=group)
-
-        elif state == 'absent' and group is not None:
-            self.conn.identity.delete_group(group)
-            changed = True
-        self.exit_json(changed=changed)
 
 
 def main():

plugins/modules/identity_group_info.py

@@ -4,108 +4,74 @@
 # Copyright (c) 2019, Phillipe Smith <phillipelnx@gmail.com>
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
-DOCUMENTATION = '''
+DOCUMENTATION = r'''
 ---
 module: identity_group_info
-short_description: Retrieve info about one or more OpenStack groups
+short_description: Fetch OpenStack identity (Keystone) groups
 author: OpenStack Ansible SIG
 description:
-    - Retrieve info about a one or more OpenStack groups.
+  - Fetch OpenStack identity (Keystone) groups.
 options:
-   name:
+  domain:
-     description:
+    description:
-        - Name or ID of the group.
+      - Name or ID of the domain containing the group.
-     type: str
+    type: str
-   domain:
+  filters:
-     description:
+    description:
-        - Name or ID of the domain containing the group if the cloud supports domains
+      - A dictionary of meta data to use for further filtering. Elements of
-     type: str
+        this dictionary may be additional dictionaries.
-   filters:
+    type: dict
-     description:
+  name:
-        - A dictionary of meta data to use for further filtering.  Elements of
+    description:
-          this dictionary may be additional dictionaries.
+      - Name or ID of the group.
-     type: dict
+    type: str
 extends_documentation_fragment:
-- openstack.cloud.openstack
+  - openstack.cloud.openstack
 '''
 
-EXAMPLES = '''
+EXAMPLES = r'''
-# Gather info about previously created groups
+- name: Gather previously created groups
-- name: gather info
+  openstack.cloud.identity_group_info:
-  hosts: localhost
+    cloud: awesomecloud
-  tasks:
-    - name: Gather info about previously created groups
-      openstack.cloud.identity_group_info:
-        cloud: awesomecloud
-      register: openstack_groups
-    - debug:
-        var: openstack_groups
 
-# Gather info about a previously created group by name
+- name: Gather previously created groups by name
-- name: gather info
+  openstack.cloud.identity_group_info:
-  hosts: localhost
+    cloud: awesomecloud
-  tasks:
+    name: demogroup
-    - name: Gather info about a previously created group by name
-      openstack.cloud.identity_group_info:
-        cloud: awesomecloud
-        name: demogroup
-      register: openstack_groups
-    - debug:
-        var: openstack_groups
 
-# Gather info about a previously created group in a specific domain
+- name: Gather previously created groups in a specific domain
-- name: gather info
+  openstack.cloud.identity_group_info:
-  hosts: localhost
+    cloud: awesomecloud
-  tasks:
+    domain: admindomain
-    - name: Gather info about a previously created group in a specific domain
-      openstack.cloud.identity_group_info:
-        cloud: awesomecloud
-        name: demogroup
-        domain: admindomain
-      register: openstack_groups
-    - debug:
-        var: openstack_groups
 
-# Gather info about a previously created group in a specific domain with filter
+- name: Gather and filter previously created groups
-- name: gather info
+  openstack.cloud.identity_group_info:
-  hosts: localhost
+    cloud: awesomecloud
-  tasks:
+    name: demogroup
-    - name: Gather info about a previously created group in a specific domain with filter
+    domain: admindomain
-      openstack.cloud.identity_group_info:
+    filters:
-        cloud: awesomecloud
+      is_enabled: False
-        name: demogroup
-        domain: admindomain
-        filters:
-          enabled: False
-      register: openstack_groups
-    - debug:
-        var: openstack_groups
 '''
 
-
+RETURN = r'''
-RETURN = '''
 groups:
-    description: Dictionary describing all the matching groups.
+  description: Dictionary describing all matching identity groups.
-    returned: always, but can be an empty list
+  returned: always
-    type: list
+  type: list
-    elements: dict
+  elements: dict
-    contains:
+  contains:
-        name:
+    name:
-            description: Name given to the group.
+      description: Name given to the group.
-            returned: success
+      type: str
-            type: str
+    description:
-        description:
+      description: Description of the group.
-            description: Description of the group.
+      type: str
-            returned: success
+    id:
-            type: str
+      description: Unique UUID.
-        id:
+      type: str
-            description: Unique UUID.
+    domain_id:
-            returned: success
+      description: Domain ID containing the group (keystone v3 clouds only)
-            type: str
+      type: bool
-        domain_id:
-            description: Domain ID containing the group (keystone v3 clouds only)
-            returned: success
-            type: bool
 '''
 
 from ansible_collections.openstack.cloud.plugins.module_utils.openstack import OpenStackModule
@@ -113,9 +79,9 @@ from ansible_collections.openstack.cloud.plugins.module_utils.openstack import O
 
 class IdentityGroupInfoModule(OpenStackModule):
     argument_spec = dict(
-        name=dict(),
         domain=dict(),
         filters=dict(type='dict'),
+        name=dict(),
     )
     module_kwargs = dict(
         supports_check_mode=True
@@ -123,20 +89,19 @@ class IdentityGroupInfoModule(OpenStackModule):
 
     def run(self):
         name = self.params['name']
-        domain = self.params['domain']
         filters = self.params['filters'] or {}
 
-        args = {}
+        kwargs = {}
-        if domain:
+        domain_name_or_id = self.params['domain']
-            dom = self.conn.identity.find_domain(domain)
+        if domain_name_or_id:
-            if dom:
+            domain = self.conn.identity.find_domain(domain_name_or_id)
-                args['domain_id'] = dom['id']
+            if domain is None:
-            else:
+                self.exit_json(changed=False, groups=[])
-                self.fail_json(msg='Domain name or ID does not exist')
+            kwargs['domain_id'] = domain['id']
 
-        groups = self.conn.search_groups(name, filters, **args)
+        groups = self.conn.search_groups(name, filters, **kwargs)
-        groups = [g.to_dict(computed=False) for g in groups]
+        self.exit_json(changed=False,
-        self.exit_json(changed=False, groups=groups)
+                       groups=[g.to_dict(computed=False) for g in groups])
 
 
 def main():