Prepare release metadata for openstack.cloud 2.6.0

Bump galaxy.yml to 2.6.0.
Add a 2.6.0 entry in changelogs/changelog.yaml,
regenerate CHANGELOG.rst with antsibull-changelog.

Tests-Run: tox -e pep8

Change-Id: I03a4a424d1f47a9fdaa70efae9b8c9a3fa60b072
Signed-off-by: Grzegorz Koper <grzegorzk@stackhpc.com>

.gitignore

@@ -4,3 +4,7 @@ ansible_collections
 FILES.json
 MANIFEST.json
 importer_result.json
+
+**/__pycache__
+.venv
+.python-version

.zuul.yaml

@@ -47,6 +47,8 @@
       devstack_services:
         designate: true
         neutron-dns: true
+        neutron-trunk: true
+        neutron-segments: true
       zuul_copy_output:
         '{{ devstack_log_dir }}/test_output.log': 'logs'
       extensions_to_txt:
@@ -94,6 +96,39 @@
         c-bak: false
       tox_extra_args: -vv --skip-missing-interpreters=false -- coe_cluster coe_cluster_template
 
+- job:
+    name: ansible-collections-openstack-functional-devstack-manila-base
+    parent: ansible-collections-openstack-functional-devstack-base
+    # Do not restrict branches in base jobs because else Zuul would not find a matching
+    # parent job variant during job freeze when child jobs are on other branches.
+    description: |
+      Run openstack collections functional tests against a devstack with Manila plugin enabled
+    # Do not set job.override-checkout or job.required-projects.override-checkout in base job because
+    # else Zuul will use this branch when matching variants for parent jobs during job freeze
+    required-projects:
+      - openstack/manila
+      - openstack/python-manilaclient
+    files:
+      - ^ci/roles/share_type/.*$
+      - ^plugins/modules/share_type.py
+      - ^plugins/modules/share_type_info.py
+    timeout: 10800
+    vars:
+      devstack_localrc:
+        MANILA_ENABLED_BACKENDS: generic
+        MANILA_OPTGROUP_generic_driver_handles_share_servers: true
+        MANILA_OPTGROUP_generic_connect_share_server_to_tenant_network: true
+        MANILA_USE_SERVICE_INSTANCE_PASSWORD: true
+      devstack_plugins:
+        manila: https://opendev.org/openstack/manila
+      devstack_services:
+        manila: true
+        m-api: true
+        m-sch: true
+        m-shr: true
+        m-dat: true
+      tox_extra_args: -vv --skip-missing-interpreters=false -- share_type share_type_info
+
 - job:
     name: ansible-collections-openstack-functional-devstack-magnum
     parent: ansible-collections-openstack-functional-devstack-magnum-base
@@ -103,6 +138,15 @@
       with Magnum plugin enabled, using master of openstacksdk and latest
       ansible release. Run it only on coe_cluster{,_template} changes.
 
+- job:
+    name: ansible-collections-openstack-functional-devstack-manila
+    parent: ansible-collections-openstack-functional-devstack-manila-base
+    branches: master
+    description: |
+      Run openstack collections functional tests against a master devstack
+      with Manila plugin enabled, using master of openstacksdk and latest
+      ansible release. Run it only on share_type{,_info} changes.
+
 - job:
     name: ansible-collections-openstack-functional-devstack-octavia-base
     parent: ansible-collections-openstack-functional-devstack-base
@@ -162,50 +206,48 @@
       tox_constraints_file: '{{ ansible_user_dir }}/{{ zuul.project.src_dir }}/tests/constraints-openstacksdk-1.x.x.txt'
       tox_install_siblings: false
 
-# Job with Ansible 2.9 for checking backward compatibility
 - job:
-    name: ansible-collections-openstack-functional-devstack-ansible-2.9
+    name: ansible-collections-openstack-functional-devstack-ansible-2.18
     parent: ansible-collections-openstack-functional-devstack-base
     branches: master
     description: |
       Run openstack collections functional tests against a master devstack
-      using master of openstacksdk and stable 2.9 branch of ansible
+      using master of openstacksdk and stable 2.18 branch of ansible
     required-projects:
       - name: github.com/ansible/ansible
-        override-checkout: stable-2.9
+        override-checkout: stable-2.18
     vars:
-      tox_envlist: ansible_2_9
+      tox_envlist: ansible_2_18
 
 - job:
-    name: ansible-collections-openstack-functional-devstack-ansible-2.11
+    name: ansible-collections-openstack-functional-devstack-ansible-2.19
     parent: ansible-collections-openstack-functional-devstack-base
     branches: master
     description: |
       Run openstack collections functional tests against a master devstack
-      using master of openstacksdk and stable 2.12 branch of ansible
+      using master of openstacksdk and stable 2.19 branch of ansible
     required-projects:
       - name: github.com/ansible/ansible
-        override-checkout: stable-2.11
+        override-checkout: stable-2.19
     vars:
-      tox_envlist: ansible_2_11
+      tox_envlist: ansible_2_19
 
 - job:
-    name: ansible-collections-openstack-functional-devstack-ansible-2.12
+    name: ansible-collections-openstack-functional-devstack-ansible-2.20
     parent: ansible-collections-openstack-functional-devstack-base
     branches: master
     description: |
       Run openstack collections functional tests against a master devstack
-      using master of openstacksdk and stable 2.12 branch of ansible
+      using master of openstacksdk and stable 2.20 branch of ansible
     required-projects:
       - name: github.com/ansible/ansible
-        override-checkout: stable-2.12
+        override-checkout: stable-2.20
     vars:
-      tox_envlist: ansible_2_12
+      tox_envlist: ansible_2_20
 
 - job:
     name: ansible-collections-openstack-functional-devstack-ansible-devel
     parent: ansible-collections-openstack-functional-devstack-base
-    nodeset: openstack-single-node-jammy
     branches: master
     description: |
       Run openstack collections functional tests against a master devstack
@@ -234,34 +276,58 @@
 - job:
     name: openstack-tox-linters-ansible-devel
     parent: openstack-tox-linters-ansible
-    nodeset: ubuntu-jammy
+    nodeset: ubuntu-noble
     description: |
       Run openstack collections linter tests using the devel branch of ansible
     # non-voting because we can't prevent ansible devel from breaking us
     voting: false
     vars:
-      python_version: '3.10'
+      python_version: '3.12'
       bindep_profile: test py310
 
 - job:
-    name: openstack-tox-linters-ansible-2.12
+    name: openstack-tox-linters-ansible-2.18
     parent: openstack-tox-linters-ansible
-    nodeset: ubuntu-focal
     description: |
-      Run openstack collections linter tests using the 2.12 branch of ansible
+      Run openstack collections linter tests using the 2.18 branch of ansible
     required-projects:
       - name: github.com/ansible/ansible
-        override-checkout: stable-2.12
+        override-checkout: stable-2.18
     vars:
-      ensure_tox_version: '<4'
-      tox_envlist: linters_2_12
-      python_version: 3.8
-      bindep_profile: test py38
+      tox_envlist: linters_2_18
+      python_version: "3.12"
+      bindep_profile: test py312
+
+- job:
+    name: openstack-tox-linters-ansible-2.19
+    parent: openstack-tox-linters-ansible
+    description: |
+      Run openstack collections linter tests using the 2.19 branch of ansible
+    required-projects:
+      - name: github.com/ansible/ansible
+        override-checkout: stable-2.19
+    vars:
+      tox_envlist: linters_2_19
+      python_version: "3.12"
+      bindep_profile: test py312
+
+- job:
+    name: openstack-tox-linters-ansible-2.20
+    parent: openstack-tox-linters-ansible
+    description: |
+      Run openstack collections linter tests using the 2.20 branch of ansible
+    required-projects:
+      - name: github.com/ansible/ansible
+        override-checkout: stable-2.20
+    vars:
+      tox_envlist: linters_2_20
+      python_version: "3.12"
+      bindep_profile: test py312
 
 # Cross-checks with other projects
 - job:
     name: bifrost-collections-src
-    parent: bifrost-integration-tinyipa-ubuntu-focal
+    parent: bifrost-integration-on-ubuntu-noble
     required-projects:
       - openstack/ansible-collections-openstack
       - # always use master branch when collecting parent job variants, refer to git blame for rationale.
@@ -272,7 +338,7 @@
         override-checkout: master
 - job:
     name: bifrost-keystone-collections-src
-    parent: bifrost-integration-tinyipa-keystone-ubuntu-focal
+    parent: bifrost-integration-keystone-on-ubuntu-noble
     required-projects:
       - openstack/ansible-collections-openstack
       - # always use master branch when collecting parent job variants, refer to git blame for rationale.
@@ -284,7 +350,7 @@
 
 - job:
     name: ansible-collections-openstack-release
-    parent: base
+    parent: openstack-tox-linters-ansible
     run: ci/publish/publish_collection.yml
     secrets:
       - ansible_galaxy_info
@@ -294,79 +360,71 @@
     data:
       url: https://galaxy.ansible.com
       token: !encrypted/pkcs1-oaep
-        - lZFzfoCbuwqV1k6qRfl/VS7E+knUW7+zpg7BptrenK4n0g7UY0HtdVkYq0pV0Tj/LbhzG
-          jHD0mehcV1iS6B7ORKg4criJkdDfEx09BD8z8yv0EleiIMmhlrCoMcY593OZMBtVbGi0D
-          CwQtNO98QIsfZogChfLfvRNiBmUV98mEb/p6p3EtGx8J7qcAsqfWxc/CzB8GCleLAHHHT
-          FuikMM03ZnV0ew7E+TPkHbzzPhBZOqS5HYF0HtgttHwIXdfIWp/XdTuEEk7uRRgYZ2Iao
-          ifWRzoKaOQmhM++e1ydCqw9D4y9dZEFNMQLwSqcrvtb8cNwT1kl7SCFqYNE2lbutj4ne6
-          PTBQRsKegMB4Y3ena14fNF6tCynvJLPhF/cjPH2Jhs+B19XQhWkL3TgiOY02W24YHwRcP
-          +LdkM8inAvyVi3DEbEqdjBPO9OFJcBOKPlCdkGvuwdNCuEpEwctWs0gV3voflG2CDKzmJ
-          wu9JJOAWnq/0l1WpuDqWreKeQ/BUGZC2Gb4xRAqofulgvhs4WuYoEccjH4EJFIZ90S1EP
-          R/ZLadqZaEhmjwGM5sMWbBbjT23XsRgg0Tzt9m8DENYMuYDqkMdRbt2jYZa+32p4hyxVe
-          Y6H/pqYq5b9uOzumnShaK4WlmkQyXcNPkoSlMC1h4OGvqX/WUixpI38jyMA5Tc=
+        - K93hOZo1B5z248H04COB1N2HCkGbFPo2EUr+0W7qFzsrdvmbsAI86Hl9bUCfEENGrwvfV
+          0j9CE5iO0tyqal3r6ucMhGT44MgQWL3MBeRvK89yAJpSNMU7R7rEY/zbjZMoC9YElcHEv
+          GEDZSA/0gQHCHpZVDlx4JMGwrnd+Nz9ha3c12BYeZS8rS/dQl7EmZ867OsozmNdG9UkkC
+          0vP/dkenUQNvoZOSWgZztRBlbAyI1nc5iEEw9vvpLh19HcY9+S2iAZkgSq4jOOO4wn7gE
+          XAZPr0HRdwS2m4Hw0Pusrg7SdC3+2O0N/fvFGnvvKXHcSgQk3rPLn6HfKzOJoPWc4WlDX
+          MA79jYloNBXjOaeXOoiwYzzshWK53F6Ci+3leq1cYuFyHSi2ds2mYXat7YndZSsmsk5um
+          hj0+Ddy9Om1uYy3nhHyZLULE7UDUmduA9EPkvdyWlcW0yZL2kXcrDTHlSp4PaJg9iKVys
+          0aOOo9CNMwhyXAOGiFCYF/m7Efbnp50zUQhHN9+7LeVzXZuiH98C8kNvWfE0qrkrrgQ1n
+          78UMqGcGpdw4ZSlWrDTbrbd4v0bRnsJ+IAWISnT5OXaeJgGZwXRuBHtTXqbjoosBeX/8w
+          YKb0lx7E5ZtSw7+Y6LNDGihGTmVg1nkZUWo85CxyF/RiWHuNvpkzzqXmdGS1bg=
 
 - project:
     check:
       jobs:
         - tox-pep8
         - openstack-tox-linters-ansible-devel
-        - openstack-tox-linters-ansible-2.12
-        - ansible-collections-openstack-functional-devstack:
-            dependencies: &deps_unit_lint
-              - tox-pep8
-              - openstack-tox-linters-ansible-2.12
-
-        - ansible-collections-openstack-functional-devstack-releases:
-            dependencies: *deps_unit_lint
-        - ansible-collections-openstack-functional-devstack-ansible-2.9:
-            dependencies: *deps_unit_lint
-        - ansible-collections-openstack-functional-devstack-ansible-2.12:
-            dependencies: *deps_unit_lint
-        - ansible-collections-openstack-functional-devstack-ansible-devel:
-            dependencies: *deps_unit_lint
-        - ansible-collections-openstack-functional-devstack-magnum:
-            dependencies: *deps_unit_lint
-        - ansible-collections-openstack-functional-devstack-octavia:
-            dependencies: *deps_unit_lint
+        - openstack-tox-linters-ansible-2.18
+        - openstack-tox-linters-ansible-2.19
+        - openstack-tox-linters-ansible-2.20
+        - ansible-collections-openstack-functional-devstack
+        - ansible-collections-openstack-functional-devstack-releases
+        - ansible-collections-openstack-functional-devstack-ansible-2.18
+        - ansible-collections-openstack-functional-devstack-ansible-2.19
+        - ansible-collections-openstack-functional-devstack-ansible-2.20
+        - ansible-collections-openstack-functional-devstack-ansible-devel
+        - ansible-collections-openstack-functional-devstack-magnum
+        - ansible-collections-openstack-functional-devstack-manila
+        - ansible-collections-openstack-functional-devstack-octavia
 
         - bifrost-collections-src:
             voting: false
-            dependencies: *deps_unit_lint
             irrelevant-files: *ignore_files
         - bifrost-keystone-collections-src:
             voting: false
-            dependencies: *deps_unit_lint
             irrelevant-files: *ignore_files
 
     gate:
       jobs:
         - tox-pep8
-        - openstack-tox-linters-ansible-2.12
-        # - ansible-collections-openstack-functional-devstack
+        - openstack-tox-linters-ansible-2.18
+        - openstack-tox-linters-ansible-2.19
+        - openstack-tox-linters-ansible-2.20
         - ansible-collections-openstack-functional-devstack-releases
-        # - ansible-collections-openstack-functional-devstack-ansible-2.9
-        # - ansible-collections-openstack-functional-devstack-ansible-2.12
         - ansible-collections-openstack-functional-devstack-magnum
+        - ansible-collections-openstack-functional-devstack-manila
         - ansible-collections-openstack-functional-devstack-octavia
 
     periodic:
       jobs:
         - openstack-tox-linters-ansible-devel
-        - openstack-tox-linters-ansible-2.12
+        - openstack-tox-linters-ansible-2.18
+        - openstack-tox-linters-ansible-2.19
+        - openstack-tox-linters-ansible-2.20
         - ansible-collections-openstack-functional-devstack
         - ansible-collections-openstack-functional-devstack-releases
-        - ansible-collections-openstack-functional-devstack-ansible-2.9
-        - ansible-collections-openstack-functional-devstack-ansible-2.12
+        - ansible-collections-openstack-functional-devstack-ansible-2.18
+        - ansible-collections-openstack-functional-devstack-ansible-2.19
+        - ansible-collections-openstack-functional-devstack-ansible-2.20
         - ansible-collections-openstack-functional-devstack-ansible-devel
         - bifrost-collections-src
         - bifrost-keystone-collections-src
         - ansible-collections-openstack-functional-devstack-magnum
+        - ansible-collections-openstack-functional-devstack-manila
         - ansible-collections-openstack-functional-devstack-octavia
 
-    experimental:
-      jobs:
-        - ansible-collections-openstack-functional-devstack-ansible-2.11
-
     tag:
       jobs:
         - ansible-collections-openstack-release

CHANGELOG.rst

@@ -4,6 +4,259 @@ Ansible OpenStack Collection Release Notes
 
 .. contents:: Topics
 
+v2.6.0
+======
+
+Release Summary
+---------------
+
+New modules for Bare Metal port groups and Neutron network segments, plus image/project enhancements and bugfixes.
+
+
+Minor Changes
+-------------
+
+- Add support for setting the shard key on a baremetal node.
+- image - Add support for image ID reservation and queued image creation
+- project - Support updating extra_specs
+
+Bugfixes
+--------
+
+- Fix Ansible errors
+- Fixed compatability with openstacksdk version 4.15.0
+
+New Modules
+-----------
+
+- openstack.cloud.baremetal_port_group - Create/Delete Bare Metal port group resources from OpenStack
+- openstack.cloud.compute_service - Update OpenStack Compute (Nova) services
+- openstack.cloud.network_segment - Creates/removes network segments from OpenStack
+- openstack.cloud.volume_image_metadata - Manage OpenStack Cinder volume image metadata
+- openstack.cloud.volume_retype - Retype (change the volume type of) a Cinder block storage volume
+
+v2.5.0
+======
+
+Release Summary
+---------------
+
+Bugfixes and minor changes
+
+Major Changes
+-------------
+
+- Add import_method to module
+- Add object_containers_info module
+- Add support for filters in inventory
+- Add volume_manage module
+- Introduce share_type modules
+
+Minor Changes
+-------------
+
+- Allow role_assignment module to work cross domain
+- Don't compare current state for `reboot_*` actions
+- Fix disable_gateway_ip for subnet
+- Fix example in the dns_zone_info module doc
+- Fix router module external IPs when only subnet specified
+- Fix the bug reporting url
+- Let clouds_yaml_path behave as documented (Override path to clouds.yaml file)
+- Shows missing data in `stack_info` module output
+
+v2.4.1
+======
+
+Release Summary
+---------------
+
+Bugfixes and minor changes
+
+Minor Changes
+-------------
+
+- Update tags when changing server
+
+Bugfixes
+--------
+
+- Fix missed client_cert in OpenStackModule
+
+v2.4.0
+======
+
+Release Summary
+---------------
+
+New trait module and minor changes
+
+Major Changes
+-------------
+
+- Add trait module
+
+Minor Changes
+-------------
+
+- Add loadbalancer quota options
+- Allow create instance with tags
+
+New Modules
+-----------
+
+- openstack.cloud.trait - Add or Delete a trait from OpenStack
+
+v2.3.3
+======
+
+Release Summary
+---------------
+
+Bugfixes and minor changes
+
+Minor Changes
+-------------
+
+- Add test to only_ipv4 in inventory
+- add an option to use only IPv4 only for ansible_host and ansible_ssh_host
+
+Bugfixes
+--------
+
+- CI - Fix deprecated ANSIBLE_COLLECTIONS_PATHS variable
+
+v2.3.2
+======
+
+Release Summary
+---------------
+
+Bugfixes and minor changes
+
+Minor Changes
+-------------
+
+- Drop compat implementations for tests
+
+Bugfixes
+--------
+
+- Fix openstack.cloud.port module failure in check mode
+
+v2.3.1
+======
+
+Release Summary
+---------------
+
+Client TLS certificate support
+
+Minor Changes
+-------------
+
+- Add ability to pass client tls certificate
+
+v2.3.0
+======
+
+Release Summary
+---------------
+
+Bugfixes and new modules
+
+Major Changes
+-------------
+
+- Add Neutron trunk module
+- Add application_credential module
+- Add module to filter available volume services
+
+Minor Changes
+-------------
+
+- Add inactive state for the images
+- Add insecure_registry property to coe_cluster_templates
+- Add support for creation of the default external networks
+- Add target_all_project option
+- Add vlan_tranparency for creation networks
+- Allow munch results in server_info module
+- Allow to specify multiple allocation pools when creating a subnet
+- CI - Disable auto-discovery for setuptools
+- CI - Don't create port with binding profile
+- CI - Fix CI in collection
+- CI - Fix linters-devel and devstack tests
+- CI - Fix regression in quota module
+- CI - Fix test for server shelve
+- CI - Migrate Bifrost jobs to Ubuntu Jammy
+- CI - Remove 2.9 jobs from Zuul config
+- CI - Run functional testing regardless of pep8/linter results
+- Enable glance-direct interop image import
+- Ensure coe_cluster_template compare labels properly
+- Wait for deleted server to disappear from results
+- router - Allow specifying external network name in a different project
+
+Bugfixes
+--------
+
+- Allow wait false when auto_ip is false
+- Fix exception when creating object from file
+- Fix exception when updating container with metadata
+- Fix typo in openstack.cloud.lb_pool
+- Fix typo in parameter description
+- fix subnet module - allow cidr option with subnet_pool
+
+New Modules
+-----------
+
+- openstack.cloud.application_credential - Manage OpenStack Identity (Keystone) application credentials
+- openstack.cloud.trunk - Add or delete trunks from an OpenStack cloud
+- openstack.cloud.volume_service_info - Fetch OpenStack Volume (Cinder) services
+
+v2.2.0
+======
+
+Release Summary
+---------------
+
+New module for volume_type and bugfixes
+
+Minor Changes
+-------------
+
+- Add volume_encryption_type modules
+- Add volume_type modules
+
+Bugfixes
+--------
+
+- Fix image module filter
+- Fix port module idempotency
+- Fix router module idempotency
+
+v2.1.0
+======
+
+Release Summary
+---------------
+
+New module for Ironic and bugfixes
+
+Minor Changes
+-------------
+
+- Add baremetal_deploy_template module
+- Highlight our mode of operation more prominently
+
+Bugfixes
+--------
+
+- Change security group rules only when instructed to do so
+- Fix for AttributeError: 'dict' object has no attribute 'status'
+- Fix issue with multiple records in recordset
+- Fix mistake in compute_flavor_access notes
+- Fixed private option in inventory plugin
+- Respect description option and delete security group rules first
+- Use true and false instead of yes and no for boolean values
 
 v2.0.0
 ======

README.md

@@ -6,6 +6,12 @@ http://zuul.opendev.org/t/openstack/builds?project=openstack%2Fansible-collectio
 Ansible OpenStack collection aka `openstack.cloud` provides Ansible modules and Ansible plugins for managing OpenStack
 clouds. It is supported and maintained by the OpenStack community.
 
+**NOTE:** We need and value your contributions! Maintaining this collection is a community effort. We are all both users
+and developers of this collection at the same time. If you find a bug, please report it. If you have fixed a bug, please
+submit a patch. If you need new functionality which is not covered by this collection yet, please extend an existing
+module or submit a new one. Our [Contributing](#contributing) section below has tons of docs to check out. Please get in
+touch!
+
 ## Branches and Non Backward Compatibility ⚠️
 
 Our codebase has been split into two separate release series, `2.x.x` and `1.x.x`:
@@ -205,7 +211,7 @@ Thank you for your interest in our Ansible OpenStack collection ☺️
 There are many ways in which you can participate in the project, for example:
 
 - [Report and verify bugs and help with solving issues](
-  https://storyboard.openstack.org/#!/project/openstack/ansible-collections-openstack).
+  https://bugs.launchpad.net/ansible-collections-openstack).
 - [Submit and review patches](
   https://review.opendev.org/#/q/project:openstack/ansible-collections-openstack).
 - Follow OpenStack's [How To Contribute](https://wiki.openstack.org/wiki/How_To_Contribute) guide.
@@ -216,8 +222,7 @@ docs/reviewing.md) (⚠️) before sending your first patch. Pull requests submi
 ## Communication
 
 We have a Special Interest Group for the Ansible OpenStack collection. Join us in `#openstack-ansible-sig` on
-[OFTC IRC](https://www.oftc.net/) and ping Artem Goncharov <artem.goncharov@gmail.com> (gtema), Jakob Meng
-<mail@jakobmeng.de> (jm1) or Sagi Shnaidman <sshnaidm@redhat.com> (sshnaidm) 🍪
+[OFTC IRC](https://www.oftc.net/) 🍪
 
 ## License
 

changelogs/changelog.yaml

@@ -500,3 +500,168 @@ releases:
         directory which could be used to generate and develop new Ansible modules
         for this collection have been removed.
     release_date: '2023-01-31'
+  2.1.0:
+    changes:
+      bugfixes:
+      - Change security group rules only when instructed to do so
+      - 'Fix for AttributeError: ''dict'' object has no attribute ''status'''
+      - Fix issue with multiple records in recordset
+      - Fix mistake in compute_flavor_access notes
+      - Fixed private option in inventory plugin
+      - Respect description option and delete security group rules first
+      - Use true and false instead of yes and no for boolean values
+      minor_changes:
+      - Add baremetal_deploy_template module
+      - Highlight our mode of operation more prominently
+      release_summary: New module for Ironic and bugfixes
+    release_date: '2023-04-19'
+  2.2.0:
+    changes:
+      bugfixes:
+      - Fix image module filter
+      - Fix port module idempotency
+      - Fix router module idempotency
+      minor_changes:
+      - Add volume_encryption_type modules
+      - Add volume_type modules
+      release_summary: New module for volume_type and bugfixes
+    release_date: '2023-12-01'
+  2.3.0:
+    changes:
+      bugfixes:
+      - Allow wait false when auto_ip is false
+      - Fix exception when creating object from file
+      - Fix exception when updating container with metadata
+      - Fix typo in openstack.cloud.lb_pool
+      - Fix typo in parameter description
+      - fix subnet module - allow cidr option with subnet_pool
+      major_changes:
+      - Add Neutron trunk module
+      - Add application_credential module
+      - Add module to filter available volume services
+      minor_changes:
+      - Add inactive state for the images
+      - Add insecure_registry property to coe_cluster_templates
+      - Add support for creation of the default external networks
+      - Add target_all_project option
+      - Add vlan_tranparency for creation networks
+      - Allow munch results in server_info module
+      - Allow to specify multiple allocation pools when creating a subnet
+      - CI - Disable auto-discovery for setuptools
+      - CI - Don't create port with binding profile
+      - CI - Fix CI in collection
+      - CI - Fix linters-devel and devstack tests
+      - CI - Fix regression in quota module
+      - CI - Fix test for server shelve
+      - CI - Migrate Bifrost jobs to Ubuntu Jammy
+      - CI - Remove 2.9 jobs from Zuul config
+      - CI - Run functional testing regardless of pep8/linter results
+      - Enable glance-direct interop image import
+      - Ensure coe_cluster_template compare labels properly
+      - Wait for deleted server to disappear from results
+      - router - Allow specifying external network name in a different project
+      release_summary: Bugfixes and new modules
+    modules:
+    - description: Manage OpenStack Identity (Keystone) application credentials
+      name: application_credential
+      namespace: ''
+    - description: Add or delete trunks from an OpenStack cloud
+      name: trunk
+      namespace: ''
+    - description: Fetch OpenStack Volume (Cinder) services
+      name: volume_service_info
+      namespace: ''
+    release_date: '2024-11-28'
+  2.3.1:
+    changes:
+      minor_changes:
+      - Add ability to pass client tls certificate
+      release_summary: Client TLS certificate support
+    release_date: '2024-12-18'
+  2.3.2:
+    changes:
+      bugfixes:
+      - Fix openstack.cloud.port module failure in check mode
+      minor_changes:
+      - Drop compat implementations for tests
+      release_summary: Bugfixes and minor changes
+    release_date: '2024-12-20'
+  2.3.3:
+    changes:
+      bugfixes:
+      - CI - Fix deprecated ANSIBLE_COLLECTIONS_PATHS variable
+      minor_changes:
+      - Add test to only_ipv4 in inventory
+      - add an option to use only IPv4 only for ansible_host and ansible_ssh_host
+      release_summary: Bugfixes and minor changes
+    release_date: '2024-12-22'
+  2.4.0:
+    changes:
+      major_changes:
+      - Add trait module
+      minor_changes:
+      - Add loadbalancer quota options
+      - Allow create instance with tags
+      release_summary: New trait module and minor changes
+    modules:
+    - description: Add or Delete a trait from OpenStack
+      name: trait
+      namespace: ''
+    release_date: '2025-01-15'
+  2.4.1:
+    changes:
+      bugfixes:
+      - Fix missed client_cert in OpenStackModule
+      minor_changes:
+      - Update tags when changing server
+      release_summary: Bugfixes and minor changes
+    release_date: '2024-01-20'
+  2.5.0:
+    changes:
+      major_changes:
+      - Add import_method to module
+      - Add object_containers_info module
+      - Add support for filters in inventory
+      - Add volume_manage module
+      - Introduce share_type modules
+      minor_changes:
+      - Allow role_assignment module to work cross domain
+      - Don't compare current state for `reboot_*` actions
+      - Fix disable_gateway_ip for subnet
+      - Fix example in the dns_zone_info module doc
+      - Fix router module external IPs when only subnet specified
+      - Fix the bug reporting url
+      - Let clouds_yaml_path behave as documented (Override path to clouds.yaml file)
+      - Shows missing data in `stack_info` module output
+      release_summary: Bugfixes and minor changes
+    release_date: '2025-10-24'
+  2.6.0:
+    changes:
+      bugfixes:
+      - Fix Ansible errors
+      - Fixed compatability with openstacksdk version 4.15.0
+      minor_changes:
+      - Add support for setting the shard key on a baremetal node.
+      - image - Add support for image ID reservation and queued image creation
+      - project - Support updating extra_specs
+      release_summary: New modules for Bare Metal port groups and Neutron network
+        segments, plus image/project enhancements and bugfixes.
+    fragments:
+    - add_shard_key_field_for_baremetal_node.yaml
+    modules:
+    - description: Create/Delete Bare Metal port group resources from OpenStack
+      name: baremetal_port_group
+      namespace: ''
+    - description: Update OpenStack Compute (Nova) services
+      name: compute_service
+      namespace: ''
+    - description: Creates/removes network segments from OpenStack
+      name: network_segment
+      namespace: ''
+    - description: Manage OpenStack Cinder volume image metadata
+      name: volume_image_metadata
+      namespace: ''
+    - description: Retype (change the volume type of) a Cinder block storage volume
+      name: volume_retype
+      namespace: ''
+    release_date: '2026-06-10'

ci/publish/publish_collection.yml

@@ -3,7 +3,8 @@
   vars:
     collection_path: "{{ ansible_user_dir }}/{{ zuul.project.src_dir }}"
     build_collection_path: /tmp/collection_built/
-    ansible_galaxy_path: "~/.local/bin/ansible-galaxy"
+    ansible_virtualenv_path: /tmp/ansible_venv
+    ansible_galaxy_path: "{{ ansible_virtualenv_path }}/bin/ansible-galaxy"
 
   tasks:
 
@@ -11,9 +12,15 @@
       include_role:
         name: ensure-pip
 
-    - name: Install ansible
+    - name: Install Ansible in virtualenv
       pip:
-        name: ansible-core<2.12
+        name: ansible-core<2.19
+        virtualenv: "{{ ansible_virtualenv_path }}"
+        virtualenv_command: "{{ ensure_pip_virtualenv_command }}"
+
+    - name: Detect ansible version
+      command: "{{ ansible_virtualenv_path }}/bin/ansible --version"
+      register: ansible_version
 
     - name: Discover tag version
       set_fact:

ci/roles/application_credential/defaults/main.yml

@@ -0,0 +1,9 @@
+expected_fields:
+  - description
+  - expires_at
+  - id
+  - name
+  - project_id
+  - roles
+  - secret
+  - unrestricted

ci/roles/application_credential/tasks/main.yml

@@ -0,0 +1,61 @@
+---
+
+- name: Create application credentials
+  openstack.cloud.application_credential:
+    cloud: "{{ cloud }}"
+    state: present
+    name: ansible_creds
+    description: dummy description
+  register: appcred
+
+- name: Assert return values of application_credential module
+  assert:
+    that:
+      - appcred is changed
+      # allow new fields to be introduced but prevent fields from being removed
+      - expected_fields|difference(appcred.application_credential.keys())|length == 0
+
+- name: Create the application credential again
+  openstack.cloud.application_credential:
+    cloud: "{{ cloud }}"
+    state: present
+    name: ansible_creds
+    description: dummy description
+  register: appcred
+
+- name: Assert return values of ansible_credential module
+  assert:
+    that:
+      # credentials are immutable so creating twice will cause delete and create
+      - appcred is changed
+      # allow new fields to be introduced but prevent fields from being removed
+      - expected_fields|difference(appcred.application_credential.keys())|length == 0
+
+- name: Update the application credential again
+  openstack.cloud.application_credential:
+    cloud: "{{ cloud }}"
+    state: present
+    name: ansible_creds
+    description: new description
+  register: appcred
+
+- name: Assert application credential changed
+  assert:
+     that:
+       - appcred is changed
+       - appcred.application_credential.description == 'new description'
+
+- name: Get list of all keypairs using application credential
+  openstack.cloud.keypair_info:
+    cloud: "{{ appcred.cloud }}"
+
+- name: Delete application credential
+  openstack.cloud.application_credential:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: ansible_creds
+  register: appcred
+
+- name: Assert application credential changed
+  assert:
+     that: appcred is changed

ci/roles/baremetal_deploy_template/defaults/main.yml

@@ -0,0 +1,7 @@
+expected_fields:
+  - created_at
+  - extra
+  - id
+  - name
+  - steps
+  - updated_at

ci/roles/baremetal_deploy_template/tasks/main.yml

@@ -0,0 +1,58 @@
+---
+# TODO: Actually run this role in CI. Atm we do not have DevStack's ironic plugin enabled.
+- name: Create baremetal deploy template
+  openstack.cloud.baremetal_deploy_template:
+    cloud: "{{ cloud }}"
+    state: present
+    name: CUSTOM_ANSIBLE_DEPLOY_TEMPLATE
+    steps:
+      - interface: bios
+        step: apply_configuration
+        args:
+          settings:
+            - name: some-setting
+              value: some-value
+        priority: 110
+  register: template
+
+- debug: var=template
+
+- name: Assert return values of baremetal_deploy_template module
+  assert:
+    that:
+      # allow new fields to be introduced but prevent fields from being removed
+      - expected_fields|difference(template.template.keys())|length == 0
+
+- name: Update baremetal deploy template
+  openstack.cloud.baremetal_deploy_template:
+    cloud: "{{ cloud }}"
+    state: present
+    id: "{{ template.template.id }}"
+    extra:
+      foo: bar
+  register: updated_template
+
+- name: Assert return values of updated baremetal deploy template
+  assert:
+    that:
+      - updated_template is changed
+      - updated_template.template.id == template.template.id
+
+- name: Update baremetal deploy template again
+  openstack.cloud.baremetal_deploy_template:
+    cloud: "{{ cloud }}"
+    state: present
+    id: "{{ template.template.id }}"
+  register: updated_template
+
+- name: Assert return values of updated baremetal deploy template
+  assert:
+    that:
+      - updated_template is not changed
+      - updated_template.template.id == template.template.id
+
+- name: Delete Bare Metal deploy template
+  openstack.cloud.baremetal_deploy_template:
+    cloud: "{{ cloud }}"
+    state: absent
+    id: "{{ template.template.id }}"

ci/roles/baremetal_inspect/defaults/main.yml

@@ -46,6 +46,7 @@ expected_fields:
   - reservation
   - resource_class
   - retired_reason
+  - shard
   - states
   - storage_interface
   - target_power_state

ci/roles/baremetal_node/defaults/main.yml

@@ -46,6 +46,7 @@ expected_fields:
   - reservation
   - resource_class
   - retired_reason
+  - shard
   - states
   - storage_interface
   - target_power_state

ci/roles/baremetal_port_group/defaults/main.yml

@@ -0,0 +1,12 @@
+expected_fields:
+  - address
+  - created_at
+  - extra
+  - id
+  - links
+  - mode
+  - name
+  - node_id
+  - properties
+  - standalone_ports_supported
+  - updated_at

ci/roles/baremetal_port_group/tasks/main.yml

@@ -0,0 +1,100 @@
+---
+# TODO: Actually run this role in CI. Atm we do not have DevStack's ironic plugin enabled.
+- name: Create baremetal node
+  openstack.cloud.baremetal_node:
+    cloud: "{{ cloud }}"
+    driver_info:
+      ipmi_address: "1.2.3.4"
+      ipmi_username: "admin"
+      ipmi_password: "secret"
+    name: ansible_baremetal_node
+    nics:
+      - mac: "aa:bb:cc:aa:bb:cc"
+    state: present
+  register: node
+
+- name: Create baremetal port group
+  openstack.cloud.baremetal_port_group:
+    cloud: "{{ cloud }}"
+    state: present
+    name: ansible_baremetal_port_group
+    node: ansible_baremetal_node
+    address: fa:16:3e:aa:aa:ab
+    mode: active-backup
+    standalone_ports_supported: true
+    extra:
+      test: created
+    properties:
+      miimon: '100'
+  register: port_group
+
+- debug: var=port_group
+
+- name: Assert return values of baremetal_port_group module
+  assert:
+    that:
+      # allow new fields to be introduced but prevent fields from being removed
+      - expected_fields|difference(port_group.port_group.keys())|length == 0
+      - port_group.port_group.name == "ansible_baremetal_port_group"
+      - port_group.port_group.node_id == node.node.id
+
+- name: Update baremetal port group
+  openstack.cloud.baremetal_port_group:
+    cloud: "{{ cloud }}"
+    state: present
+    id: "{{ port_group.port_group.id }}"
+    mode: 802.3ad
+    standalone_ports_supported: false
+    extra:
+      test: updated
+  register: updated_port_group
+
+- name: Assert return values of updated baremetal port group
+  assert:
+    that:
+      - updated_port_group is changed
+      - updated_port_group.port_group.id == port_group.port_group.id
+      - updated_port_group.port_group.mode == "802.3ad"
+      - not updated_port_group.port_group.standalone_ports_supported
+      - updated_port_group.port_group.extra.test == "updated"
+
+- name: Update baremetal port group again
+  openstack.cloud.baremetal_port_group:
+    cloud: "{{ cloud }}"
+    state: present
+    id: "{{ port_group.port_group.id }}"
+    mode: 802.3ad
+    standalone_ports_supported: false
+    extra:
+      test: updated
+  register: updated_port_group
+
+- name: Assert idempotency for baremetal port group module
+  assert:
+    that:
+      - updated_port_group is not changed
+      - updated_port_group.port_group.id == port_group.port_group.id
+
+- name: Delete baremetal port group
+  openstack.cloud.baremetal_port_group:
+    cloud: "{{ cloud }}"
+    state: absent
+    id: "{{ port_group.port_group.id }}"
+
+- name: Delete baremetal port group again
+  openstack.cloud.baremetal_port_group:
+    cloud: "{{ cloud }}"
+    state: absent
+    id: "{{ port_group.port_group.id }}"
+  register: deleted_port_group
+
+- name: Assert idempotency for deleted baremetal port group
+  assert:
+    that:
+      - deleted_port_group is not changed
+
+- name: Delete baremetal node
+  openstack.cloud.baremetal_node:
+    cloud: "{{ cloud }}"
+    name: ansible_baremetal_node
+    state: absent

ci/roles/coe_cluster/tasks/main.yml

@@ -72,6 +72,8 @@
     image_id: '{{ image_id }}'
     is_floating_ip_enabled: true
     keypair_id: '{{ keypair.keypair.id }}'
+    flavor_id: 'm1.small'
+    master_flavor_id: 'm1.small'
     name: k8s
     state: present
   register: coe_cluster_template

ci/roles/coe_cluster_template/tasks/main.yml

@@ -26,6 +26,9 @@
     keypair_id: '{{ keypair.keypair.id }}'
     name: k8s
     state: present
+    labels:
+      docker_volume_size: 10
+      cloud_provider_tag: v1.23.1
   register: coe_cluster_template
 
 - name: Assert return values of coe_cluster_template module
@@ -43,6 +46,9 @@
     keypair_id: '{{ keypair.keypair.id }}'
     name: k8s
     state: present
+    labels:
+      docker_volume_size: 10
+      cloud_provider_tag: v1.23.1
   register: coe_cluster_template
 
 - name: Assert return values of coe_cluster_template module

ci/roles/compute_service/tasks/main.yml

@@ -21,3 +21,50 @@
   assert:
     that:
       - compute_services.compute_services | length > 0
+
+- name: Disable compute service on a node
+  openstack.cloud.compute_service:
+    cloud: "{{ cloud }}"
+    host: "{{ compute_services.compute_services[0].host }}"
+    binary: 'nova-compute'
+    status: 'disabled'
+    disabled_reason: 'maintenance'
+  register: compute_service_disabled
+
+- name: Assert service being "disabled"
+  ansible.builtin.assert:
+    that:
+      - compute_service_disabled.compute_services | map(attribute='status') | unique | length == 1
+      - compute_service_disabled.compute_services | map(attribute='disabled_reason') | unique | length == 1
+      - compute_service_disabled.compute_services[0].status == "disabled"
+      - compute_service_disabled.compute_services[0].disabled_reason == "maintenance"
+      - compute_service_disabled is changed
+
+- name: Disable compute service on a node again
+  openstack.cloud.compute_service:
+    cloud: "{{ cloud }}"
+    host: "{{ compute_services.compute_services[0].host }}"
+    binary: 'nova-compute'
+    status: 'disabled'
+    disabled_reason: 'maintenance'
+  register: compute_service_disabled_again
+
+- name: Assert idempotency of service disable
+  ansible.builtin.assert:
+    that:
+      - compute_service_disabled_again is not changed
+
+- name: Re-enable compute service
+  openstack.cloud.compute_service:
+    cloud: "{{ cloud }}"
+    host: "{{ compute_services.compute_services[0].host }}"
+    binary: 'nova-compute'
+    status: 'enabled'
+  register: compute_service_enabled
+
+- name: Assert service being "disabled"
+  ansible.builtin.assert:
+    that:
+      - compute_service_enabled.compute_services | map(attribute='status') | unique | length == 1
+      - compute_service_enabled.compute_services[0].status == "enabled"
+      - compute_service_enabled is changed

ci/roles/federation_mapping/tasks/main.yml

@@ -19,7 +19,7 @@
         name: '{{ mapping_name }}'
         rules: '{{ mapping_rules_1 }}'
       register: create_mapping
-      check_mode: yes
+      check_mode: true
 
     - assert:
         that:
@@ -91,7 +91,7 @@
         name: '{{ mapping_name }}'
         rules: '{{ mapping_rules_1 }}'
       register: create_mapping
-      check_mode: yes
+      check_mode: true
 
     - assert:
         that:
@@ -117,7 +117,7 @@
         name: '{{ mapping_name }}'
         rules: '{{ mapping_rules_2 }}'
       register: update_mapping
-      check_mode: yes
+      check_mode: true
 
     - assert:
         that:
@@ -196,7 +196,7 @@
         state: 'absent'
         name: '{{ mapping_name }}'
       register: delete_mapping
-      check_mode: yes
+      check_mode: true
 
     - assert:
         that:
@@ -217,7 +217,7 @@
         state: 'absent'
         name: '{{ mapping_name }}'
       register: delete_mapping
-      check_mode: yes
+      check_mode: true
 
     - assert:
         that:
@@ -257,10 +257,10 @@
       openstack.cloud.federation_mapping:
          state: 'absent'
          name: '{{ mapping_name }}'
-      ignore_errors: yes
+      ignore_errors: true
 
     - name: 'Delete second mapping'
       openstack.cloud.federation_mapping:
          state: 'absent'
          name: '{{ mapping_name_2 }}'
-      ignore_errors: yes
+      ignore_errors: true

ci/roles/floating_ip/tasks/main.yml

@@ -27,6 +27,12 @@
     name: ansible_external
     external: true
 
+- name: Gather information about external network
+  openstack.cloud.networks_info:
+    cloud: "{{ cloud }}"
+    name: ansible_external
+  register: external_network
+
 - name: Create external subnet
   openstack.cloud.subnet:
     cloud: "{{ cloud }}"
@@ -98,6 +104,17 @@
       - ip_address: 10.7.7.102
   register: port3
 
+- name: Create internal port 4
+  openstack.cloud.port:
+    cloud: "{{ cloud }}"
+    state: present
+    name: ansible_internal_port4
+    network: ansible_internal
+    fixed_ips:
+      - ip_address: 10.7.7.103
+      - ip_address: 10.7.7.104
+  register: port4
+
 - name: Create router 1
   openstack.cloud.router:
     cloud: "{{ cloud }}"
@@ -136,10 +153,31 @@
                                   selectattr('floating_network_id', '==', public_network.networks.0.id)|
                                   list|length > 0 }}"
 
-# TODO: Replace with appropriate Ansible module once available
 - name: Create a floating ip on public network (required for simplest, first floating ip test)
-  command: openstack --os-cloud={{ cloud }} floating ip create public
   when: not public_network_had_fips
+  block:
+    - name: Create a floating ip on public network
+      openstack.cloud.floating_ip:
+        cloud: "{{ cloud }}"
+        state: present
+        network: public
+      register: public_fip_result
+
+    - name: Verify floating ip got created
+      assert:
+        that:
+          - public_fip_result.floating_ip.floating_network_id == public_network.networks.0.id
+
+    - name: Create a floating ip on public network again
+      openstack.cloud.floating_ip:
+        cloud: "{{ cloud }}"
+        state: present
+        network: public
+      register: public_fip_result
+
+    - name: Verify idempotency
+      assert:
+        that: public_fip_result is not changed
 
 # TODO: Replace with appropriate Ansible module once available
 - name: Create floating ip 1 on external network
@@ -151,6 +189,90 @@
   when: fips.floating_ips|length == 0 or
         "10.6.6.150" not in fips.floating_ips|map(attribute="floating_ip_address")|list
 
+- name: Create floating ip 2 on external network
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: present
+    network: ansible_external
+    floating_ip_address: 10.6.6.151
+  register: external_fip2_result
+
+- name: Verify floating ip got created
+  assert:
+    that:
+      - external_fip2_result.floating_ip.floating_network_id == external_network.networks.0.id
+
+- name: Update floating ip 2 on external network
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: present
+    network: ansible_external
+    floating_ip_address: 10.6.6.151
+    nat_destination: ansible_internal
+    fixed_address: 10.7.7.104
+  register: external_fip2_result
+
+- name: Verify floating ip got updated
+  assert:
+    that:
+      - external_fip2_result is changed
+      - external_fip2_result.floating_ip.floating_ip_address == "10.6.6.151"
+      - external_fip2_result.floating_ip.port_id == port4.port.id
+      - external_fip2_result.floating_ip.fixed_ip_address == "10.7.7.104"
+
+- name: Update floating ip 2 on external network again
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: present
+    network: ansible_external
+    floating_ip_address: 10.6.6.151
+    nat_destination: ansible_internal
+    fixed_address: 10.7.7.104
+  register: external_fip2_result
+
+- name: Verify idempotency
+  assert:
+    that:
+      - external_fip2_result is not changed
+
+- name: Detatch floating ip 2 on external network from port
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: absent
+    network: ansible_external
+    floating_ip_address: 10.6.6.151
+
+- name: Get floating ip 2 info
+  openstack.cloud.floating_ip_info:
+    cloud: "{{ cloud }}"
+    floating_ip_address: 10.6.6.151
+  register: external_fip2_result
+
+- name: Verify floating ip got detached
+  assert:
+    that:
+      - external_fip2_result.floating_ips.0.floating_ip_address == "10.6.6.151"
+      - external_fip2_result.floating_ips.0.fixed_ip_address == none
+      - external_fip2_result.floating_ips.0.port_id == none
+
+- name: Detatch floating ip 2 on external network from port again
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: absent
+    network: ansible_external
+    floating_ip_address: 10.6.6.151
+
+- name: Get floating ip 2 info
+  openstack.cloud.floating_ip_info:
+    cloud: "{{ cloud }}"
+    floating_ip_address: 10.6.6.151
+  register: external_fip2_result
+
+- name: Verify idempotency
+  assert:
+    that:
+      - external_fip2_result is not changed
+
 - name: Create server 1 with one nic
   openstack.cloud.server:
     cloud: "{{ cloud }}"
@@ -214,7 +336,7 @@
     cloud: "{{ cloud }}"
     state: present
     server: ansible_server1
-    wait: yes
+    wait: true
 
 - name: Get floating ip attached to server 1
   openstack.cloud.floating_ip_info:
@@ -241,7 +363,7 @@
     that:
       - server1_fips is success
       - server1_fips is not changed
-      - server1_fips.floating_ips
+      - server1_fips.floating_ips|length > 0
       # allow new fields to be introduced but prevent fields from being removed
       - expected_fields|difference(server1_fips.floating_ips[0].keys())|length == 0
 
@@ -260,7 +382,7 @@
 - name: Assert return values of floating_ip module
   assert:
     that:
-      - floating_ip.floating_ip
+      - floating_ip.floating_ip|length > 0
       # allow new fields to be introduced but prevent fields from being removed
       - expected_fields|difference(floating_ip.floating_ip.keys())|length == 0
 
@@ -302,7 +424,7 @@
   openstack.cloud.floating_ip:
     cloud: "{{ cloud }}"
     state: present
-    reuse: no  # else fixed_address will be ignored
+    reuse: false  # else fixed_address will be ignored
     server: ansible_server2
     network: public
     fixed_address: "{{ port2.port.fixed_ips[0].ip_address }}"
@@ -312,7 +434,7 @@
 - name: Assert floating ip attached to server 2
   assert:
     that:
-      - server2_fip.floating_ip
+      - server2_fip.floating_ip|length > 0
 
 - name: Find all floating ips for debugging
   openstack.cloud.floating_ip_info:
@@ -347,12 +469,12 @@
   openstack.cloud.floating_ip:
     cloud: "{{ cloud }}"
     state: present
-    reuse: no  # else fixed_address will be ignored
+    reuse: false  # else fixed_address will be ignored
     server: ansible_server2
     network: ansible_external
     fixed_address: "{{ port3.port.fixed_ips[0].ip_address }}"
     floating_ip_address: "10.6.6.150"
-    wait: no # does not work anyway and causes issues in local testing
+    wait: false # does not work anyway and causes issues in local testing
 
 - name: Get floating ip attached to server 2
   openstack.cloud.floating_ip_info:
@@ -433,18 +555,41 @@
     cloud: "{{ cloud }}"
   register: fips
 
-# TODO: Replace with appropriate Ansible module once available
 - name: Delete floating ip on public network if we created it
   when: not public_network_had_fips
-  command: >
-    openstack --os-cloud={{ cloud }} floating ip delete
-        {{ fips.floating_ips|selectattr('floating_network_id', '==', public_network.networks.0.id)|
-           map(attribute="floating_ip_address")|list|join(' ') }}
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: absent
+    purge: true
+    floating_ip_address: "{{ public_fip }}"
+    network: public
+  loop: >-
+    {{
+      fips.floating_ips |
+      selectattr('floating_network_id', '==', public_network.networks.0.id) |
+      map(attribute="floating_ip_address") |
+      list
+    }}
+  loop_control:
+    loop_var: public_fip
 
-# TODO: Replace with appropriate Ansible module once available
 - name: Delete floating ip 1
-  command: openstack --os-cloud={{ cloud }} floating ip delete 10.6.6.150
   when: fips.floating_ips|length > 0 and "10.6.6.150" in fips.floating_ips|map(attribute="floating_ip_address")|list
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: absent
+    purge: true
+    floating_ip_address: 10.6.6.150
+    network: ansible_external
+
+- name: Delete floating ip 2
+  when: fips.floating_ips|length > 0 and "10.6.6.151" in fips.floating_ips|map(attribute="floating_ip_address")|list
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: absent
+    purge: true
+    floating_ip_address: 10.6.6.151
+    network: ansible_external
 
 - name: Get remaining floating ips on external network
   openstack.cloud.floating_ip_info:
@@ -452,14 +597,24 @@
     floating_network: ansible_external
   register: fips
 
-# TODO: Replace with appropriate Ansible module once available
 # The first, simple floating ip test might have allocated a floating ip on the external network.
 # This floating ip must be removed before external network can be deleted.
 - name: Delete remaining floating ips on external network
   when: fips.floating_ips|length > 0
-  command: >
-    openstack --os-cloud={{ cloud }} floating ip delete
-        {{ fips.floating_ips|map(attribute="floating_ip_address")|list|join(' ') }}
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: absent
+    purge: true
+    floating_ip_address: "{{ external_fip }}"
+    network: ansible_external
+  loop: >-
+    {{
+      fips.floating_ips |
+      map(attribute="floating_ip_address") |
+      list
+    }}
+  loop_control:
+    loop_var: external_fip
 
 # Remove routers after floating ips have been detached and disassociated else removal fails with
 #  Error detaching interface from router ***: Client Error for url: ***,
@@ -478,6 +633,12 @@
     state: absent
     name: ansible_router1
 
+- name: Delete internal port 4
+  openstack.cloud.port:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: ansible_internal_port4
+
 - name: Delete internal port 3
   openstack.cloud.port:
     cloud: "{{ cloud }}"

ci/roles/identity_user/tasks/main.yml

@@ -28,7 +28,7 @@
     domain: default
     default_project: demo
   register: user
-  ignore_errors: yes
+  ignore_errors: true
 
 - name: Assert that update failed
   assert:
@@ -93,7 +93,7 @@
     update_password: always
     email: updated.ansible.user@nowhere.net
   register: user
-  ignore_errors: yes
+  ignore_errors: true
 
 - name: Assert user update failed
   assert:

ci/roles/image/tasks/main.yml

@@ -24,6 +24,13 @@
         path: '{{ tmp_file.path }}'
         size: 1M
 
+    - name: Calculating file checksum
+      ansible.builtin.stat:
+        path: "{{ tmp_file.path }}"
+        checksum_algorithm: sha512
+        get_checksum: true
+      register: image_details
+
     - name: Ensure mock kernel and ramdisk images (defaults)
       openstack.cloud.image:
          cloud: "{{ cloud }}"
@@ -42,6 +49,7 @@
          name: ansible_image
          filename: "{{ tmp_file.path }}"
          is_protected: true
+         checksum: "{{ image_details.stat.checksum }}"
          disk_format: raw
          tags:
            - test
@@ -168,6 +176,34 @@
           - image is changed
           - image.image.name == 'ansible_image-changed'
 
+    - name: Deactivate raw image
+      openstack.cloud.image:
+         cloud: "{{ cloud }}"
+         state: inactive
+         id: "{{ image.image.id }}"
+         name: 'ansible_image-changed'
+      register: image
+
+    - name: Assert changed
+      assert:
+        that:
+          - image is changed
+          - image.image.status == 'deactivated'
+
+    - name: Reactivate raw image
+      openstack.cloud.image:
+         cloud: "{{ cloud }}"
+         state: present
+         id: "{{ image.image.id }}"
+         name: 'ansible_image-changed'
+      register: image
+
+    - name: Assert changed
+      assert:
+        that:
+          - image is changed
+          - image.image.status == 'active'
+
     - name: Rename back raw image (defaults)
       openstack.cloud.image:
          cloud: "{{ cloud }}"
@@ -318,6 +354,15 @@
          name: ansible_project
          domain: default
 
+    - name: Delete mock kernel and ramdisk images
+      openstack.cloud.image:
+         cloud: "{{ cloud }}"
+         state: absent
+         name: "{{ item }}"
+      loop:
+        - cirros-vmlinuz
+        - cirros-initrd
+
     - name: Delete test image file
       file:
          name: "{{ tmp_file.path }}"

ci/roles/inventory/tasks/main.yml

@@ -279,6 +279,11 @@
           ansible.builtin.set_fact:
             cache: "{{ cache.content | b64decode | from_yaml }}"
 
+        - name: Further process Ansible 2.19+ cache
+          ansible.builtin.set_fact:
+            cache: "{{ cache.__payload__ | from_yaml }}"
+          when: cache.__payload__ is defined
+
         - name: Check Ansible's cache
           assert:
             that:
@@ -303,6 +308,25 @@
             that:
               - inventory.all.children.RegionOne.hosts.keys() | sort == ['ansible_server1', 'ansible_server2'] | sort
 
+        - name: List servers with inventory plugin with IPv4 only
+          ansible.builtin.command:
+            cmd: ansible-inventory --list --yaml --extra-vars only_ipv4=true --inventory-file openstack.yaml
+            chdir: "{{ tmp_dir.path }}"
+          environment:
+            ANSIBLE_INVENTORY_CACHE: "True"
+            ANSIBLE_INVENTORY_CACHE_PLUGIN: "jsonfile"
+            ANSIBLE_CACHE_PLUGIN_CONNECTION: "{{ tmp_dir.path }}/.cache/"
+          register: inventory
+
+        - name: Read YAML output from inventory plugin again
+          ansible.builtin.set_fact:
+            inventory: "{{ inventory.stdout | from_yaml }}"
+
+        - name: Check YAML output from inventory plugin again
+          assert:
+            that:
+              - inventory.all.children.RegionOne.hosts.keys() | sort == ['ansible_server1', 'ansible_server2'] | sort
+
     - name: Delete server 2
       openstack.cloud.resource:
         service: compute

ci/roles/keypair/tasks/main.yml

@@ -38,7 +38,7 @@
 - name: Ensure public key is returned
   assert:
     that:
-      - keypair.keypair.public_key is defined and keypair.keypair.public_key
+      - keypair.keypair.public_key is defined and keypair.keypair.public_key|length > 0
 
 - name: Create another keypair
   openstack.cloud.keypair:
@@ -78,7 +78,7 @@
 - name: Generate test key file
   user:
     name: "{{ ansible_env.USER }}"
-    generate_ssh_key: yes
+    generate_ssh_key: true
     ssh_key_file: .ssh/shade_id_rsa
 
 - name: Create keypair (file)

ci/roles/keystone_federation_protocol/tasks/main.yml

@@ -78,7 +78,7 @@
     #   Creation
 
     - name: Create protocol - CHECK MODE
-      check_mode: yes
+      check_mode: true
       openstack.cloud.keystone_federation_protocol:
         state: present
         name: ansible_protocol1
@@ -119,7 +119,7 @@
           - expected_fields|difference(protocol.protocol.keys())|length == 0
 
     - name: Create protocol (retry - no change) - CHECK MODE
-      check_mode: yes
+      check_mode: true
       openstack.cloud.keystone_federation_protocol:
         state: present
         name: ansible_protocol1
@@ -148,7 +148,7 @@
     #   Update
 
     - name: Update protocol - CHECK MODE
-      check_mode: yes
+      check_mode: true
       openstack.cloud.keystone_federation_protocol:
         state: present
         name: ansible_protocol1
@@ -174,7 +174,7 @@
           - protocol.protocol.mapping_id == 'ansible_mapping2'
 
     - name: Update protocol (retry - no change) - CHECK MODE
-      check_mode: yes
+      check_mode: true
       openstack.cloud.keystone_federation_protocol:
         state: present
         name: ansible_protocol1
@@ -258,7 +258,7 @@
     #   Deletion
 
     - name: Delete protocol - CHECK MODE
-      check_mode: yes
+      check_mode: true
       openstack.cloud.keystone_federation_protocol:
         state: absent
         name: ansible_protocol1
@@ -279,7 +279,7 @@
           - protocol is changed
 
     - name: Delete protocol (retry - no change) - CHECK MODE
-      check_mode: yes
+      check_mode: true
       openstack.cloud.keystone_federation_protocol:
         state: absent
         name: ansible_protocol1
@@ -307,35 +307,35 @@
          state: absent
          name: ansible_protocol1
          idp_id: ansible_idp
-      ignore_errors: yes
+      ignore_errors: true
 
     - name: Delete protocol (2)
       openstack.cloud.keystone_federation_protocol:
          state: absent
          name: ansible_protocol2
          idp_id: ansible_idp
-      ignore_errors: yes
+      ignore_errors: true
 
     - name: Delete mapping 1
       openstack.cloud.federation_mapping:
          state: absent
          name: ansible_mapping1
-      ignore_errors: yes
+      ignore_errors: true
 
     - name: Delete mapping 2
       openstack.cloud.federation_mapping:
          state: absent
          name: ansible_mapping2
-      ignore_errors: yes
+      ignore_errors: true
 
     - name: Delete idp
       openstack.cloud.federation_idp:
          state: absent
          name: ansible_idp
-      ignore_errors: yes
+      ignore_errors: true
 
     - name: Delete domain
       openstack.cloud.identity_domain:
          state: absent
          name: ansible_domain
-      ignore_errors: yes
+      ignore_errors: true

ci/roles/keystone_idp/tasks/main.yml

@@ -116,7 +116,7 @@
         _idps: '{{ idps.identity_providers }}'
 
     - name: 'Create identity_provider (retry - no change) - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider'
@@ -150,7 +150,7 @@
     #   Update (simple cases)
 
     - name: 'Update IDP set description - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider'
@@ -181,7 +181,7 @@
         _idp: '{{ idp.identity_provider }}'
 
     - name: 'Update IDP set description (retry - no change) - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider'
@@ -213,7 +213,7 @@
 
 
     - name: 'Update IDP set Remote IDs - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider'
@@ -244,7 +244,7 @@
         _idp: '{{ idp.identity_provider }}'
 
     - name: 'Update IDP set Remote IDs (retry - no change) - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider'
@@ -275,7 +275,7 @@
         _idp: '{{ idp.identity_provider }}'
 
     - name: 'Update IDP set Enabled - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider'
@@ -306,7 +306,7 @@
         _idp: '{{ idp.identity_provider }}'
 
     - name: 'Update IDP set Enabled (retry - no change) - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider'
@@ -338,7 +338,7 @@
 
     # If we don't specify anything to change, then nothing should change...
     - name: 'Minimal call to IDP (no change) - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider'
@@ -371,7 +371,7 @@
     #   Update (mass-update)
 
     - name: 'Update all updatable IDP parameters - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider'
@@ -406,7 +406,7 @@
         _idp: '{{ idp.identity_provider }}'
 
     - name: 'Update all updatable IDP parameters (no change) - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider'
@@ -444,7 +444,7 @@
     #   Create complex IDP
 
     - name: 'Create complex IDP - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider2'
@@ -481,7 +481,7 @@
         _idp: '{{ idp.identity_provider }}'
 
     - name: 'Create complex IDP (retry - no change) - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: present
         name: 'ansible_identity_provider2'
@@ -558,7 +558,7 @@
         - False in (idps.identity_providers | map(attribute='is_enabled'))
 
     - name: 'Delete identity_provider - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: absent
         name: 'ansible_identity_provider'
@@ -579,7 +579,7 @@
         - idp is changed
 
     - name: 'Delete identity_provider (retry - no change) - CHECK_MODE'
-      check_mode: yes
+      check_mode: true
       openstack.cloud.federation_idp:
         state: absent
         name: 'ansible_identity_provider'

ci/roles/network/tasks/main.yml

@@ -11,7 +11,7 @@
 - name: Check output of creating network
   assert:
     that:
-      - infonet.network
+      - infonet.network is defined
       - item in infonet.network
   loop: "{{ expected_fields }}"
 
@@ -23,7 +23,7 @@
 
 - name: Check output of network info
   # TODO: Remove ignore_errors once SDK's search_networks() (re)implemented searching by id
-  ignore_errors: yes
+  ignore_errors: true
   assert:
     that:
     - result.networks|length == 1
@@ -69,6 +69,9 @@
      external: false
      mtu: "{{ mtu }}"
      port_security_enabled: "{{ port_security_enabled }}"
+     tags:
+       - foo
+       - bar
   register: result_create_nw_with_new_params
   ignore_errors: true
 
@@ -85,6 +88,8 @@
       - result_newparams.networks.0.mtu == mtu
       - "'is_port_security_enabled' in result_newparams.networks.0"
       - result_newparams.networks.0['is_port_security_enabled'] == port_security_enabled
+      - "'foo' in result_newparams.networks.0.tags"
+      - "'bar' in result_newparams.networks.0.tags"
 
 - name: Delete network - generic and with new SDK params
   openstack.cloud.network:
@@ -115,6 +120,9 @@
      external: false
      mtu: "{{ mtu }}"
      port_security_enabled: "{{ port_security_enabled }}"
+     tags:
+       - foo
+       - bar
   register: result_create_nw_for_updates
 
 - name: Update network - update failure
@@ -147,6 +155,11 @@
      mtu: "{{ mtu - 50 }}"
      # NOTE: This property should be updated
      port_security_enabled: "{{ not port_security_enabled }}"
+     # NOTE: This property should be updated
+     tags:
+       - foo
+       - bar
+       - baz
   register: result_nw_update_success
 
 - name: Gather networks info - updates
@@ -162,6 +175,29 @@
       - result_network_updates_info.networks.0.name == network_name_updates
       - result_network_updates_info.networks.0.mtu == mtu - 50
       - result_network_updates_info.networks.0['is_port_security_enabled'] == (not port_security_enabled)
+      - "'foo' in result_network_updates_info.networks.0.tags"
+      - "'bar' in result_network_updates_info.networks.0.tags"
+      - "'baz' in result_network_updates_info.networks.0.tags"
+
+- name: Update network - no change
+  openstack.cloud.network:
+     cloud: "{{ cloud }}"
+     name: "{{ network_name_updates }}"
+     state: present
+     shared: "{{ network_shared }}"
+     external: false
+     mtu: "{{ mtu - 50 }}"
+     port_security_enabled: "{{ not port_security_enabled }}"
+     tags:
+       - foo
+       - bar
+       - baz
+  register: result_nw_update_no_change
+
+- name: Verify networks info - no change
+  assert:
+    that:
+      - result_nw_update_no_change is not changed
 
 - name: Delete network - updates
   openstack.cloud.network:

ci/roles/network_segment/defaults/main.yml

@@ -0,0 +1,17 @@
+---
+expected_fields:
+  - description
+  - id
+  - name
+  - network_id
+  - network_type
+  - physical_network
+  - segmentation_id
+
+network_name: segment_network
+segment_name: example_segment
+network_type: vlan
+segmentation_id: 999
+physical_network: public
+initial_description: "example segment description"
+updated_description: "updated segment description"

ci/roles/network_segment/tasks/main.yml

@@ -0,0 +1,72 @@
+---
+- name: Create network {{ network_name }}
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    name: "{{ network_name }}"
+    state: present
+
+- name: Create segment {{ segment_name }}
+  openstack.cloud.network_segment:
+    cloud: "{{ cloud }}"
+    name: "{{ segment_name }}"
+    description: "{{ initial_description }}"
+    network: "{{ network_name }}"
+    network_type: "{{ network_type }}"
+    segmentation_id: "{{ segmentation_id }}"
+    physical_network: "{{ physical_network }}"
+    state: present
+  register: segment
+
+- name: Assert changed
+  assert:
+    that: segment is changed
+
+- name: Assert segment fields
+  assert:
+    that: item in segment.network_segment
+  loop: "{{ expected_fields }}"
+
+- name: Update segment {{ segment_name }} by name - no changes
+  openstack.cloud.network_segment:
+    cloud: "{{ cloud }}"
+    name: "{{ segment_name }}"
+    description: "{{ initial_description }}"
+    state: present
+  register: segment
+
+- name: Assert not changed
+  assert:
+    that: segment is not changed
+
+- name: Update segment {{ segment_name }} by all fields - changes
+  openstack.cloud.network_segment:
+    cloud: "{{ cloud }}"
+    name: "{{ segment_name }}"
+    description: "{{ updated_description }}"
+    network: "{{ network_name }}"
+    network_type: "{{ network_type }}"
+    segmentation_id: "{{ segmentation_id }}"
+    physical_network: "{{ physical_network }}"
+    state: present
+  register: segment
+
+- name: Assert changed
+  assert:
+    that: segment is changed
+
+- name: Delete segment {{ segment_name }}
+  openstack.cloud.network_segment:
+    cloud: "{{ cloud }}"
+    name: "{{ segment_name }}"
+    state: absent
+  register: segment
+
+- name: Assert changed
+  assert:
+    that: segment is changed
+
+- name: Delete network {{ network_name }}
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    name: "{{ network_name }}"
+    state: absent

ci/roles/neutron_rbac_policy/defaults/main.yml

@@ -7,3 +7,4 @@ expected_fields:
   - project_id
   - target_project_id
   - tenant_id
+all_project_symbol: '*'

ci/roles/neutron_rbac_policy/tasks/main.yml

@@ -69,6 +69,29 @@
     id: "{{ rbac_policy.rbac_policy.id }}"
     state: absent
 
+- name: Create a new network RBAC policy by targeting all projects
+  openstack.cloud.neutron_rbac_policy:
+    cloud: "{{ cloud }}"
+    object_id: "{{ network.network.id }}"
+    object_type: 'network'
+    action: 'access_as_shared'
+    target_all_project: true
+    project_id: "{{ source_project.project.id }}"
+  register: rbac_policy
+
+- name: Assert return values of neutron_rbac_policy module
+  assert:
+    that:
+      # allow new fields to be introduced but prevent fields from being removed
+      - expected_fields|difference(rbac_policy.rbac_policy.keys())|length == 0
+      - rbac_policy.rbac_policy.target_project_id == all_project_symbol
+
+- name: Delete RBAC policy
+  openstack.cloud.neutron_rbac_policy:
+    cloud: "{{ cloud }}"
+    id: "{{ rbac_policy.rbac_policy.id }}"
+    state: absent
+
 - name: Get all rbac policies for {{ source_project.project.name }} - after deletion
   openstack.cloud.neutron_rbac_policies_info:
     cloud: "{{ cloud }}"

ci/roles/object/tasks/main.yml

@@ -5,7 +5,7 @@
     state: present
     name: ansible_container
 
-- name: Create object
+- name: Create object from data
   openstack.cloud.object:
     cloud: "{{ cloud }}"
     state: present
@@ -28,6 +28,47 @@
     name: ansible_object
     container: ansible_container
 
+- name: Create object from file
+  block:
+    - name: Create temporary data file
+      ansible.builtin.tempfile:
+      register: tmp_file
+
+    - name: Populate data file
+      ansible.builtin.copy:
+        content: "this is a test"
+        dest: "{{ tmp_file.path }}"
+
+    - name: Create object from data file
+      openstack.cloud.object:
+        cloud: "{{ cloud }}"
+        state: present
+        name: ansible_object
+        filename: "{{ tmp_file.path }}"
+        container: ansible_container
+      register: object
+
+  always:
+    - name: Remove temporary data file
+      ansible.builtin.file:
+        path: "{{ tmp_file.path }}"
+        state: absent
+      when: tmp_file is defined and 'path' in tmp_file
+
+- name: Assert return values of object module
+  assert:
+    that:
+      - object.object.id == "ansible_object"
+      # allow new fields to be introduced but prevent fields from being removed
+      - expected_fields|difference(object.object.keys())|length == 0
+
+- name: Delete object
+  openstack.cloud.object:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: ansible_object
+    container: ansible_container
+
 - name: Delete container
   openstack.cloud.object_container:
     cloud: "{{ cloud }}"

ci/roles/object_container/tasks/main.yml

@@ -31,6 +31,21 @@
       - ('cache-control' in container.container.metadata.keys()|map('lower'))
       - container.container.metadata['foo'] == 'bar'
 
+- name: Update container metadata
+  openstack.cloud.object_container:
+    cloud: "{{ cloud }}"
+    name: ansible_container
+    metadata:
+      'foo': 'baz'
+  register: container
+
+- name: Verify container metadata was updated
+  assert:
+    that:
+      - container is changed
+      - ('cache-control' in container.container.metadata.keys()|map('lower'))
+      - container.container.metadata['foo'] == 'baz'
+
 - name: Update a container
   openstack.cloud.object_container:
     cloud: "{{ cloud }}"
@@ -45,7 +60,7 @@
     that:
       - container is changed
       - ('cache-control' not in container.container.metadata.keys()|map('lower'))
-      - "container.container.metadata == {'foo': 'bar'}"
+      - "container.container.metadata == {'foo': 'baz'}"
       - container.container.read_ACL is none or container.container.read_ACL == ""
 
 - name: Delete container
@@ -90,4 +105,4 @@
     cloud: "{{ cloud }}"
     state: absent
     name: ansible_container2
-    delete_with_all_objects: yes
+    delete_with_all_objects: true

ci/roles/object_containers_info/defaults/main.yml

@@ -0,0 +1,37 @@
+---
+
+test_container_unprefixed_name: ansible-test-container
+test_container_prefixed_prefix: ansible-prefixed-test-container
+test_container_prefixed_num: 2
+
+test_object_data: "Hello, world!"
+
+expected_fields_single:
+  - bytes
+  - bytes_used
+  - content_type
+  - count
+  - history_location
+  - id
+  - if_none_match
+  - is_content_type_detected
+  - is_newest
+  - meta_temp_url_key
+  - meta_temp_url_key_2
+  - name
+  - object_count
+  - read_ACL
+  - storage_policy
+  - sync_key
+  - sync_to
+  - timestamp
+  - versions_location
+  - write_ACL
+
+expected_fields_multiple:
+  - bytes
+  - bytes_used
+  - count
+  - id
+  - name
+  - object_count

ci/roles/object_containers_info/tasks/main.yml

@@ -0,0 +1,124 @@
+---
+
+- name: Generate list of containers to create
+  ansible.builtin.set_fact:
+    all_test_containers: >-
+      {{
+        [test_container_unprefixed_name]
+        + (
+            [test_container_prefixed_prefix + '-']
+            | product(range(test_container_prefixed_num) | map('string'))
+            | map('join', '')
+          )
+      }}
+
+- name: Run checks
+  block:
+
+    - name: Create all containers
+      openstack.cloud.object_container:
+        cloud: "{{ cloud }}"
+        name: "{{ item }}"
+        read_ACL: ".r:*,.rlistings"
+      loop: "{{ all_test_containers }}"
+
+    - name: Create an object in all containers
+      openstack.cloud.object:
+        cloud: "{{ cloud }}"
+        container: "{{ item }}"
+        name: hello.txt
+        data: "{{ test_object_data }}"
+      loop: "{{ all_test_containers }}"
+
+    - name: Fetch single containers by name
+      openstack.cloud.object_containers_info:
+        cloud: "{{ cloud }}"
+        name: "{{ item }}"
+      register: single_containers
+      loop: "{{ all_test_containers }}"
+
+    - name: Check that all fields are returned for single containers
+      ansible.builtin.assert:
+        that:
+          - (item.containers | length) == 1
+          - item.containers[0].name == item.item
+          - item.containers[0].bytes == (test_object_data | length)
+          - item.containers[0].read_ACL == ".r:*,.rlistings"
+          # allow new fields to be introduced but prevent fields from being removed
+          - (expected_fields_single | difference(item.containers[0].keys()) | length) == 0
+        quiet: true
+      loop: "{{ single_containers.results }}"
+      loop_control:
+        label: "{{ item.item }}"
+
+    - name: Fetch multiple containers by prefix
+      openstack.cloud.object_containers_info:
+        cloud: "{{ cloud }}"
+        prefix: "{{ test_container_prefixed_prefix }}"
+      register: multiple_containers
+
+    - name: Check that the correct number of prefixed containers were returned
+      ansible.builtin.assert:
+        that:
+          - (multiple_containers.containers | length) == test_container_prefixed_num
+        fail_msg: >-
+          Incorrect number of containers found
+          (found {{ multiple_containers.containers | length }},
+          expected {{ test_container_prefixed_num }})
+        quiet: true
+
+    - name: Check that all prefixed containers exist
+      ansible.builtin.assert:
+        that:
+          - >-
+            (test_container_prefixed_prefix + '-' + (item | string))
+            in (multiple_containers.containers | map(attribute='name'))
+        fail_msg: "Container not found: {{ test_container_prefixed_prefix + '-' + (item | string) }}"
+        quiet: true
+      loop: "{{ range(test_container_prefixed_num) | list }}"
+      loop_control:
+        label: "{{ test_container_prefixed_prefix + '-' + (item | string) }}"
+
+    - name: Check that the expected fields are returned for all prefixed containers
+      ansible.builtin.assert:
+        that:
+          - item.name.startswith(test_container_prefixed_prefix)
+          # allow new fields to be introduced but prevent fields from being removed
+          - (expected_fields_multiple | difference(item.keys()) | length) == 0
+        quiet: true
+      loop: "{{ multiple_containers.containers | sort(attribute='name') }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+    - name: Fetch all containers
+      openstack.cloud.object_containers_info:
+        cloud: "{{ cloud }}"
+      register: all_containers
+
+    - name: Check that all expected containers were returned
+      ansible.builtin.assert:
+        that:
+          - item in (all_containers.containers | map(attribute='name'))
+        fail_msg: "Container not found: {{ item }}"
+        quiet: true
+      loop: "{{ all_test_containers }}"
+
+    - name: Check that the expected fields are returned for all containers
+      ansible.builtin.assert:
+        that:
+          # allow new fields to be introduced but prevent fields from being removed
+          - (expected_fields_multiple | difference(item.keys()) | length) == 0
+        quiet: true
+      loop: "{{ all_containers.containers | selectattr('name', 'in', all_test_containers) }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+  always:
+
+    - name: Delete all containers
+      openstack.cloud.object_container:
+        cloud: "{{ cloud }}"
+        name: "{{ item }}"
+        state: absent
+        delete_with_all_objects: true
+      loop: "{{ all_test_containers }}"

ci/roles/port/defaults/main.yml

@@ -1,6 +1,3 @@
-binding_profile:
-  "pci_slot": "0000:03:11.1"
-  "physical_network": "provider"
 expected_fields:
   - allowed_address_pairs
   - binding_host_id

ci/roles/port/tasks/main.yml

@@ -169,7 +169,7 @@
       - ip_address: 10.5.5.69
     name: "{{ port_name }}"
     network: "{{ network_name }}"
-    no_security_groups: yes
+    no_security_groups: true
     state: present
   register: port
 
@@ -192,7 +192,7 @@
         subnet_id: "{{ subnet.subnet.id }}"
     name: "{{ port_name }}"
     network: "{{ network_name }}"
-    no_security_groups: yes
+    no_security_groups: true
     state: present
   register: port_again
 
@@ -256,27 +256,6 @@
     state: absent
     name: ansible_security_group
 
-- name: Create port (with binding profile)
-  openstack.cloud.port:
-    cloud: "{{ cloud }}"
-    state: present
-    name: "{{ port_name }}"
-    network: "{{ network_name }}"
-    binding_profile: "{{ binding_profile }}"
-  register: port
-
-- name: Assert binding_profile exists in created port
-  assert:
-    that: "port.port['binding_profile']"
-
-- debug: var=port
-
-- name: Delete port (with binding profile)
-  openstack.cloud.port:
-    cloud: "{{ cloud }}"
-    state: absent
-    name: "{{ port_name }}"
-
 - name: Delete subnet
   openstack.cloud.subnet:
     cloud: "{{ cloud }}"

ci/roles/port_forwarding/defaults/main.yml

@@ -0,0 +1,10 @@
+expected_fields:
+  - description
+  - external_port
+  - floatingip_id
+  - id
+  - internal_ip_address
+  - internal_port
+  - internal_port_id
+  - name
+  - protocol

ci/roles/port_forwarding/tasks/main.yml

@@ -0,0 +1,272 @@
+---
+- name: Create test network
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    state: present
+    name: test_internal_network
+
+- name: Create test subnet
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    state: present
+    name: test_internal_subnet
+    network_name: test_internal_network
+    cidr: 192.168.100.0/24
+    gateway_ip: 192.168.100.1
+
+- name: Create test port
+  openstack.cloud.port:
+    cloud: "{{ cloud }}"
+    state: present
+    name: test_internal_port
+    network: test_internal_network
+    fixed_ips:
+      - ip_address: 192.168.100.10
+  register: test_internal_port
+
+- name: Create test external network
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    state: present
+    name: test_external_network
+    external: true
+
+- name: Create test external subnet
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    state: present
+    network_name: test_external_network
+    name: test_external_subnet
+    cidr: 10.6.6.0/24
+
+- name: Create router
+  openstack.cloud.router:
+    cloud: "{{ cloud }}"
+    state: present
+    name: test_router
+    network: test_external_network
+    external_fixed_ips:
+      - subnet: test_external_subnet
+    interfaces:
+      - test_internal_subnet
+
+- name: Create test floating IP
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: present
+    network: test_external_network
+  register: test_floating_ip
+
+- name: Test - Create port forwarding rule
+  openstack.cloud.port_forwarding:
+    cloud: "{{ cloud }}"
+    state: present
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+    network_port: test_internal_port
+    internal_ip: 192.168.100.10
+    external_protocol_port: 8080
+    internal_protocol_port: 80
+    protocol: tcp
+  register: pf_create
+
+- name: Get port forwarding info
+  openstack.cloud.port_forwarding_info:
+    cloud: "{{ cloud }}"
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+    port_forwarding_id: "{{ pf_create.port_forwarding.id }}"
+  register: pf_create_info
+
+- name: Verify - Port forwarding created successfully
+  assert:
+    that:
+      - pf_create is changed
+      - pf_create.port_forwarding is defined
+      - pf_create.port_forwarding.external_port == 8080
+      - pf_create.port_forwarding.internal_port == 80
+      - pf_create.port_forwarding.protocol == "tcp"
+      - pf_create_info.port_forwardings | length == 1
+      - pf_create_info.port_forwardings.0.id == pf_create.port_forwarding.id
+
+- name: Test - Create port forwarding rule again (idempotency)
+  openstack.cloud.port_forwarding:
+    cloud: "{{ cloud }}"
+    state: present
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+    network_port: test_internal_port
+    internal_ip: 192.168.100.10
+    external_protocol_port: 8080
+    internal_protocol_port: 80
+    protocol: tcp
+  register: pf_idempotent
+
+- name: Verify - No changes
+  assert:
+    that:
+      - pf_idempotent is not changed
+
+- name: Test - Update port forwarding internal port
+  openstack.cloud.port_forwarding:
+    cloud: "{{ cloud }}"
+    state: present
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+    network_port: test_internal_port
+    internal_ip: 192.168.100.10
+    external_protocol_port: 8080
+    internal_protocol_port: 8080  # Changed from 80 to 8080
+    protocol: tcp
+  register: pf_update
+
+- name: Get port forwarding info
+  openstack.cloud.port_forwarding_info:
+    cloud: "{{ cloud }}"
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+    port_forwarding_id: "{{ pf_update.port_forwarding.id }}"
+  register: pf_update_info
+
+- name: Verify - Port forwarding updated successfully
+  assert:
+    that:
+      - pf_update is changed
+      - pf_update.port_forwarding.internal_port == 8080
+      - pf_update_info.port_forwardings | length == 1
+      - pf_update_info.port_forwardings.0.id == pf_update.port_forwarding.id
+
+- name: Test - Update with same values (idempotency)
+  openstack.cloud.port_forwarding:
+    cloud: "{{ cloud }}"
+    state: present
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+    network_port: test_internal_port
+    internal_ip: 192.168.100.10
+    external_protocol_port: 8080
+    internal_protocol_port: 8080
+    protocol: tcp
+  register: pf_update_idempotent
+
+- name: Verify - No changes
+  assert:
+    that:
+      - pf_update_idempotent is not changed
+
+- name: Test - Change just one attribute
+  openstack.cloud.port_forwarding:
+    cloud: "{{ cloud }}"
+    state: present
+    port_forwarding_id: "{{ pf_create.port_forwarding.id }}"
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+    internal_protocol_port: 9090  # Different internal port
+  register: pf_update_by_id
+
+- name: Verify - Port forwarding updated by ID
+  assert:
+    that:
+      - pf_update_by_id.changed == true
+      - pf_update_by_id.port_forwarding.id == pf_create.port_forwarding.id
+      - pf_update_by_id.port_forwarding.internal_port_id == test_internal_port.port.id
+      - pf_update_by_id.port_forwarding.internal_ip_address == "192.168.100.10"
+      - pf_update_by_id.port_forwarding.external_port == 8080
+      - pf_update_by_id.port_forwarding.internal_port == 9090
+
+- name: Test - Create port forwarding without specifying internal IP
+  openstack.cloud.port_forwarding:
+    cloud: "{{ cloud }}"
+    state: present
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+    network_port: test_internal_port
+    external_protocol_port: 2222
+    internal_protocol_port: 22
+    protocol: tcp
+  register: pf_auto_internal_ip
+
+- name: Verify - Port forwarding created with auto internal IP
+  assert:
+    that:
+      - pf_auto_internal_ip.changed == true
+      - pf_auto_internal_ip.port_forwarding.internal_ip_address == "192.168.100.10"
+
+- name: Test - Delete port forwarding
+  openstack.cloud.port_forwarding:
+    cloud: "{{ cloud }}"
+    state: absent
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+    network_port: test_internal_port
+    external_protocol_port: 8080
+    internal_protocol_port: 9090
+    protocol: tcp
+  register: pf_delete
+
+- name: Verify - Port forwarding deleted successfully
+  assert:
+    that:
+      - pf_delete.changed == true
+
+- name: Test - Delete port forwarding by ID
+  openstack.cloud.port_forwarding:
+    cloud: "{{ cloud }}"
+    state: absent
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+    port_forwarding_id: "{{ pf_auto_internal_ip.port_forwarding.id }}"
+  register: pf_delete_by_id
+
+- name: Verify - Port forwarding deleted by ID
+  assert:
+    that:
+      - pf_delete_by_id.changed == true
+
+- name: Test - Delete already deleted port forwarding (idempotency)
+  openstack.cloud.port_forwarding:
+    cloud: "{{ cloud }}"
+    state: absent
+    port_forwarding_id: "{{ pf_auto_internal_ip.port_forwarding.id }}"
+    floating_ip: "{{ test_floating_ip.floating_ip.id }}"
+  register: pf_delete_idempotent
+
+- name: Verify - No errors on deleting non-existent rule (idempotency)
+  assert:
+    that:
+      - pf_delete_idempotent is not changed
+      - pf_delete_idempotent is not failed
+
+- name: Clean up - Delete test floating IP
+  openstack.cloud.floating_ip:
+    cloud: "{{ cloud }}"
+    state: absent
+    floating_ip_address: "{{ test_floating_ip.floating_ip.floating_ip_address }}"
+    network: test_external_network
+    purge: true
+
+- name: Clean up - Delete router
+  openstack.cloud.router:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: test_router
+
+- name: Clean up - Delete test external subnet
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: test_external_subnet
+
+- name: Clean up - Delete test external network
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: test_external_network
+
+- name: Clean up - Delete test port
+  openstack.cloud.port:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: test_internal_port
+
+- name: Clean up - Delete test subnet
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: test_internal_subnet
+
+- name: Clean up - Delete test network
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: test_internal_network

ci/roles/project/tasks/main.yml

@@ -174,6 +174,38 @@
     that:
       - project.project.is_enabled == True
 
+- name: Update project to add new extra_specs
+  openstack.cloud.project:
+    cloud: "{{ cloud }}"
+    state: present
+    name: ansible_project
+    extra_specs:
+      is_enabled: True
+      another_tag: True
+  register: project
+
+- name: Assert return values of project module
+  assert:
+    that:
+      - project.project.is_enabled == True
+      - project.project.another_tag == True
+
+- name: Update project to change existing extra_specs
+  openstack.cloud.project:
+    cloud: "{{ cloud }}"
+    state: present
+    name: ansible_project
+    extra_specs:
+      is_enabled: True
+      another_tag: False
+  register: project
+
+- name: Assert return values of project module
+  assert:
+    that:
+      - project.project.is_enabled == True
+      - project.project.another_tag == False
+
 - name: Delete project
   openstack.cloud.project:
      cloud: "{{ cloud }}"

ci/roles/quota/defaults/main.yml

@@ -28,3 +28,9 @@ test_compute_quota:
   ram: 5
   server_group_members: 5
   server_groups: 5
+test_load_balancer_quota:
+  load_balancers: 5
+  health_monitors: 5
+  listeners: 5
+  pools: 5
+  members: 5

ci/roles/quota/tasks/loadbalancer.yml

@@ -0,0 +1,158 @@
+---
+- module_defaults:
+    group/openstack.cloud.openstack:
+      cloud: "{{ cloud }}"
+      name: "{{ test_project }}"
+    # Backward compatibility with Ansible 2.9
+    openstack.cloud.project:
+      cloud: "{{ cloud }}"
+      name: "{{ test_project }}"
+    openstack.cloud.quota:
+      cloud: "{{ cloud }}"
+      name: "{{ test_project }}"
+  block:
+    - name: Create test project
+      openstack.cloud.project:
+        state: present
+
+    - name: Clear quotas before tests
+      openstack.cloud.quota:
+        state: absent
+      register: default_quotas
+
+    - name: Set network quota
+      openstack.cloud.quota: "{{ test_network_quota }}"
+      register: quotas
+
+    - name: Assert changed
+      assert:
+        that: quotas is changed
+
+    - name: Assert field values
+      assert:
+        that: quotas.quotas.network[item.key] == item.value
+      loop: "{{ test_network_quota | dict2items }}"
+
+    - name: Set network quota again
+      openstack.cloud.quota: "{{ test_network_quota }}"
+      register: quotas
+
+    - name: Assert not changed
+      assert:
+        that: quotas is not changed
+
+    - name: Set volume quotas
+      openstack.cloud.quota: "{{ test_volume_quota }}"
+      register: quotas
+
+    - name: Assert changed
+      assert:
+        that: quotas is changed
+
+    - name: Assert field values
+      assert:
+        that: quotas.quotas.volume[item.key] == item.value
+      loop: "{{ test_volume_quota | dict2items }}"
+
+    - name: Set volume quotas again
+      openstack.cloud.quota: "{{ test_volume_quota }}"
+      register: quotas
+
+    - name: Assert not changed
+      assert:
+        that: quotas is not changed
+
+    - name: Set compute quotas
+      openstack.cloud.quota: "{{ test_compute_quota }}"
+      register: quotas
+
+    - name: Assert changed
+      assert:
+        that: quotas is changed
+
+    - name: Assert field values
+      assert:
+        that: quotas.quotas.compute[item.key] == item.value
+      loop: "{{ test_compute_quota | dict2items }}"
+
+    - name: Set compute quotas again
+      openstack.cloud.quota: "{{ test_compute_quota }}"
+      register: quotas
+
+    - name: Set load_balancer quotas
+      openstack.cloud.quota: "{{ test_load_balancer_quota }}"
+      register: quotas
+
+    - name: Assert changed
+      assert:
+        that: quotas is changed
+
+    - name: Assert field values
+      assert:
+        that: quotas.quotas.load_balancer[item.key] == item.value
+      loop: "{{ test_load_balancer_quota | dict2items }}"
+
+    - name: Set load_balancer quotas again
+      openstack.cloud.quota: "{{ test_load_balancer_quota }}"
+      register: quotas
+
+    - name: Assert not changed
+      assert:
+        that: quotas is not changed
+
+    - name: Unset all quotas
+      openstack.cloud.quota:
+        state: absent
+      register: quotas
+
+    - name: Assert defaults restore
+      assert:
+        that: quotas.quotas == default_quotas.quotas
+
+    - name: Set all quotas at once
+      openstack.cloud.quota:
+        "{{ [test_network_quota, test_volume_quota, test_compute_quota, test_load_balancer_quota] | combine }}"
+      register: quotas
+
+    - name: Assert changed
+      assert:
+        that: quotas is changed
+
+    - name: Assert volume values
+      assert:
+        that: quotas.quotas.volume[item.key] == item.value
+      loop: "{{ test_volume_quota | dict2items }}"
+
+    - name: Assert network values
+      assert:
+        that: quotas.quotas.network[item.key] == item.value
+      loop: "{{ test_network_quota | dict2items }}"
+
+    - name: Assert compute values
+      assert:
+        that: quotas.quotas.compute[item.key] == item.value
+      loop: "{{ test_compute_quota | dict2items }}"
+
+    - name: Assert load_balancer values
+      assert:
+        that: quotas.quotas.load_balancer[item.key] == item.value
+      loop: "{{ test_load_balancer_quota | dict2items }}"
+
+    - name: Set all quotas at once again
+      openstack.cloud.quota:
+        "{{ [test_network_quota, test_volume_quota, test_compute_quota, test_load_balancer_quota] | combine }}"
+      register: quotas
+
+    - name: Assert not changed
+      assert:
+        that: quotas is not changed
+
+    - name: Unset all quotas
+      openstack.cloud.quota:
+        state: absent
+      register: quotas
+
+    - name: Delete test project
+      openstack.cloud.project:
+         state: absent
+

ci/roles/quota/tasks/main.yml

@@ -128,4 +128,9 @@
 
     - name: Delete test project
       openstack.cloud.project:
-         state: absent
+        state: absent
+
+- import_tasks: loadbalancer.yml
+  tags:
+    - loadbalancer
+

ci/roles/recordset/defaults/main.yml

@@ -1,7 +1,7 @@
 dns_zone_name: test.dns.zone.
 recordset_name: testrecordset.test.dns.zone.
-records: ['10.0.0.0']
-updated_records: ['10.1.1.1']
+records: ['10.0.0.0', '10.0.0.2']
+updated_records: ['10.1.1.1', '10.0.0.2']
 
 recordset_fields:
   - action

ci/roles/recordset/tasks/main.yml

@@ -14,6 +14,15 @@
     email: test@example.net
   register: dns_zone
 
+- name: Ensure recordset not present
+  openstack.cloud.recordset:
+    cloud: "{{ cloud }}"
+    zone: "{{ dns_zone.zone.name }}"
+    name: "{{ recordset_name }}"
+    recordset_type: "a"
+    records: "{{ records }}"
+    state: absent
+
 - name: Create a recordset
   openstack.cloud.recordset:
     cloud: "{{ cloud }}"
@@ -22,14 +31,16 @@
     recordset_type: "a"
     records: "{{ records }}"
   register: recordset
+  until: '"PENDING" not in recordset["recordset"].status'
+  retries: 10
+  delay: 5
 
 - name: Verify recordset info
   assert:
     that:
-      - recordset is changed
       - recordset["recordset"].name == recordset_name
       - recordset["recordset"].zone_name ==  dns_zone.zone.name
-      - recordset["recordset"].records == records
+      - recordset["recordset"].records | list | sort == records | list | sort
 
 - name: Assert recordset fields
   assert:
@@ -71,7 +82,7 @@
       - recordset is changed
       - recordset["recordset"].zone_name == dns_zone.zone.name
       - recordset["recordset"].name == recordset_name
-      - recordset["recordset"].records == updated_records
+      - recordset["recordset"].records | list | sort == updated_records | list | sort
 
 - name: Assert recordset fields
   assert:

ci/roles/role_assignment/tasks/main.yml

@@ -45,12 +45,6 @@
     state: absent
     user: admin
 
-- name: Delete project
-  openstack.cloud.project:
-     cloud: "{{ cloud }}"
-     state: absent
-     name: ansible_project
-
 - name: Create domain
   openstack.cloud.identity_domain:
      cloud: "{{ cloud }}"
@@ -78,6 +72,7 @@
      state: present
      name: ansible_user
      domain: default
+  register: specific_user
 
 - name: Create user in specific domain
   openstack.cloud.identity_user:
@@ -138,6 +133,45 @@
     that:
       - role_assignment is changed
 
+- name: Assign role to user in specific domain on default domain project
+  openstack.cloud.role_assignment:
+    cloud: "{{ cloud }}"
+    role: anotherrole
+    user: "{{ specific_user.user.id }}"
+    domain: default
+    project: ansible_project
+  register: role_assignment
+
+- name: Assert role assignment
+  assert:
+    that:
+      - role_assignment is changed
+
+- name: Revoke role to user in specific domain
+  openstack.cloud.role_assignment:
+    cloud: "{{ cloud }}"
+    role: anotherrole
+    user: "{{ specific_user.user.id }}"
+    domain: default
+    project: ansible_project
+    state: absent
+  register: role_assignment
+
+- name: Assert role assignment revoked
+  assert:
+    that:
+      - role_assignment is changed
+
+- name: Assign role to user in specific domain on default domain project
+  openstack.cloud.role_assignment:
+    cloud: "{{ cloud }}"
+    role: anotherrole
+    user: ansible_user
+    user_domain: "{{ specific_user.user.domain_id }}"
+    project: ansible_project
+    project_domain: default
+  register: role_assignment
+
 - name: Delete group in default domain
   openstack.cloud.identity_group:
      cloud: "{{ cloud }}"
@@ -171,3 +205,10 @@
      cloud: "{{ cloud }}"
      state: absent
      name: ansible_domain
+
+- name: Delete project
+  openstack.cloud.project:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_project
+

ci/roles/router/tasks/main.yml

@@ -325,6 +325,43 @@
       - ports.ports|rejectattr('device_owner', 'equalto', 'network:router_gateway')|sum(attribute='fixed_ips', start=[])|map(attribute='ip_address')|sort|list ==
         ['10.7.7.1']
 
+- name: Update router (add tags)
+  openstack.cloud.router:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ router_name }}"
+    tags:
+      - foo
+      - bar
+
+- name: Gather routers info
+  openstack.cloud.routers_info:
+     cloud: "{{ cloud }}"
+     name: "{{ router_name }}"
+  register: info
+
+- name: Verify tags
+  assert:
+    that:
+      - info.routers.0.name == router_name
+      - info.routers.0.id == router.router.id
+      - "'foo' in info.routers.0.tags"
+      - "'bar' in info.routers.0.tags"
+
+- name: Update router (add tags) again
+  openstack.cloud.router:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ router_name }}"
+    tags:
+      - foo
+      - bar
+  register: router
+
+- name: Assert idempotent module
+  assert:
+    that: router is not changed
+
 # Admin operation
 - name: Create external network
   openstack.cloud.network:
@@ -384,7 +421,7 @@
          - shade_subnet1
      network: "{{ external_network_name }}"
      external_fixed_ips:
-        - subnet: shade_subnet5
+        - subnet_id: shade_subnet5
           ip: 10.6.6.100
 
 - name: Gather routers info
@@ -412,7 +449,7 @@
      external_gateway_info:
         network: "{{ external_network_name }}"
         external_fixed_ips:
-           - subnet: shade_subnet5
+           - subnet_id: shade_subnet5
              ip: 10.6.6.100
            - subnet: shade_subnet5
              ip: 10.6.6.101
@@ -426,7 +463,7 @@
          - shade_subnet1
      network: "{{ external_network_name }}"
      external_fixed_ips:
-        - subnet: shade_subnet5
+        - subnet_id: shade_subnet5
           ip: 10.6.6.100
         - subnet: shade_subnet5
           ip: 10.6.6.101
@@ -461,7 +498,7 @@
          - shade_subnet1
      network: "{{ external_network_name }}"
      external_fixed_ips:
-        - subnet: shade_subnet5
+        - subnet_id: shade_subnet5
           ip: 10.6.6.101
 
 - name: Update router (remove external fixed ips) again
@@ -473,7 +510,7 @@
          - shade_subnet1
      network: "{{ external_network_name }}"
      external_fixed_ips:
-        - subnet: shade_subnet5
+        - subnet_id: shade_subnet5
           ip: 10.6.6.101
   register: router
 
@@ -506,7 +543,7 @@
          - shade_subnet1
      network: "{{ external_network_name }}"
      external_fixed_ips:
-        - subnet: shade_subnet5
+        - subnet_id: shade_subnet5
           ip: 10.6.6.101
 
 - name: Gather routers info
@@ -533,7 +570,7 @@
          - shade_subnet1
      network: "{{ external_network_name }}"
      external_fixed_ips:
-        - subnet: shade_subnet5
+        - subnet_id: shade_subnet5
           ip: 10.6.6.101
   register: router
 
@@ -558,6 +595,46 @@
   assert:
     that: router is not changed
 
+- name: Create router without explicit IP address
+  openstack.cloud.router:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ router_name }}"
+     enable_snat: false
+     interfaces:
+         - shade_subnet1
+     network: "{{ external_network_name }}"
+     external_fixed_ips:
+        - subnet_id: shade_subnet5
+  register: router
+
+- name: Assert idempotent module
+  assert:
+    that: router is changed
+
+- name: Update router without explicit IP address
+  openstack.cloud.router:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ router_name }}"
+     enable_snat: false
+     interfaces:
+         - shade_subnet1
+     network: "{{ external_network_name }}"
+     external_fixed_ips:
+        - subnet_id: shade_subnet5
+  register: router
+
+- name: Assert idempotent module
+  assert:
+    that: router is not changed
+
+- name: Delete router
+  openstack.cloud.router:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ router_name }}"
+
 - name: Create router with simple interface
   openstack.cloud.router:
      cloud: "{{ cloud }}"
@@ -720,3 +797,5 @@
      name: "{{ external_network_name }}"
 
 - include_tasks: shared_network.yml
+
+- include_tasks: shared_ext_network.yml

ci/roles/router/tasks/shared_ext_network.yml

@@ -0,0 +1,99 @@
+---
+# Test the case where we have a shared external network in one project used as
+# the gateway on a router in a second project.
+# See https://bugs.launchpad.net/ansible-collections-openstack/+bug/2049658
+
+- name: Create the first project
+  openstack.cloud.project:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "shared_ext_net_test_1"
+    description: "Project that contains the external network to be shared"
+    domain: default
+    is_enabled: True
+  register: project_1
+
+- name: Create the external network to be shared
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ external_network_name }}"
+    project: "shared_ext_net_test_1"
+    external: true
+    shared: true
+  register: shared_ext_network
+
+- name: Create subnet on external network
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    state: present
+    network_name: "{{ shared_ext_network.id }}"
+    name: "shared_ext_subnet"
+    project: "shared_ext_net_test_1"
+    cidr: "10.6.6.0/24"
+  register: shared_subnet
+
+- name: Create the second project
+  openstack.cloud.project:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "shared_ext_net_test_2"
+    description: "Project that contains the subnet to be shared"
+    domain: default
+    is_enabled: True
+  register: project_2
+
+- name: Create router with gateway on shared external network
+  openstack.cloud.router:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "shared_ext_net_test2_router"
+    project: "shared_ext_net_test_2"
+    network: "{{ external_network_name }}"
+  register: router
+
+- name: Gather routers info
+  openstack.cloud.routers_info:
+     cloud: "{{ cloud }}"
+     name: "shared_ext_net_test2_router"
+  register: routers
+
+- name: Verify routers info
+  assert:
+    that:
+      - routers.routers.0.id == router.router.id
+      - routers.routers.0.external_gateway_info.external_fixed_ips|length == 1
+
+- name: Delete router
+  openstack.cloud.router:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "shared_ext_net_test2_router"
+    project: "shared_ext_net_test_2"
+
+- name: Delete subnet
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    state: absent
+    network_name: "{{ shared_ext_network.id }}"
+    name: "shared_ext_subnet"
+    project: "shared_ext_net_test_1"
+
+- name: Delete network
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "{{ external_network_name }}"
+    project: "shared_ext_net_test_1"
+
+- name: Delete project 2
+  openstack.cloud.project:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "shared_ext_net_test_2"
+
+- name: Delete project 1
+  openstack.cloud.project:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "shared_ext_net_test_1"

ci/roles/security_group/tasks/main.yml

@@ -72,4 +72,25 @@
      name: ansible_security_group
      state: absent
 
+- name: Create stateless security group
+  openstack.cloud.security_group:
+     cloud: "{{ cloud }}"
+     name: ansible_security_group_stateless
+     stateful: false
+     state: present
+     description: 'Created from Ansible playbook'
+  register: security_group_stateless
+
+- name: Assert return values of security_group module
+  assert:
+    that:
+      - security_group_stateless.security_group.name == 'ansible_security_group_stateless'
+      - security_group_stateless.security_group.stateful == False
+
+- name: Delete stateless security group
+  openstack.cloud.security_group:
+     cloud: "{{ cloud }}"
+     name: ansible_security_group_stateless
+     state: absent
+
 - include_tasks: rules.yml

ci/roles/security_group/tasks/rules.yml

@@ -32,7 +32,9 @@
 - name: Assert return values of security_group_rule_info module
   assert:
     that:
-      - security_group_rules.security_group_rules | length == 0
+      - security_group_rules.security_group_rules | length in [1, 2]
+      - security_group_rules.security_group_rules | map(attribute='ether_type') | list | sort in
+        [['IPv4'], ['IPv6'], ['IPv4', 'IPv6']]
 
 - name: Delete security group
   openstack.cloud.security_group:
@@ -58,6 +60,47 @@
     that:
       - security_group is not changed
 
+- name: Create security group without security group rules
+  openstack.cloud.security_group:
+    cloud: "{{ cloud }}"
+    name: ansible_security_group
+    security_group_rules: []
+  register: security_group
+
+- name: Assert return values of security_group module
+  assert:
+    that:
+      - security_group is changed
+
+- name: Create security group without security group rules again
+  openstack.cloud.security_group:
+    cloud: "{{ cloud }}"
+    name: ansible_security_group
+    security_group_rules: []
+  register: security_group
+
+- name: Assert return values of security_group module
+  assert:
+    that:
+      - security_group is not changed
+
+- name: Fetch security group rules
+  openstack.cloud.security_group_rule_info:
+    cloud: "{{ cloud }}"
+    security_group: ansible_security_group
+  register: security_group_rules
+
+- name: Assert return values of security_group_rule_info module
+  assert:
+    that:
+      - security_group_rules.security_group_rules | length == 0
+
+- name: Delete security group without security group rules
+  openstack.cloud.security_group:
+    cloud: "{{ cloud }}"
+    name: ansible_security_group
+    state: absent
+
 - name: Create security group including security group rules
   openstack.cloud.security_group:
     cloud: "{{ cloud }}"
@@ -263,10 +306,11 @@
     name: ansible_security_group
     state: absent
 
-- name: Create security group
+- name: Create security group without security group rules
   openstack.cloud.security_group:
     cloud: "{{ cloud }}"
     name: ansible_security_group
+    security_group_rules: []
     state: present
   register: security_group
 

ci/roles/server/tasks/main.yml

@@ -224,7 +224,7 @@
   register: info
   # TODO: Drop ignore_errors once openstacksdk's bug #2010135 has been solved.
   #       Ref.: https://storyboard.openstack.org/#!/story/2010135
-  ignore_errors: yes
+  ignore_errors: true
 
 - name: Check info about server image name
   assert:
@@ -232,7 +232,7 @@
       - info.servers[0].image.name == image_name
   # TODO: Drop ignore_errors once openstacksdk's bug #2010135 has been solved.
   #       Ref.: https://storyboard.openstack.org/#!/story/2010135
-  ignore_errors: yes
+  ignore_errors: true
 
 - name: Delete server (FIP from pool/network)
   openstack.cloud.server:
@@ -375,7 +375,7 @@
     state: present
     name: "{{ server_port }}"
     network: "{{ server_network }}"
-    no_security_groups: yes
+    no_security_groups: true
     fixed_ips:
       - ip_address: 192.168.0.42
   register: port
@@ -399,6 +399,9 @@
       - port-id: "{{ port.port.id }}"
     reuse_ips: false
     state: present
+    tags:
+      - first
+      - second
     wait: true
   register: server
 
@@ -413,6 +416,7 @@
         |selectattr('OS-EXT-IPS:type', 'equalto', 'floating')
         |map(attribute='addr')
         |list|length == 0
+      - server.server.tags == ["first", "second"]
 
 - name: Find all floating ips for debugging
   openstack.cloud.floating_ip_info:
@@ -454,6 +458,8 @@
       - '{{ server_security_group }}'
       - '{{ server_alt_security_group }}'
     state: present
+    tags:
+      - yellow
     wait: true
   register: server_updated
 
@@ -475,6 +481,7 @@
       - server_updated.server.addresses[server_network]|length == 2
       - port.port.fixed_ips[0].ip_address in
         server_updated.server.addresses[server_network]|map(attribute='addr')
+      - server_updated.server.tags == ['yellow']
       # TODO: Verify networks once openstacksdk's issue #2010352 has been solved
       # Ref.: https://storyboard.openstack.org/#!/story/2010352
       #- server_updated.server.addresses.public|length > 0
@@ -509,6 +516,8 @@
       - '{{ server_security_group }}'
       - '{{ server_alt_security_group }}'
     state: present
+    tags:
+      - yellow
     wait: true
   register: server_updated_again
 
@@ -517,6 +526,7 @@
     that:
       - server.server.id == server_updated_again.server.id
       - server_updated_again is not changed
+      - server_updated_again.server.tags == ['yellow']
 
 # TODO: Drop failure test once openstacksdk's issue #2010352 has been solved
 # Ref.: https://storyboard.openstack.org/#!/story/2010352
@@ -555,7 +565,7 @@
 - name: Delete updated server
   openstack.cloud.server:
     cloud: "{{ cloud }}"
-    delete_ips: yes
+    delete_ips: true
     name: "{{ server_name }}"
     state: absent
     wait: true

ci/roles/server_action/tasks/main.yml

@@ -460,19 +460,14 @@
   register: server
   ignore_errors: true
 
-- name: Assert shelve offload server
-  assert:
-    that:
-      - ((server is success)
-         or (server is not success
-             and "Cannot 'shelveOffload' instance" in server.msg
-             and "while it is in vm_state shelved_offloaded" in server.msg))
-
 - name: Get info about server
   openstack.cloud.server_info:
     cloud: "{{ cloud }}"
     server: ansible_server
   register: servers
+  until: servers.servers.0.task_state == none
+  retries: 30
+  delay: 10
 
 - name: Ensure status for server is SHELVED_OFFLOADED
   # no change if server has been offloaded automatically after first shelve command
@@ -558,7 +553,7 @@
   assert:
     that:
       - servers.servers.0.status == 'ACTIVE'
-      - server is not changed
+      - server is changed
 
 - name: Reboot server (HARD)
   openstack.cloud.server_action:
@@ -578,7 +573,7 @@
   assert:
     that:
       - servers.servers.0.status == 'ACTIVE'
-      - server is not changed
+      - server is changed
 
 - name: Delete server
   openstack.cloud.server:

ci/roles/server_volume/tasks/main.yml

@@ -1,9 +1,21 @@
+---
+- name: List all images
+  openstack.cloud.image_info:
+    cloud: "{{ cloud }}"
+  register: images
+
+- name: Identify CirrOS image name
+  set_fact:
+    image_name: "{{ images.images|community.general.json_query(query)|first }}"
+  vars:
+    query: "[?starts_with(name, 'cirros')].name"
+
 - name: Create server
   openstack.cloud.server:
     cloud: "{{ cloud }}"
     state: present
     name: "{{ server_name }}"
-    image: "cirros-0.5.2-x86_64-disk"
+    image: "{{ image_name }}"
     flavor: "{{ flavor_name }}"
     network: "{{ server_network }}"
     auto_ip: false

ci/roles/share_type/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+share_backend_name: GENERIC_BACKEND
+share_type_name: test_share_type
+share_type_description: Test share type for CI
+share_type_alt_description: Changed test share type

ci/roles/share_type/tasks/main.yml

@@ -0,0 +1,130 @@
+---
+- name: Create share type
+  openstack.cloud.share_type:
+    name: "{{ share_type_name }}"
+    cloud: "{{ cloud }}"
+    state: present
+    extra_specs:
+      share_backend_name: "{{ share_backend_name }}"
+      snapshot_support: true
+      create_share_from_snapshot_support: true
+    description: "{{ share_type_description }}"
+  register: the_result
+
+- name: Check created share type
+  vars:
+    the_share_type: "{{ the_result.share_type }}"
+  ansible.builtin.assert:
+    that:
+      - "'id' in the_result.share_type"
+      - the_share_type.description == share_type_description
+      - the_share_type.is_public == True
+      - the_share_type.name == share_type_name
+      - the_share_type.extra_specs['share_backend_name'] == share_backend_name
+      - the_share_type.extra_specs['snapshot_support'] == "True"
+      - the_share_type.extra_specs['create_share_from_snapshot_support'] == "True"
+    success_msg: >-
+      Created share type: {{ the_result.share_type.id }},
+      Name: {{ the_result.share_type.name }},
+      Description: {{ the_result.share_type.description }}
+
+- name: Test share type info module
+  openstack.cloud.share_type_info:
+    name: "{{ share_type_name }}"
+    cloud: "{{ cloud }}"
+  register: info_result
+
+- name: Check share type info result
+  ansible.builtin.assert:
+    that:
+      - info_result.share_type.id == the_result.share_type.id
+      - info_result.share_type.name == share_type_name
+      - info_result.share_type.description == share_type_description
+    success_msg: "Share type info retrieved successfully"
+
+- name: Test, check idempotency
+  openstack.cloud.share_type:
+    name: "{{ share_type_name }}"
+    cloud: "{{ cloud }}"
+    state: present
+    extra_specs:
+      share_backend_name: "{{ share_backend_name }}"
+      snapshot_support: true
+      create_share_from_snapshot_support: true
+    description: "{{ share_type_description }}"
+    is_public: true
+  register: the_result
+
+- name: Check result.changed is false
+  ansible.builtin.assert:
+    that:
+      - the_result.changed == false
+    success_msg: "Request with the same details lead to no changes"
+
+- name: Add extra spec
+  openstack.cloud.share_type:
+    cloud: "{{ cloud }}"
+    name: "{{ share_type_name }}"
+    state: present
+    extra_specs:
+      share_backend_name: "{{ share_backend_name }}"
+      snapshot_support: true
+      create_share_from_snapshot_support: true
+      some_spec: fake_spec
+    description: "{{ share_type_alt_description }}"
+    is_public: true
+  register: the_result
+
+- name: Check share type extra spec
+  ansible.builtin.assert:
+    that:
+      - "'some_spec' in the_result.share_type.extra_specs"
+      - the_result.share_type.extra_specs["some_spec"] == "fake_spec"
+      - the_result.share_type.description == share_type_alt_description
+    success_msg: >-
+      New extra specs: {{ the_result.share_type.extra_specs }}
+
+- name: Remove extra spec by updating with reduced set
+  openstack.cloud.share_type:
+    cloud: "{{ cloud }}"
+    name: "{{ share_type_name }}"
+    state: present
+    extra_specs:
+      share_backend_name: "{{ share_backend_name }}"
+      snapshot_support: true
+      create_share_from_snapshot_support: true
+    description: "{{ share_type_alt_description }}"
+    is_public: true
+  register: the_result
+
+- name: Check extra spec was removed
+  ansible.builtin.assert:
+    that:
+      - "'some_spec' not in the_result.share_type.extra_specs"
+    success_msg: "Extra spec was successfully removed"
+
+- name: Delete share type
+  openstack.cloud.share_type:
+    cloud: "{{ cloud }}"
+    name: "{{ share_type_name }}"
+    state: absent
+  register: the_result
+
+- name: Check deletion was successful
+  ansible.builtin.assert:
+    that:
+      - the_result.changed == true
+    success_msg: "Share type deleted successfully"
+
+- name: Test deletion idempotency
+  openstack.cloud.share_type:
+    cloud: "{{ cloud }}"
+    name: "{{ share_type_name }}"
+    state: absent
+  register: the_result
+
+- name: Check deletion idempotency
+  ansible.builtin.assert:
+    that:
+      - the_result.changed == false
+    success_msg: "Deletion idempotency works correctly"

ci/roles/subnet/defaults/main.yml

@@ -25,3 +25,4 @@ expected_fields:
   - updated_at
   - use_default_subnet_pool
 subnet_name: shade_subnet
+segment_name: example_segment

ci/roles/subnet/tasks/main.yml

@@ -17,10 +17,20 @@
     name: "{{ network_name }}"
     state: present
 
+- name: Create network segment {{ segment_name }}
+  openstack.cloud.network_segment:
+    cloud: "{{ cloud }}"
+    name: "{{ segment_name }}"
+    network: "{{ network_name }}"
+    network_type: "vxlan"
+    segmentation_id: 1000
+    state: present
+
 - name: Create subnet {{ subnet_name }} on network {{ network_name }}
   openstack.cloud.subnet:
     cloud: "{{ cloud }}"
     network_name: "{{ network_name }}"
+    network_segment: "{{ segment_name }}"
     name: "{{ subnet_name }}"
     state: present
     enable_dhcp: "{{ enable_subnet_dhcp }}"
@@ -31,6 +41,9 @@
     gateway_ip: 192.168.0.1
     allocation_pool_start: 192.168.0.2
     allocation_pool_end: 192.168.0.254
+    tags:
+      - foo
+      - bar
   register: subnet
 
 - name: Assert changed
@@ -56,6 +69,9 @@
     gateway_ip: 192.168.0.1
     allocation_pool_start: 192.168.0.2
     allocation_pool_end: 192.168.0.254
+    tags:
+      - foo
+      - bar
   register: subnet
 
 - name: Assert not changed
@@ -80,6 +96,8 @@
       enable_dhcp: "{{ enable_subnet_dhcp }}"
       gateway_ip: 192.168.0.1
       cidr: 192.168.0.0/24
+      tags:
+        - bar
   register: subnet
 
 - name: Verify Subnet info result
@@ -114,6 +132,10 @@
     dns_nameservers:
       - 8.8.8.7
     cidr: 192.168.0.0/24
+    tags:
+      - foo
+      - bar
+      - baz
   register: subnet
 
 - name: Assert changed
@@ -142,6 +164,48 @@
   assert:
     that: subnet is not changed
 
+- name: Create subnet {{ subnet_name }} on network {{ network_name }} without gateway IP
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    name: "{{ subnet_name }}"
+    state: present
+    cidr: 192.168.0.0/24
+    disable_gateway_ip: true
+  register: subnet
+
+- name: Assert changed
+  assert:
+    that: subnet is changed
+
+- name: Create subnet {{ subnet_name }} on network {{ network_name }} without gateway IP
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    name: "{{ subnet_name }}"
+    state: present
+    cidr: 192.168.0.0/24
+    disable_gateway_ip: true
+  register: subnet
+
+- name: Assert not changed
+  assert:
+    that: subnet is not changed
+
+- name: Delete subnet {{ subnet_name }} again
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_name }}"
+    state: absent
+  register: subnet
+
+- name: Delete network segment {{ segment_name }}
+  openstack.cloud.network_segment:
+    cloud: "{{ cloud }}"
+    name: "{{ segment_name }}"
+    network: "{{ network_name }}"
+    state: absent
+
 - name: Delete network {{ network_name }}
   openstack.cloud.network:
     cloud: "{{ cloud }}"
@@ -150,3 +214,6 @@
 
 - name: Subnet Allocation
   include_tasks: subnet-allocation.yml
+
+- name: Subnet Allocations from Subnet Pool
+  include_tasks: subnet-pool.yaml

ci/roles/subnet/tasks/subnet-allocation.yml

@@ -62,6 +62,81 @@
       - subnet_result.subnets[0].allocation_pools.0.start ==  '192.168.0.2'
       - subnet_result.subnets[0].allocation_pools.0.end == '192.168.0.8'
 
+- name: Delete subnet {{ subnet_name }}
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_name }}"
+    state: absent
+
+- name: Create subnet {{ subnet_name }} with multiple allocation pools on network {{ network_name }}
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    enable_dhcp: "{{ enable_subnet_dhcp }}"
+    name: "{{ subnet_name }}"
+    state: present
+    cidr: 192.168.0.0/24
+    gateway_ip: 192.168.0.1
+    allocation_pools:
+      - start: 192.168.0.2
+        end: 192.168.0.4
+      - start: 192.168.0.10
+        end: 192.168.0.12
+
+- name: Create subnet {{ subnet_name }} on network {{ network_name }} again
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    enable_dhcp: "{{ enable_subnet_dhcp }}"
+    name: "{{ subnet_name }}"
+    state: present
+    cidr: 192.168.0.0/24
+    gateway_ip: 192.168.0.1
+    allocation_pools:
+      - start: 192.168.0.2
+        end: 192.168.0.4
+      - start: 192.168.0.10
+        end: 192.168.0.12
+  register: idem2
+
+- name: Update subnet {{ subnet_name }} allocation pools
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    name: "{{ subnet_name }}"
+    state: present
+    cidr: 192.168.0.0/24
+    gateway_ip: 192.168.0.1
+    allocation_pools:
+      - start: 192.168.0.2
+        end: 192.168.0.8
+      - start: 192.168.0.10
+        end: 192.168.0.16
+
+- name: Get Subnet Info
+  openstack.cloud.subnets_info:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_name }}"
+  register: subnet_result
+
+# TODO(sshnaidm): Uncomment this section when the issue with allocation_pools is fixed
+# - name: Verify Subnet Allocation Pools Exist
+#   assert:
+#     that:
+#       - idem2 is not changed
+#       - subnet_result.subnets is defined
+#       - subnet_result.subnets | length == 1
+#       - subnet_result.subnets[0].allocation_pools is defined
+#       - subnet_result.subnets[0].allocation_pools | length == 2
+
+# - name: Verify Subnet Allocation Pools
+#   assert:
+#     that:
+#       - (subnet_result.subnets[0].allocation_pools.0.start == '192.168.0.2' and subnet_result.subnets[0].allocation_pools.0.end == '192.168.0.8') or
+#         (subnet_result.subnets[0].allocation_pools.0.start == '192.168.0.10' and subnet_result.subnets[0].allocation_pools.0.end == '192.168.0.16')
+#       - (subnet_result.subnets[0].allocation_pools.1.start == '192.168.0.2' and subnet_result.subnets[0].allocation_pools.1.end == '192.168.0.8') or
+#         (subnet_result.subnets[0].allocation_pools.1.start == '192.168.0.10' and subnet_result.subnets[0].allocation_pools.1.end == '192.168.0.16')
+
 - name: Delete subnet {{ subnet_name }}
   openstack.cloud.subnet:
     cloud: "{{ cloud }}"

ci/roles/subnet/tasks/subnet-pool.yaml

@@ -0,0 +1,168 @@
+---
+# This test cover case when subnet is constructed
+# with few prefixes and neutron API is required
+# CIDR parameter to be used together with subnet pool.
+
+- name: Create network {{ network_name }}
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    name: "{{ network_name }}"
+    state: present
+
+- name: Create address_scope
+  openstack.cloud.address_scope:
+    cloud: "{{ cloud }}"
+    name: "{{ address_scope_name }}"
+    shared: false
+    ip_version: "4"
+  register: create_address_scope
+
+- name: Create subnet pool
+  openstack.cloud.subnet_pool:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_pool_name }}"
+    is_shared: false
+    address_scope: "{{ address_scope_name }}"
+    prefixes:
+      - 192.168.0.0/24
+      - 192.168.42.0/24
+  register: subnet_pool
+
+- name: Create subnet {{ subnet_name }} on network {{ network_name }} from subnet pool {{ subnet_pool_name }}
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    enable_dhcp: "{{ enable_subnet_dhcp }}"
+    name: "{{ subnet_name }}"
+    state: present
+    cidr: 192.168.42.0/24  # we want specific cidr from subnet pool
+    ip_version: 4
+    subnet_pool: "{{ subnet_pool_name }}"
+    gateway_ip: 192.168.42.1
+    allocation_pool_start: 192.168.42.2
+    allocation_pool_end: 192.168.42.4
+
+- name: Create subnet {{ subnet_name }} on network {{ network_name }} from subnet pool {{ subnet_pool_name }} again
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    enable_dhcp: "{{ enable_subnet_dhcp }}"
+    name: "{{ subnet_name }}"
+    state: present
+    cidr: 192.168.42.0/24
+    ip_version: 4
+    subnet_pool: "{{ subnet_pool_name }}"
+    gateway_ip: 192.168.42.1
+    allocation_pool_start: 192.168.42.2
+    allocation_pool_end: 192.168.42.4
+  register: idem1
+
+- name: Get Subnet Info
+  openstack.cloud.subnets_info:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_name }}"
+  register: subnet_result
+
+- name: Verify Subnet Allocation Pools Exist
+  assert:
+    that:
+      - idem1 is not changed
+      - subnet_result.subnets is defined
+      - subnet_result.subnets | length == 1
+      - subnet_result.subnets[0].allocation_pools is defined
+      - subnet_result.subnets[0].allocation_pools | length == 1
+
+- name: Verify Subnet Allocation Pools
+  assert:
+    that:
+      - subnet_result.subnets[0].allocation_pools.0.start ==  '192.168.42.2'
+      - subnet_result.subnets[0].allocation_pools.0.end == '192.168.42.4'
+
+- name: Delete subnet {{ subnet_name }}
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_name }}"
+    state: absent
+
+- name: Create subnet {{ subnet_name }} with multiple allocation pools on network {{ network_name }} from subnet pool {{ subnet_pool_name }}
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    enable_dhcp: "{{ enable_subnet_dhcp }}"
+    name: "{{ subnet_name }}"
+    state: present
+    cidr: 192.168.42.0/24  # we want specific cidr from subnet pool
+    ip_version: 4
+    subnet_pool: "{{ subnet_pool_name }}"
+    gateway_ip: 192.168.42.1
+    allocation_pools:
+      - start: 192.168.42.2
+        end: 192.168.42.4
+      - start: 192.168.42.6
+        end: 192.168.42.8
+
+- name: Create subnet {{ subnet_name }} on network {{ network_name }} from subnet pool {{ subnet_pool_name }} again
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    enable_dhcp: "{{ enable_subnet_dhcp }}"
+    name: "{{ subnet_name }}"
+    state: present
+    cidr: 192.168.42.0/24
+    ip_version: 4
+    subnet_pool: "{{ subnet_pool_name }}"
+    gateway_ip: 192.168.42.1
+    allocation_pools:
+      - start: 192.168.42.2
+        end: 192.168.42.4
+      - start: 192.168.42.6
+        end: 192.168.42.8
+  register: idem2
+
+- name: Get Subnet Info
+  openstack.cloud.subnets_info:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_name }}"
+  register: subnet_result
+
+# NOT(gtema) Temporarily disable the check to land other gate fix
+#- name: Verify Subnet Allocation Pools Exist
+#  assert:
+#    that:
+#      - idem2 is not changed
+#      - subnet_result.subnets is defined
+#      - subnet_result.subnets | length == 1
+#      - subnet_result.subnets[0].allocation_pools is defined
+#      - subnet_result.subnets[0].allocation_pools | length == 2
+#
+#- name: Verify Subnet Allocation Pools
+#  assert:
+#    that:
+#      - (subnet_result.subnets[0].allocation_pools.0.start == '192.168.42.2' and subnet_result.subnets[0].allocation_pools.0.end == '192.168.42.4') or
+#        (subnet_result.subnets[0].allocation_pools.0.start == '192.168.42.6' and subnet_result.subnets[0].allocation_pools.0.end == '192.168.42.8')
+#      - (subnet_result.subnets[0].allocation_pools.1.start == '192.168.42.2' and subnet_result.subnets[0].allocation_pools.1.end == '192.168.42.4') or
+#        (subnet_result.subnets[0].allocation_pools.1.start == '192.168.42.6' and subnet_result.subnets[0].allocation_pools.1.end == '192.168.42.8')
+
+- name: Delete subnet {{ subnet_name }}
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_name }}"
+    state: absent
+
+- name: Delete created subnet pool
+  openstack.cloud.subnet_pool:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_pool_name }}"
+    state: absent
+
+- name: Delete created address scope
+  openstack.cloud.address_scope:
+    cloud: "{{ cloud }}"
+    name: "{{ address_scope_name }}"
+    state: absent
+
+- name: Delete network {{ network_name }}
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    name: "{{ network_name }}"
+    state: absent

ci/roles/trait/defaults/main.yml

@@ -0,0 +1 @@
+trait_name: CUSTOM_ANSIBLE_TRAIT

ci/roles/trait/tasks/main.yml

@@ -0,0 +1,28 @@
+---
+- name: Create trait
+  openstack.cloud.trait:
+    cloud: "{{ cloud }}"
+    state: present
+    id: "{{ trait_name }}"
+  until: result is success
+  retries: 5
+  delay: 20
+  register: result
+
+- name: Assert trait
+  assert:
+    that:
+      - "'name' in result.trait"
+      - "result.trait.id == trait_name"
+
+- name: Remove trait
+  openstack.cloud.trait:
+    cloud: "{{ cloud }}"
+    state: absent
+    id: "{{ trait_name }}"
+  register: result1
+
+- name: Assert trait removed
+  assert:
+    that:
+      - "'trait' not in result1"

ci/roles/trunk/defaults/main.yml

@@ -0,0 +1,21 @@
+expected_fields:
+  - created_at
+  - description
+  - id
+  - is_admin_state_up
+  - name
+  - port_id
+  - project_id
+  - revision_number
+  - status
+  - sub_ports
+  - tags
+  - tenant_id
+  - updated_at
+trunk_name: ansible_trunk
+parent_network_name: ansible_parent_port_network
+parent_subnet_name: ansible_parent_port_subnet
+parent_port_name: ansible_parent_port
+subport_network_name: ansible_subport_network
+subport_subnet_name: ansible_subport_subnet
+subport_name: ansible_subport

ci/roles/trunk/tasks/main.yml

@@ -0,0 +1,185 @@
+---
+- name: Create parent network
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ parent_network_name }}"
+    external: true
+  register: parent_network
+
+- name: Create parent subnet
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ parent_subnet_name }}"
+    network_name: "{{ parent_network_name }}"
+    cidr: 10.5.5.0/24
+  register: parent_subnet
+
+- name: Create parent port
+  openstack.cloud.port:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ parent_port_name }}"
+    network: "{{ parent_network_name }}"
+    fixed_ips:
+      - ip_address: 10.5.5.69
+  register: parent_port
+
+- name: Create subport network
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ subport_network_name }}"
+    external: true
+  register: subport_network
+
+- name: Create subport subnet
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ subport_subnet_name }}"
+    network_name: "{{ subport_network_name }}"
+    cidr: 10.5.6.0/24
+  register: subport_subnet
+
+- name: Create subport
+  openstack.cloud.port:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ subport_name }}"
+    network: "{{ subport_network_name }}"
+    fixed_ips:
+      - ip_address: 10.5.6.55
+  register: subport
+
+- name: Create trunk without subports
+  openstack.cloud.trunk:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ trunk_name }}"
+    port: "{{ parent_port_name }}"
+  register: trunk
+
+- name: Display return values of trunk module
+  ansible.builtin.debug:
+    var: trunk
+
+- name: Assert return values of trunk module
+  ansible.builtin.assert:
+    that:
+      # allow new fields to be introduced but prevent fields from being removed
+      - expected_fields|difference(trunk.trunk.keys())|length == 0
+
+- name: Add subport to trunk by name
+  openstack.cloud.trunk:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ trunk_name }}"
+    port: "{{ parent_port_name }}"
+    sub_ports:
+      - port: "{{ subport_name }}"
+        segmentation_type: vlan
+        segmentation_id: 123
+  register: trunk_subport_by_name
+
+- name: Assert the subport is part of the trunk
+  ansible.builtin.assert:
+    that:
+      - trunk_subport_by_name.trunk.sub_ports|length == 1
+
+- name: Remove subport from trunk
+  openstack.cloud.trunk:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ trunk_name }}"
+    port: "{{ parent_port_name }}"
+    sub_ports: []
+  register: trunk_subport_removed
+
+- name: Assert no subports are part of the trunk
+  ansible.builtin.assert:
+    that:
+      - trunk_subport_removed.trunk.sub_ports|length == 0
+
+- name: Add subport to trunk by ID
+  openstack.cloud.trunk:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ trunk_name }}"
+    port: "{{ parent_port_name }}"
+    sub_ports:
+      - port: "{{ subport.port.id }}"
+        segmentation_type: vlan
+        segmentation_id: 123
+  register: trunk_subport_by_id
+
+- name: Assert the subport is part of the trunk
+  ansible.builtin.assert:
+    that:
+      - trunk_subport_by_id.trunk.sub_ports|length == 1
+
+- name: Delete trunk
+  openstack.cloud.trunk:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "{{ trunk_name }}"
+
+- name: Create trunk without subports
+  openstack.cloud.trunk:
+    cloud: "{{ cloud }}"
+    state: present
+    name: "{{ trunk_name }}"
+    port: "{{ parent_port_name }}"
+    sub_ports:
+      - port: "{{ subport.port.id }}"
+        segmentation_type: vlan
+        segmentation_id: 123
+  register: trunk_with_subports
+
+- name: Assert the subport is part of the trunk
+  ansible.builtin.assert:
+    that:
+      - trunk_with_subports.trunk.sub_ports|length == 1
+
+- name: Delete trunk
+  openstack.cloud.trunk:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "{{ trunk_name }}"
+
+- name: Delete subport
+  openstack.cloud.port:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "{{ subport_name }}"
+
+- name: Delete subport subnet
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "{{ subport_subnet_name }}"
+
+- name: Delete subport network
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "{{ subport_network_name }}"
+
+- name: Delete parent port
+  openstack.cloud.port:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "{{ parent_port_name }}"
+
+- name: Delete parent subnet
+  openstack.cloud.subnet:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "{{ parent_subnet_name }}"
+
+- name: Delete parent network
+  openstack.cloud.network:
+    cloud: "{{ cloud }}"
+    state: absent
+    name: "{{ parent_network_name }}"

ci/roles/volume/tasks/main.yml

@@ -12,14 +12,35 @@
     that: item in vol.volume
   loop: "{{ expected_fields }}"
 
-- name: Create volume from existing volume
+- assert:
+    that: not vol.volume.is_bootable
+
+- name: Create bootable volume from existing volume
   openstack.cloud.volume:
      cloud: "{{ cloud }}"
      state: present
      size: 1
      volume: "{{ vol.volume.id }}"
      name: ansible_volume1
+     is_bootable: true
      description: Test volume
+  register: vol
+
+- assert:
+    that: vol.volume.is_bootable
+
+- name: Make the first volume bootable
+  openstack.cloud.volume:
+     cloud: "{{ cloud }}"
+     state: present
+     size: 1
+     name: ansible_volume
+     is_bootable: true
+     description: Test volume
+  register: vol
+
+- assert:
+    that: vol.volume.is_bootable
 
 - name: Delete volume
   openstack.cloud.volume:

ci/roles/volume/tasks/volume_info.yml

@@ -37,7 +37,7 @@
 - name: Check info
   assert:
     that:
-      - info1.volumes | selectattr("id", "equalto", "{{ info.volumes.0.id }}") | list | length == 1
+      - info1.volumes | selectattr("id", "equalto", info.volumes.0.id) | list | length == 1
       - info1.volumes.0.name == 'ansible_test'
       - info1.volumes.0.status == None
 

ci/roles/volume_image_metadata/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+volume_image_metadata_cloud: "{{ cloud | default(omit) }}"
+volume_image_metadata_volume_name: test-image-metadata-volume
+volume_image_metadata_size: 1
+volume_image_metadata:
+  disk_format: qcow2
+  container_format: bare

ci/roles/volume_image_metadata/tasks/main.yml

@@ -0,0 +1,103 @@
+---
+- name: Get available images
+  openstack.cloud.image_info:
+    cloud: "{{ volume_image_metadata_cloud }}"
+  register: image_info
+
+- name: Select test image
+  set_fact:
+    volume_image_metadata_image_id: >-
+      {{
+        image_info.images
+        | selectattr('status', 'equalto', 'active')
+        | list
+        | first
+        | default({})
+      }}
+
+- name: Assert an image is available for testing
+  assert:
+    that:
+      - volume_image_metadata_image_id.id is defined
+    fail_msg: "No active images available in the cloud for volume_image_metadata CI test"
+
+- name: Create a test volume from image
+  openstack.cloud.volume:
+    cloud: "{{ volume_image_metadata_cloud }}"
+    state: present
+    name: "{{ volume_image_metadata_volume_name }}"
+    image: "{{ volume_image_metadata_image_id.id }}"
+    size: "{{ volume_image_metadata_size }}"
+  register: created_volume
+
+- name: Assert volume was created
+  assert:
+    that:
+      - created_volume.volume is defined
+      - created_volume.volume.id is defined
+
+- name: Get volume details
+  openstack.cloud.volume_info:
+    cloud: "{{ volume_image_metadata_cloud }}"
+    name: "{{ volume_image_metadata_volume_name }}"
+  register: volume_info
+
+- name: Assert volume has image metadata
+  assert:
+    that:
+      - volume_info.volumes[0].volume_image_metadata is defined
+      - volume_info.volumes[0].volume_image_metadata | length > 0
+
+# --------------------------------------------------------------------
+# Exercise new module
+# --------------------------------------------------------------------
+- name: Set volume image metadata
+  openstack.cloud.volume_image_metadata:
+    cloud: "{{ volume_image_metadata_cloud }}"
+    volume: "{{ created_volume.volume.id }}"
+    image_metadata: "{{ volume_image_metadata }}"
+  register: image_meta_result
+
+- name: Assert image metadata changed
+  assert:
+    that:
+      - image_meta_result.changed | bool
+
+# --------------------------------------------------------------------
+# Idempotency check
+# --------------------------------------------------------------------
+- name: Set volume image metadata again (idempotent)
+  openstack.cloud.volume_image_metadata:
+    cloud: "{{ volume_image_metadata_cloud }}"
+    volume: "{{ created_volume.volume.id }}"
+    image_metadata: "{{ volume_image_metadata }}"
+  register: image_meta_idempotent
+
+- name: Assert idempotent behavior
+  assert:
+    that:
+      - not image_meta_idempotent.changed | bool
+
+# --------------------------------------------------------------------
+# Verify metadata persisted
+# --------------------------------------------------------------------
+- name: Re-fetch volume details
+  openstack.cloud.volume_info:
+    cloud: "{{ volume_image_metadata_cloud }}"
+    name: "{{ volume_image_metadata_volume_name }}"
+  register: final_volume_info
+
+- name: Verify image metadata values
+  assert:
+    that:
+      - final_volume_info.volumes[0].volume_image_metadata.disk_format == "qcow2"
+      - final_volume_info.volumes[0].volume_image_metadata.container_format == "bare"
+
+# --------------------------------------------------------------------
+# Cleanup
+# --------------------------------------------------------------------
+- name: Delete test volume
+  openstack.cloud.volume:
+    cloud: "{{ volume_image_metadata_cloud }}"
+    state: absent
+    name: "{{ volume_image_metadata_volume_name }}"

ci/roles/volume_manage/defaults/main.yml

@@ -0,0 +1,32 @@
+test_volume: ansible_test_volume
+managed_volume: managed_test_volume
+expected_fields:
+  - attachments
+  - availability_zone
+  - consistency_group_id
+  - created_at
+  - updated_at
+  - description
+  - extended_replication_status
+  - group_id
+  - host
+  - image_id
+  - is_bootable
+  - is_encrypted
+  - is_multiattach
+  - migration_id
+  - migration_status
+  - project_id
+  - replication_driver_data
+  - replication_status
+  - scheduler_hints
+  - size
+  - snapshot_id
+  - source_volume_id
+  - status
+  - user_id
+  - volume_image_metadata
+  - volume_type
+  - id
+  - name
+  - metadata

ci/roles/volume_manage/tasks/main.yml

@@ -0,0 +1,65 @@
+---
+- name: Create volume
+  openstack.cloud.volume:
+     cloud: "{{ cloud }}"
+     state: present
+     size: 1
+     name: "{{ test_volume }}"
+     description: Test volume
+  register: vol
+
+- assert:
+    that: item in vol.volume
+  loop: "{{ expected_fields }}"
+
+- name: Unmanage volume
+  openstack.cloud.volume_manage:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ vol.volume.id }}"
+
+- name: Unmanage volume again
+  openstack.cloud.volume_manage:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ vol.volume.id }}"
+  register: unmanage_idempotency
+
+- assert:
+    that:
+      - unmanage_idempotency is not changed
+
+- name: Manage volume
+  openstack.cloud.volume_manage:
+     cloud: "{{ cloud }}"
+     state: present
+     source_name: volume-{{ vol.volume.id }}
+     host: "{{ vol.volume.host }}"
+     name: "{{ managed_volume }}"
+  register: new_vol
+
+- assert:
+    that:
+      - new_vol.volume.name == managed_volume
+
+- name: Manage volume again
+  openstack.cloud.volume_manage:
+     cloud: "{{ cloud }}"
+     state: present
+     source_name: volume-{{ vol.volume.id }}
+     host: "{{ vol.volume.host }}"
+     name: "{{ managed_volume }}"
+  register: vol_idempotency
+
+- assert:
+    that:
+      - vol_idempotency is not changed
+
+- pause:
+    seconds: 10
+
+- name: Delete volume
+  openstack.cloud.volume:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ managed_volume }}"

ci/roles/volume_retype/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+volume_retype_cloud: "{{ cloud | default(omit) }}"
+vtype_src_name: ansible_test_vtype_src
+vtype_dst_name: ansible_test_vtype_dst
+volume_name: ansible_test_retype_vol

ci/roles/volume_retype/tasks/main.yml

@@ -0,0 +1,183 @@
+---
+# ci/roles/volume_retype/tasks/main.yml
+# Integration tests for openstack.cloud.volume_retype
+#
+# Prerequisites (set up in surrounding playbook or defaults):
+#   - cloud: devstack-admin
+#   - A DevStack instance with at least two volume types
+#
+# The tests follow the collection's pattern:
+#   1. Create prerequisites (volume types, volume)
+#   2. Run module - assert changed
+#   3. Re-run module - assert NOT changed (idempotency)
+#   4. Validate returned data
+#   5. Clean up
+
+- name: Create source volume type
+  openstack.cloud.volume_type:
+    cloud: "{{ volume_retype_cloud  }}"
+    state: present
+    name: "{{ vtype_src_name }}"
+    is_public: true
+  register: vtype_src
+
+- name: Create destination volume type
+  openstack.cloud.volume_type:
+    cloud: "{{ volume_retype_cloud }}"
+    state: present
+    name: "{{ vtype_dst_name }}"
+    is_public: true
+  register: vtype_dst
+
+- name: Create a test volume using the source type
+  openstack.cloud.volume:
+    cloud: "{{ volume_retype_cloud }}"
+    state: present
+    name: "{{ volume_name }}"
+    size: 1
+    volume_type: "{{ vtype_src_name }}"
+    wait: true
+  register: test_volume
+
+- name: Assert volume was created with the source type
+  ansible.builtin.assert:
+    that:
+      - test_volume.volume.volume_type == vtype_src_name
+      - test_volume.volume.status == 'available'
+
+# ------------------------------------------------------------------
+# Test 1: Basic retype (migration_policy=never, same-backend assumed)
+# ------------------------------------------------------------------
+- name: Retype volume to destination type (migration_policy=never)
+  openstack.cloud.volume_retype:
+    cloud: "{{ volume_retype_cloud }}"
+    volume: "{{ volume_name }}"
+    new_type: "{{ vtype_dst_name }}"
+    migration_policy: never
+    wait: true
+    timeout: 120
+  register: retype_result
+
+- name: Assert retype was applied
+  ansible.builtin.assert:
+    that:
+      - retype_result is changed
+      - retype_result.volume.volume_type == vtype_dst_name
+      - retype_result.volume.status == 'available'
+
+# ------------------------------------------------------------------
+# Test 2: Idempotency – re-running with same target type must be no-op
+# ------------------------------------------------------------------
+- name: Re-run retype with same target type (idempotency check)
+  openstack.cloud.volume_retype:
+    cloud: "{{ volume_retype_cloud }}"
+    volume: "{{ volume_name }}"
+    new_type: "{{ vtype_dst_name }}"
+    migration_policy: never
+    wait: true
+  register: retype_idempotent
+
+- name: Assert no change on second run
+  ansible.builtin.assert:
+    that:
+      - retype_idempotent is not changed
+
+# ------------------------------------------------------------------
+# Test 3: Check mode – must report changed without touching the API
+# ------------------------------------------------------------------
+- name: Check mode – retype back to source type (should report changed, no action)
+  openstack.cloud.volume_retype:
+    cloud: "{{ volume_retype_cloud }}"
+    volume: "{{ volume_name }}"
+    new_type: "{{ vtype_src_name }}"
+    migration_policy: never
+  check_mode: true
+  register: retype_check_mode
+
+- name: Assert check mode reports changed but volume type is still the destination
+  ansible.builtin.assert:
+    that:
+      - retype_check_mode is changed
+
+- name: Confirm actual volume type did NOT change (check mode was dry-run)
+  openstack.cloud.volume_info:
+    cloud: "{{ volume_retype_cloud }}"
+    name: "{{ volume_name }}"
+  register: volume_info_after_check
+
+- name: Assert volume type unchanged after check mode run
+  ansible.builtin.assert:
+    that:
+      - volume_info_after_check.volumes[0].volume_type == vtype_dst_name
+
+# ------------------------------------------------------------------
+# Test 4: Retype by volume ID (not name)
+# ------------------------------------------------------------------
+- name: Retype volume using its UUID
+  openstack.cloud.volume_retype:
+    cloud: "{{ volume_retype_cloud }}"
+    volume: "{{ test_volume.volume.id }}"
+    new_type: "{{ vtype_src_name }}"
+    migration_policy: never
+    wait: true
+  register: retype_by_id
+
+- name: Assert retype by ID succeeded
+  ansible.builtin.assert:
+    that:
+      - retype_by_id is changed
+      - retype_by_id.volume.volume_type == vtype_src_name
+
+# ------------------------------------------------------------------
+# Test 5: Error handling – non-existent volume
+# ------------------------------------------------------------------
+- name: Attempt retype of non-existent volume (expect failure)
+  openstack.cloud.volume_retype:
+    cloud: "{{ volume_retype_cloud }}"
+    volume: this-volume-does-not-exist
+    new_type: "{{ vtype_dst_name }}"
+  register: retype_missing
+  ignore_errors: true
+
+- name: Assert that missing volume causes failure
+  ansible.builtin.assert:
+    that:
+      - retype_missing is failed
+
+# ------------------------------------------------------------------
+# Test 6: Error handling – non-existent volume type
+# ------------------------------------------------------------------
+- name: Attempt retype to a non-existent volume type (expect failure)
+  openstack.cloud.volume_retype:
+    cloud: "{{ volume_retype_cloud }}"
+    volume: "{{ volume_name }}"
+    new_type: this-type-does-not-exist
+  register: retype_missing_type
+  ignore_errors: true
+
+- name: Assert that missing volume type causes failure
+  ansible.builtin.assert:
+    that:
+      - retype_missing_type is failed
+
+# ------------------------------------------------------------------
+# Clean up
+# ------------------------------------------------------------------
+- name: Delete test volume
+  openstack.cloud.volume:
+    cloud: "{{ volume_retype_cloud }}"
+    state: absent
+    name: "{{ volume_name }}"
+    wait: true
+
+- name: Delete source volume type
+  openstack.cloud.volume_type:
+    cloud: "{{ volume_retype_cloud }}"
+    state: absent
+    name: "{{ vtype_src_name }}"
+
+- name: Delete destination volume type
+  openstack.cloud.volume_type:
+    cloud: "{{ volume_retype_cloud }}"
+    state: absent
+    name: "{{ vtype_dst_name }}"

ci/roles/volume_service/defaults/main.yml

@@ -0,0 +1,9 @@
+expected_fields:
+  - availability_zone
+  - binary
+  - disabled_reason
+  - host
+  - name
+  - state
+  - status
+  - updated_at

ci/roles/volume_service/tasks/main.yml

@@ -0,0 +1,23 @@
+---
+- name: Fetch volume services
+  openstack.cloud.volume_service_info:
+    cloud: "{{ cloud }}"
+  register: volume_services
+
+- name: Assert return values of volume_service_info module
+  assert:
+    that:
+      - volume_services.volume_services | length > 0
+      # allow new fields to be introduced but prevent fields from being removed
+      - expected_fields|difference(volume_services.volume_services[0].keys())|length == 0
+
+- name: Fetch volume services with filters
+  openstack.cloud.volume_service_info:
+    cloud: "{{ cloud }}"
+    binary: "cinder-volume"
+  register: volume_services
+
+- name: Assert return values of volume_service_info module
+  assert:
+    that:
+      - volume_services.volume_services | length > 0

ci/roles/volume_type/defaults/main.yml

@@ -0,0 +1,10 @@
+---
+volume_backend_name: LVM_iSCSI
+volume_type_name: test_type
+volume_type_description: Test volume type
+
+enc_provider_name: nova.volume.encryptors.luks.LuksEncryptor
+enc_cipher: aes-xts-plain64
+enc_control_location: front-end
+enc_control_alt_location: back-end
+enc_key_size: 256

ci/roles/volume_type/tasks/main.yml

@@ -0,0 +1,85 @@
+---
+- name: Create volume type
+  openstack.cloud.volume_type:
+    name: "{{ volume_type_name }}"
+    cloud: "{{ cloud }}"
+    state: present
+    extra_specs:
+      volume_backend_name: "{{ volume_backend_name }}"
+    description: "{{ volume_type_description }}"
+    is_public: true
+  register: the_result
+- name: Check created volume type
+  vars:
+    the_volume: "{{ the_result.volume_type }}"
+  ansible.builtin.assert:
+    that:
+      - "'id' in the_result.volume_type"
+      - the_volume.description == volume_type_description
+      - the_volume.is_public == True
+      - the_volume.name == volume_type_name
+      - the_volume.extra_specs['volume_backend_name'] == volume_backend_name
+    success_msg: >-
+      Created volume: {{ the_result.volume_type.id }},
+      Name: {{ the_result.volume_type.name }},
+      Description: {{ the_result.volume_type.description }}
+
+- name: Test, check idempotency
+  openstack.cloud.volume_type:
+    name: "{{ volume_type_name }}"
+    cloud: "{{ cloud }}"
+    state: present
+    extra_specs:
+      volume_backend_name: "{{ volume_backend_name }}"
+    description: "{{ volume_type_description }}"
+    is_public: true
+  register: the_result
+- name: Check result.changed is false
+  ansible.builtin.assert:
+    that:
+      - the_result.changed == false
+    success_msg: "Request with the same details lead to no changes"
+
+- name: Add extra spec
+  openstack.cloud.volume_type:
+    cloud: "{{ cloud }}"
+    name: "{{ volume_type_name }}"
+    state: present
+    extra_specs:
+      volume_backend_name: "{{ volume_backend_name }}"
+      some_spec: fake_spec
+    description: "{{ volume_type_description }}"
+    is_public: true
+  register: the_result
+- name: Check volume type extra spec
+  ansible.builtin.assert:
+    that:
+      - "'some_spec' in the_result.volume_type.extra_specs"
+      - the_result.volume_type.extra_specs["some_spec"] == "fake_spec"
+    success_msg: >-
+      New extra specs: {{ the_result.volume_type.extra_specs }}
+
+# is_public update attempt using openstacksdk result in unexpected attribute
+# error... TODO: Find solution
+#
+# - name: Make volume type private
+#   openstack.cloud.volume_type:
+#     cloud: "{{ cloud }}"
+#     name: "{{ volume_type_alt_name }}"
+#     state: present
+#     extra_specs:
+#       volume_backend_name: "{{ volume_backend_name }}"
+#       # some_other_spec: test
+#     description: Changed 3rd time test volume type
+#     is_public: true
+#   register: the_result
+
+- name: Volume encryption tests
+  ansible.builtin.include_tasks: volume_encryption.yml
+
+- name: Delete volume type
+  openstack.cloud.volume_type:
+    cloud: "{{ cloud }}"
+    name: "{{ volume_type_name }}"
+    state: absent
+  register: the_result

ci/roles/volume_type/tasks/volume_encryption.yml

@@ -0,0 +1,67 @@
+---
+- name: Test, Volume type has no encryption
+  openstack.cloud.volume_type_info:
+    cloud: "{{ cloud }}"
+    name: "{{ volume_type_name }}"
+  register: the_result
+- name: Check volume type has no encryption
+  ansible.builtin.assert:
+    that:
+      - the_result.encryption.id == None
+    success_msg: >-
+      Success: Volume type has no encryption at the moment
+
+- name: Test, create volume type encryption
+  openstack.cloud.volume_type_encryption:
+    cloud: "{{ cloud }}"
+    volume_type: "{{ volume_type_name }}"
+    state: present
+    encryption_provider: "{{ enc_provider_name }}"
+    encryption_cipher: "{{ enc_cipher }}"
+    encryption_control_location: "{{ enc_control_location }}"
+    encryption_key_size: "{{ enc_key_size }}"
+  register: the_result
+- name: Check volume type encryption
+  ansible.builtin.assert:
+    that:
+      - the_result.encryption.cipher == enc_cipher
+      - the_result.encryption.control_location == enc_control_location
+      - the_result.encryption.key_size == enc_key_size
+      - the_result.encryption.provider == enc_provider_name
+    success_msg: >-
+      Success: {{ the_result.encryption.encryption_id }}
+
+- name: Test, update volume type encryption
+  openstack.cloud.volume_type_encryption:
+    cloud: "{{ cloud }}"
+    volume_type: "{{ volume_type_name }}"
+    state: present
+    encryption_provider: "{{ enc_provider_name }}"
+    encryption_cipher: "{{ enc_cipher }}"
+    encryption_control_location: "{{ enc_control_alt_location }}"
+    encryption_key_size: "{{ enc_key_size }}"
+  register: the_result
+- name: Check volume type encryption change
+  ansible.builtin.assert:
+    that:
+      - the_result.encryption.control_location == enc_control_alt_location
+    success_msg: >-
+      New location: {{ the_result.encryption.control_location }}
+
+- name: Test, delete volume type encryption
+  openstack.cloud.volume_type_encryption:
+    cloud: "{{ cloud }}"
+    volume_type: "{{ volume_type_name }}"
+    state: absent
+  register: the_result
+- name: Get volume type details
+  openstack.cloud.volume_type_info:
+    cloud: "{{ cloud }}"
+    name: "{{ volume_type_name }}"
+  register: the_result
+- name: Check volume type has no encryption
+  ansible.builtin.assert:
+    that:
+      - the_result.encryption.id == None
+    success_msg: >-
+      Success: Volume type has no encryption

ci/run-ansible-tests-collection.sh

@@ -75,10 +75,10 @@ ansible-galaxy collection install --requirements-file ci/requirements.yml
 if [ -z "$PIP_INSTALL" ]; then
     tox -ebuild
     ansible-galaxy collection install "$(find build_artifact/ -maxdepth 1 -name 'openstack-cloud-*')" --force
-    TEST_COLLECTIONS_PATHS=${HOME}/.ansible/collections:$ANSIBLE_COLLECTIONS_PATHS
+    TEST_COLLECTIONS_PATHS=${HOME}/.ansible/collections:$ANSIBLE_COLLECTIONS_PATH
 else
     pip freeze | grep ansible-collections-openstack
-    TEST_COLLECTIONS_PATHS=$VIRTUAL_ENV/share/ansible/collections:$ANSIBLE_COLLECTIONS_PATHS
+    TEST_COLLECTIONS_PATHS=$VIRTUAL_ENV/share/ansible/collections:$ANSIBLE_COLLECTIONS_PATH
 fi
 
 # We need to source the current tox environment so that Ansible will
@@ -104,9 +104,6 @@ for var in $(env | grep -e '^ANSIBLE_VAR_'); do
   ANSIBLE_VARS+="${ANSIBLE_VAR_NAME}=${ANSIBLE_VAR_VALUE} " # concat variables
 done
 
-# Discover openstacksdk version
-SDK_VER=$(python -c "import openstack; print(openstack.version.__version__)")
-
 # Choose integration tests
 tag_opt=""
 if [ -n "$TAGS" ]; then
@@ -124,12 +121,17 @@ if [ ! -e /etc/magnum ]; then
     tag_opt+=" --skip-tags coe_cluster,coe_cluster_template"
 fi
 
+if ! systemctl is-enabled devstack@m-api.service 2>&1; then
+    # Skip share_type tasks if Manila is not available
+    tag_opt+=" --skip-tags share_type"
+fi
+
 cd ci/
 
 # Run tests
 set -o pipefail
 # shellcheck disable=SC2086
-ANSIBLE_COLLECTIONS_PATHS=$TEST_COLLECTIONS_PATHS ansible-playbook \
+ANSIBLE_COLLECTIONS_PATH=$TEST_COLLECTIONS_PATHS ansible-playbook \
     -vvv ./run-collection.yml \
-    -e "sdk_version=${SDK_VER} cloud=${CLOUD} cloud_alt=${CLOUD_ALT} ${ANSIBLE_VARS}" \
+    -e "cloud=${CLOUD} cloud_alt=${CLOUD_ALT} ${ANSIBLE_VARS}" \
     ${tag_opt} 2>&1 | sudo tee /opt/stack/logs/test_output.log

ci/run-collection.yml

@@ -5,6 +5,7 @@
 
   roles:
     - { role: address_scope, tags: address_scope }
+    - { role: application_credential, tags: application_credential }
     - { role: auth, tags: auth }
     - { role: catalog_service, tags: catalog_service }
     - { role: coe_cluster, tags: coe_cluster }
@@ -31,10 +32,15 @@
     - { role: loadbalancer, tags: loadbalancer }
     - { role: logging, tags: logging }
     - { role: network, tags: network }
+    - { role: network_segment, tags: network_segment }
     - { role: neutron_rbac_policy, tags: neutron_rbac_policy }
     - { role: object, tags: object }
     - { role: object_container, tags: object_container }
+    - { role: object_containers_info, tags: object_containers_info }
     - { role: port, tags: port }
+    - { role: port_forwarding, tags: port_forwarding }
+    - { role: trait, tags: trait }
+    - { role: trunk, tags: trunk }
     - { role: project, tags: project }
     - { role: quota, tags: quota }
     - { role: recordset, tags: recordset }
@@ -49,10 +55,16 @@
     - { role: server_group, tags: server_group }
     - { role: server_metadata, tags: server_metadata }
     - { role: server_volume, tags: server_volume }
+    - { role: share_type, tags: share_type }
     - { role: stack, tags: stack }
     - { role: subnet, tags: subnet }
     - { role: subnet_pool, tags: subnet_pool }
     - { role: volume, tags: volume }
+    - { role: volume_type, tags: volume_type }
     - { role: volume_backup, tags: volume_backup }
+    - { role: volume_manage, tags: volume_manage }
+    - { role: volume_service, tags: volume_service }
     - { role: volume_snapshot, tags: volume_snapshot }
     - { role: volume_type_access, tags: volume_type_access }
+    - { role: volume_image_metadata, tags: volume_image_metadata }
+    - { role: volume_retype, tags: volume_retype }

docs/contributing.md

@@ -11,7 +11,7 @@ For hacking on the Ansible OpenStack collection it helps to [prepare a DevStack
 
 ## Hosting
 
-* [Bug tracker][storyboard]
+* [Bug tracker][bugtracker]
 * [Mailing list `openstack-discuss@lists.openstack.org`][openstack-discuss].
   Prefix subjects with `[aoc]` or `[aco]` for faster responses.
 * [Code Hosting][opendev-a-c-o]
@@ -80,6 +80,8 @@ openstacksdk], please read our [branching docs](branching.md).
   + be based on (be subclasses of) `OpenStackModule` in
     `ansible_collections.openstack.cloud.plugins.module_utils.openstack`,
   + should include `extends_documentation_fragment: openstack` in their  `DOCUMENTATION` docstring,
+  + should contain `version_added` in their `DOCUMENTATION` docstring, where the version is
+    incremented minor version of the collection,
   + be registered in `meta/action_groups.yml` for enabling the variables to be set in
     [group level][ansible-module-defaults].
 * Complex functionality, cloud interaction or interoperability code should be moved to [openstacksdk][openstacksdk].
@@ -136,6 +138,22 @@ openstacksdk], please read our [branching docs](branching.md).
     results with function parameter `filters`. openstacksdk's proxy layer does not provide an equivalent and thus the
     use of `search_users()` is perfectly fine.
 
+## Changelog fragments
+
+Every patch that introduces a new feature, a bugfix, or a breaking change must include a changelog fragment.
+
+When you introduce a new module, the changelog fragment is not required. However, ensure that your module
+`DOCUMENTATION` contains `version_added` field in it. Please, increment a minor version of the collection for
+the value of `version_added`. For example, if current `openstack.cloud` collection version is `2.5.0`, you
+need to use `version_added: 2.6.0`.
+
+As this is an Ansible collection, we follow the Ansible community standard for changelogs. Please note that **the `reno`
+tool should not be used** in this repository. Instead, follow the guide linked below to create fragments manually in the
+`changelogs/fragments/` directory.
+
+Please refer to the Ansible's [changelog fragments documentation](https://docs.ansible.com/projects/ansible/latest/community/development_process.html#creating-a-changelog-fragment)
+for more details on the format, valid sections, and how to create a fragment.
+
 ## Testing
 
 * Modules have to be tested with CI integration tests (if possible).
@@ -188,4 +206,4 @@ Read [Release Guide](releasing.md) on how to publish new releases.
 [openstacksdk-cloud-layer-stays]: https://meetings.opendev.org/irclogs/%23openstack-sdks/%23openstack-sdks.2022-04-27.log.html
 [openstacksdk-to-dict]: https://opendev.org/openstack/openstacksdk/src/branch/master/openstack/resource.py
 [openstacksdk]: https://opendev.org/openstack/openstacksdk
-[storyboard]: https://storyboard.openstack.org/#!/project/openstack/ansible-collections-openstack
+[bugtracker]: https://bugs.launchpad.net/ansible-collections-openstack

docs/devstack.md

@@ -79,8 +79,7 @@ list(conn.network.ips())[0].to_dict(computed=False)
 To run the unit tests of the collection, run this in a Bash shell:
 
 ```sh
-SDK_VER=$(python -c "import openstack; print(openstack.version.__version__)")
-ansible-playbook -vvv ci/run-collection.yml -e "sdk_version=${SDK_VER} cloud=devstack-admin cloud_alt=devstack-alt"
+ansible-playbook -vvv ci/run-collection.yml -e "cloud=devstack-admin cloud_alt=devstack-alt"
 ```
 
 Use `ansible-playbook`'s `--tags` and `--skip-tags` parameters to skip CI tests. For a list of available tags, refer to

docs/releasing.md

@@ -2,16 +2,15 @@
 
 ## Publishing to Ansible Galaxy
 
-1. Create entry in [changelog.yaml](../changelogs/changelog.yaml) with commits since last release.
-   * Modules should be in a separate section `modules`
-   * Bugfixes and minor changes in their sections
-2. Change version in [galaxy.yml](../galaxy.yml). Apply [Semantic Versioning](https://semver.org/):
+1. Change version in galaxy.yml. Apply Semantic Versioning:
    * Increase major version for breaking changes or modules were removed
    * Increase minor version when modules were added
    * Increase patch version for bugfixes
-3. Run `antsibull-changelog release` command (run `pip install antsibull` before) to generate [CHANGELOG.rst](
-   ../CHANGELOG.rst) and verify correctness of generated files.
-4. Commit changes to `changelog.yaml` and `galaxy.yml`, submit patch and wait until it has been merged
+2. Run `antsibull-changelog release` command ([antsibull-changelog documentation](
+   https://docs.ansible.com/projects/ansible/latest/dev_guide/developing_collections_changelogs.html))
+   to aggregate changelog fragments into changelog.yaml and generate CHANGELOG.rst.
+3. Verify correctness of generated files.
+4. Commit changes to `changelog.yaml` and `galaxy.yml`, submit patch and wait until it has been merged.
 5. Tag the release with version as it's described in [OpenStack docs](
    https://docs.opendev.org/opendev/infra-manual/latest/drivers.html#tagging-a-release):
     * [Make sure you have a valid GnuPG key pair](

docs/reviewing.md

@@ -22,6 +22,8 @@ How to do a review? What to look for when reviewing patches?
   attributes to `name` to be consistent with other modules and with openstacksdk. When refactoring a module, then add
   the old attribute as an alias to keep backward compatibility.
 * Does the module have integration tests in `ci/roles`?
+* Does the patch include a changelog fragment? Every new feature, or important bugfix must include one. Ensure that
+  the fragment follows the Ansible format and that `reno` is not used.
 * Is documentation in `DOCUMENTATION`, `RETURN` and `EXAMPLES` up to date?
 * Does `RETURN` list all values which are returned by the module?
 * Are descriptions, keys, names, types etc. in `RETURN` up to date and sorted?
@@ -46,7 +48,7 @@ How to do a review? What to look for when reviewing patches?
   Example:
   ```sh
   ansible-playbook -vvv ci/run-collection.yml \
-      -e "sdk_version=1.0.0 cloud=devstack-admin cloud_alt=devstack-alt" \
+      -e "cloud=devstack-admin cloud_alt=devstack-alt" \
       --tags floating_ip_info
   ```
 * Does a patch remove any functionality or break backwards compatibility? The author must give a good explanation for

galaxy.yml

@@ -11,7 +11,7 @@ dependencies: {}
 repository: https://opendev.org/openstack/ansible-collections-openstack
 documentation: https://docs.ansible.com/ansible/latest/collections/openstack/cloud/index.html
 homepage: https://opendev.org/openstack/ansible-collections-openstack
-issues: https://storyboard.openstack.org/#!/project/openstack/ansible-collections-openstack
+issues: https://bugs.launchpad.net/ansible-collections-openstack
 build_ignore:
   - "*.tar.gz"
   - build_artifact
@@ -32,4 +32,4 @@ build_ignore:
   - .vscode
   - ansible_collections_openstack.egg-info
   - changelogs
-version: 2.0.0
+version: 2.6.0

galaxy.yml.in

@@ -11,7 +11,7 @@ dependencies: {}
 repository: https://opendev.org/openstack/ansible-collections-openstack
 documentation: https://docs.ansible.com/ansible/latest/collections/openstack/cloud/index.html
 homepage: https://opendev.org/openstack/ansible-collections-openstack
-issues: https://storyboard.openstack.org/#!/project/openstack/ansible-collections-openstack
+issues: https://bugs.launchpad.net/ansible-collections-openstack
 build_ignore:
   - "*.tar.gz"
   - build_artifact

meta/runtime.yml

@@ -1,13 +1,16 @@
-requires_ansible: ">=2.8"
+requires_ansible: '>=2.8'
 action_groups:
   openstack:
     - address_scope
+    - application_credential
     - auth
+    - baremetal_deploy_template
     - baremetal_inspect
     - baremetal_node
     - baremetal_node_action
     - baremetal_node_info
     - baremetal_port
+    - baremetal_port_group
     - baremetal_port_info
     - catalog_service
     - catalog_service_info
@@ -16,6 +19,7 @@ action_groups:
     - compute_flavor
     - compute_flavor_access
     - compute_flavor_info
+    - compute_service
     - compute_service_info
     - config
     - dns_zone
@@ -29,6 +33,7 @@ action_groups:
     - floating_ip_info
     - group_assignment
     - host_aggregate
+    - host_aggregate_info
     - identity_domain
     - identity_domain_info
     - identity_group
@@ -49,12 +54,16 @@ action_groups:
     - lb_pool
     - loadbalancer
     - network
+    - network_segment
     - networks_info
     - neutron_rbac_policies_info
     - neutron_rbac_policy
     - object
     - object_container
+    - object_containers_info
     - port
+    - port_forwarding
+    - port_forwarding_info
     - port_info
     - project
     - project_info
@@ -75,15 +84,22 @@ action_groups:
     - server_info
     - server_metadata
     - server_volume
+    - share_type
+    - share_type_info
     - stack
     - stack_info
     - subnet
     - subnet_pool
     - subnets_info
+    - trunk
     - volume
+    - volume_manage
     - volume_backup
     - volume_backup_info
     - volume_info
+    - volume_service_info
     - volume_snapshot
     - volume_snapshot_info
     - volume_type_access
+    - volume_image_metadata
+    - volume_retype

plugins/doc_fragments/openstack.py

@@ -46,7 +46,7 @@ options:
     description:
       - Should ansible wait until the requested resource is complete.
     type: bool
-    default: yes
+    default: true
   timeout:
     description:
       - How long should ansible wait for the requested resource.
@@ -60,7 +60,7 @@ options:
   validate_certs:
     description:
       - Whether or not SSL API requests should be verified.
-      - Before Ansible 2.3 this defaulted to C(yes).
+      - Before Ansible 2.3 this defaulted to C(true).
     type: bool
     aliases: [ verify ]
   ca_cert:

plugins/inventory/openstack.py

@@ -96,6 +96,18 @@ options:
         only.
     type: bool
     default: false
+  only_ipv4:
+    description:
+      - Use only ipv4 addresses for ansible_host and ansible_ssh_host.
+      - Using I(only_ipv4) helps when running Ansible in a ipv4 only setup.
+    type: bool
+    default: false
+  server_filters:
+    description:
+      - A dictionary of server filter value pairs.
+      - Available parameters can be seen under https://docs.openstack.org/api-ref/compute/#list-servers
+    type: dict
+    default: {}
   show_all:
     description:
       - Whether all servers should be listed or not.
@@ -143,9 +155,6 @@ import sys
 
 from ansible.errors import AnsibleParserError
 from ansible.plugins.inventory import BaseInventoryPlugin, Constructable, Cacheable
-from ansible_collections.openstack.cloud.plugins.module_utils.openstack import (
-    ensure_compatibility
-)
 
 try:
     import openstack
@@ -167,12 +176,6 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
             raise AnsibleParserError(
                 'Could not import Python library openstacksdk')
 
-        try:
-            ensure_compatibility(openstack.version.__version__)
-        except ImportError as e:
-            raise AnsibleParserError(
-                'Incompatible openstacksdk library found: {0}'.format(e))
-
         # Redirect logging to stderr so it does not mix with output, in
         # particular JSON output of ansible-inventory.
         # TODO: Integrate openstack's logging with Ansible's logging.
@@ -271,9 +274,9 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
         if not attempt_to_read_cache or cache_needs_update:
             self.display.vvvv('Retrieving servers from Openstack clouds')
             clouds_yaml_path = self.get_option('clouds_yaml_path')
-            config_files = (
-                openstack.config.loader.CONFIG_FILES
-                + ([clouds_yaml_path] if clouds_yaml_path else []))
+            config_files = openstack.config.loader.CONFIG_FILES
+            if clouds_yaml_path:
+                config_files = clouds_yaml_path + config_files
 
             config = openstack.config.loader.OpenStackConfig(
                 config_files=config_files)
@@ -293,10 +296,6 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
             clouds = [openstack.connection.Connection(config=cloud_region)
                       for cloud_region in cloud_regions]
 
-            if self.get_option('private'):
-                for cloud in self.clouds:
-                    cloud.private = True
-
             self.display.vvvv(
                 'Found {0} OpenStack cloud(s)'
                 .format(len(clouds)))
@@ -307,6 +306,7 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
 
             expand_hostvars = self.get_option('expand_hostvars')
             all_projects = self.get_option('all_projects')
+            server_filters = self.get_option('server_filters')
             servers = []
 
             def _expand_server(server, cloud, volumes):
@@ -353,7 +353,8 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
                             all_projects=all_projects,
                             # details are required because 'addresses'
                             # attribute must be populated
-                            details=True)
+                            details=True,
+                            **server_filters)
                     ]:
                         servers.append(server)
                 except openstack.exceptions.OpenStackCloudException as e:
@@ -388,12 +389,19 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
                  if address['OS-EXT-IPS:type'] == 'floating'),
                 None)
 
-            fixed_ip = next(
-                (address['addr'] for address in addresses
-                 if address['OS-EXT-IPS:type'] == 'fixed'),
-                None)
+            if self.get_option('only_ipv4'):
+                fixed_ip = next(
+                    (address['addr'] for address in addresses
+                     if (address['OS-EXT-IPS:type'] == 'fixed' and address['version'] == 4)),
+                    None)
 
-            ip = floating_ip if floating_ip is not None else fixed_ip
+            else:
+                fixed_ip = next(
+                    (address['addr'] for address in addresses
+                     if address['OS-EXT-IPS:type'] == 'fixed'),
+                    None)
+
+            ip = floating_ip if floating_ip is not None and not self.get_option('private') else fixed_ip
 
             if ip is not None:
                 host_vars['ansible_ssh_host'] = ip

plugins/module_utils/openstack.py

@@ -32,61 +32,23 @@
 
 import abc
 import copy
-from ansible.module_utils.six import raise_from
 try:
     from ansible.module_utils.compat.version import StrictVersion
 except ImportError:
     try:
         from distutils.version import StrictVersion
     except ImportError as exc:
-        raise_from(ImportError('To use this plugin or module with ansible-core'
-                               ' < 2.11, you need to use Python < 3.12 with '
-                               'distutils.version present'), exc)
+        raise ImportError(f'To use this plugin or module with ansible-core'
+                          f' < 2.11, you need to use Python < 3.12 with '
+                          f'distutils.version present. {exc}')
 import importlib
 import os
 
 from ansible.module_utils.basic import AnsibleModule
 
 OVERRIDES = {}
-
 CUSTOM_VAR_PARAMS = ['min_ver', 'max_ver']
 
-MINIMUM_SDK_VERSION = '1.0.0'
-MAXIMUM_SDK_VERSION = None
-
-
-def ensure_compatibility(version, min_version=None, max_version=None):
-    """ Raises ImportError if the specified version does not
-        meet the minimum and maximum version requirements"""
-
-    if min_version and MINIMUM_SDK_VERSION:
-        min_version = max(StrictVersion(MINIMUM_SDK_VERSION),
-                          StrictVersion(min_version))
-    elif MINIMUM_SDK_VERSION:
-        min_version = StrictVersion(MINIMUM_SDK_VERSION)
-
-    if max_version and MAXIMUM_SDK_VERSION:
-        max_version = min(StrictVersion(MAXIMUM_SDK_VERSION),
-                          StrictVersion(max_version))
-    elif MAXIMUM_SDK_VERSION:
-        max_version = StrictVersion(MAXIMUM_SDK_VERSION)
-
-    if min_version and StrictVersion(version) < min_version:
-        raise ImportError(
-            "Version MUST be >={min_version} and <={max_version}, but"
-            " {version} is smaller than minimum version {min_version}"
-            .format(version=version,
-                    min_version=min_version,
-                    max_version=max_version))
-
-    if max_version and StrictVersion(version) > max_version:
-        raise ImportError(
-            "Version MUST be >={min_version} and <={max_version}, but"
-            " {version} is larger than maximum version {max_version}"
-            .format(version=version,
-                    min_version=min_version,
-                    max_version=max_version))
-
 
 def openstack_argument_spec():
     # DEPRECATED: This argument spec is only used for the deprecated old
@@ -165,14 +127,6 @@ def openstack_cloud_from_module(module, min_version=None, max_version=None):
     except ImportError:
         module.fail_json(msg='openstacksdk is required for this module')
 
-    try:
-        ensure_compatibility(sdk.version.__version__,
-                             min_version, max_version)
-    except ImportError as e:
-        module.fail_json(
-            msg="Incompatible openstacksdk library found: {error}."
-                .format(error=str(e)))
-
     cloud_config = module.params.pop('cloud', None)
     try:
         if isinstance(cloud_config, dict):
@@ -183,7 +137,7 @@ def openstack_cloud_from_module(module, min_version=None, max_version=None):
                 " excluded.")
             for param in (
                     'auth', 'region_name', 'validate_certs',
-                    'ca_cert', 'client_key', 'api_timeout', 'auth_type'):
+                    'ca_cert', 'client_cert', 'client_key', 'api_timeout', 'auth_type'):
                 if module.params[param] is not None:
                     module.fail_json(msg=fail_message.format(param=param))
             # For 'interface' parameter, fail if we receive a non-default value
@@ -199,6 +153,7 @@ def openstack_cloud_from_module(module, min_version=None, max_version=None):
                 verify=module.params['validate_certs'],
                 cacert=module.params['ca_cert'],
                 key=module.params['client_key'],
+                cert=module.params['client_cert'],
                 api_timeout=module.params['api_timeout'],
                 interface=module.params['interface'],
             )
@@ -244,8 +199,6 @@ class OpenStackModule:
     deprecated_names = ()
     argument_spec = {}
     module_kwargs = {}
-    module_min_sdk_version = None
-    module_max_sdk_version = None
 
     def __init__(self):
         """Initialize Openstack base class.
@@ -314,19 +267,9 @@ class OpenStackModule:
         try:
             # Due to the name shadowing we should import other way
             sdk = importlib.import_module('openstack')
-            self.sdk_version = sdk.version.__version__
         except ImportError:
             self.fail_json(msg='openstacksdk is required for this module')
 
-        try:
-            ensure_compatibility(self.sdk_version,
-                                 self.module_min_sdk_version,
-                                 self.module_max_sdk_version)
-        except ImportError as e:
-            self.fail_json(
-                msg="Incompatible openstacksdk library found: {error}."
-                    .format(error=str(e)))
-
         # Fail if there are set unsupported for this version parameters
         # New parameters should NOT use 'default' but rely on SDK defaults
         for param in self.argument_spec:
@@ -358,7 +301,7 @@ class OpenStackModule:
                 " excluded.")
             for param in (
                     'auth', 'region_name', 'validate_certs',
-                    'ca_cert', 'client_key', 'api_timeout', 'auth_type'):
+                    'ca_cert', 'client_cert', 'client_key', 'api_timeout', 'auth_type'):
                 if self.params[param] is not None:
                     self.fail_json(msg=fail_message.format(param=param))
             # For 'interface' parameter, fail if we receive a non-default value
@@ -373,6 +316,7 @@ class OpenStackModule:
                 verify=self.params['validate_certs'],
                 cacert=self.params['ca_cert'],
                 key=self.params['client_key'],
+                cert=self.params['client_cert'],
                 api_timeout=self.params['api_timeout'],
                 interface=self.params['interface'],
             )

plugins/modules/address_scope.py

@@ -40,7 +40,7 @@ options:
      description:
         - Whether this address scope is shared or not.
      type: bool
-     default: 'no'
+     default: 'false'
      aliases: ['shared']
    extra_specs:
      description:

plugins/modules/application_credential.py

@@ -0,0 +1,332 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2024 Red Hat, Inc.
+# GNU General Public License v3.0+
+# (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+DOCUMENTATION = r"""
+---
+module: application_credential
+short_description: Manage OpenStack Identity (Keystone) application credentials
+author: OpenStack Ansible SIG
+description:
+  - Create or delete an OpenStack Identity (Keystone) application credential.
+  - When the secret parameter is not set a secret will be generated and returned
+  - in the response. Existing credentials cannot be modified so running this module
+  - against an existing credential will result in it being deleted and recreated.
+  - This needs to be taken into account when the secret is generated, as the secret
+  - will change on each run of the module.
+options:
+  name:
+    description:
+      - Name of the application credential.
+    required: true
+    type: str
+  description:
+    description:
+      - Application credential description.
+    type: str
+  secret:
+    description:
+      - Secret to use for authentication
+      - (if not provided, one will be generated).
+    type: str
+  roles:
+    description:
+      - Roles to authorize (name or ID).
+    type: list
+    elements: dict
+    suboptions:
+      name:
+        description: Name of role
+        type: str
+      id:
+        description: ID of role
+        type: str
+      domain_id:
+        description: Domain ID
+        type: str
+  expires_at:
+    description:
+      - Sets an expiration date for the application credential,
+      - format of YYYY-mm-ddTHH:MM:SS
+      - (if not provided, the application credential will not expire).
+    type: str
+  unrestricted:
+    description:
+      - Enable application credential to create and delete other application
+      - credentials and trusts (this is potentially dangerous behavior and is
+      - disabled by default).
+    default: false
+    type: bool
+  access_rules:
+    description:
+      - List of access rules, each containing a request method, path, and service.
+    type: list
+    elements: dict
+    suboptions:
+      service:
+        description: Name of service endpoint
+        type: str
+        required: true
+      path:
+        description: Path portion of access URL
+        type: str
+        required: true
+      method:
+        description: HTTP method
+        type: str
+        required: true
+  state:
+    description:
+      - Should the resource be present or absent.
+      - Application credentials are immutable so running with an existing present
+      - credential will result in the credential being deleted and recreated.
+    choices: [present, absent]
+    default: present
+    type: str
+extends_documentation_fragment:
+  - openstack.cloud.openstack
+"""
+
+EXAMPLES = r"""
+- name: Create application credential
+  openstack.cloud.application_credential:
+    cloud: mycloud
+    description: demodescription
+    name: democreds
+    state: present
+
+- name: Create application credential with expiration, access rules and roles
+  openstack.cloud.application_credential:
+    cloud: mycloud
+    description: demodescription
+    name: democreds
+    access_rules:
+    - service: "compute"
+      path: "/v2.1/servers"
+      method: "GET"
+    expires_at: "2024-02-29T09:29:59"
+    roles:
+    - name: Member
+    state: present
+
+- name: Delete application credential
+  openstack.cloud.application_credential:
+    cloud: mycloud
+    name: democreds
+    state: absent
+"""
+
+RETURN = r"""
+application_credential:
+  description: Dictionary describing the project.
+  returned: On success when I(state) is C(present).
+  type: dict
+  contains:
+    id:
+      description: The ID of the application credential.
+      type: str
+      sample: "2e73d1b4f0cb473f920bd54dfce3c26d"
+    name:
+      description: The name of the application credential.
+      type: str
+      sample: "appcreds"
+    secret:
+      description: Secret to use for authentication
+                   (if not provided, returns the generated value).
+      type: str
+      sample: "JxE7LajLY75NZgDH1hfu0N_6xS9hQ-Af40W3"
+    description:
+      description: A description of the application credential's purpose.
+      type: str
+      sample: "App credential"
+    expires_at:
+      description: The expiration time of the application credential in UTC,
+                   if one was specified.
+      type: str
+      sample: "2024-02-29T09:29:59.000000"
+    project_id:
+      description: The ID of the project the application credential was created
+                   for and that authentication requests using this application
+                   credential will be scoped to.
+      type: str
+      sample: "4b633c451ac74233be3721a3635275e5"
+    roles:
+      description: A list of one or more roles that this application credential
+                   has associated with its project. A token using this application
+                   credential will have these same roles.
+      type: list
+      elements: dict
+      sample: [{"name": "Member"}]
+    access_rules:
+      description: A list of access_rules objects
+      type: list
+      elements: dict
+      sample:
+      - id: "edecb6c791d541a3b458199858470d20"
+        service: "compute"
+        path: "/v2.1/servers"
+        method: "GET"
+    unrestricted:
+      description: A flag indicating whether the application credential may be
+                   used for creation or destruction of other application credentials
+                   or trusts.
+      type: bool
+cloud:
+  description: The current cloud config with the username and password replaced
+               with the name and secret of the application credential. This
+               can be passed to the cloud parameter of other tasks, or written
+               to an openstack cloud config file.
+  returned: On success when I(state) is C(present).
+  type: dict
+  sample:
+    auth_type: "v3applicationcredential"
+    auth:
+      auth_url: "https://192.0.2.1/identity"
+      application_credential_secret: "JxE7LajLY75NZgDH1hfu0N_6xS9hQ-Af40W3"
+      application_credential_id: "3e73d1b4f0cb473f920bd54dfce3c26d"
+"""
+
+import copy
+
+from ansible_collections.openstack.cloud.plugins.module_utils.openstack import (
+    OpenStackModule,
+)
+
+try:
+    import openstack.config
+except ImportError:
+    pass
+
+
+class IdentityApplicationCredentialModule(OpenStackModule):
+    argument_spec = dict(
+        name=dict(required=True),
+        description=dict(),
+        secret=dict(no_log=True),
+        roles=dict(
+            type="list",
+            elements="dict",
+            options=dict(name=dict(), id=dict(), domain_id=dict()),
+        ),
+        expires_at=dict(),
+        unrestricted=dict(type="bool", default=False),
+        access_rules=dict(
+            type="list",
+            elements="dict",
+            options=dict(
+                service=dict(required=True),
+                path=dict(required=True),
+                method=dict(required=True),
+            ),
+        ),
+        state=dict(default="present", choices=["absent", "present"]),
+    )
+    module_kwargs = dict()
+    cloud = None
+
+    def openstack_cloud_from_module(self):
+        # Fetch cloud param before it is popped
+        self.cloud = self.params["cloud"]
+        return OpenStackModule.openstack_cloud_from_module(self)
+
+    def run(self):
+        state = self.params["state"]
+
+        creds = self._find()
+
+        if state == "present" and not creds:
+            # Create creds
+            creds = self._create().to_dict(computed=False)
+            cloud_config = self._get_cloud_config(creds)
+            self.exit_json(
+                changed=True, application_credential=creds, cloud=cloud_config
+            )
+
+        elif state == "present" and creds:
+            # Recreate immutable creds
+            self._delete(creds)
+            creds = self._create().to_dict(computed=False)
+            cloud_config = self._get_cloud_config(creds)
+            self.exit_json(
+                changed=True, application_credential=creds, cloud=cloud_config
+            )
+
+        elif state == "absent" and creds:
+            # Delete creds
+            self._delete(creds)
+            self.exit_json(changed=True)
+
+        elif state == "absent" and not creds:
+            # Do nothing
+            self.exit_json(changed=False)
+
+    def _get_user_id(self):
+        return self.conn.session.get_user_id()
+
+    def _create(self):
+        kwargs = dict(
+            (k, self.params[k])
+            for k in [
+                "name",
+                "description",
+                "secret",
+                "expires_at",
+                "unrestricted",
+                "access_rules",
+            ]
+            if self.params[k] is not None
+        )
+
+        roles = self.params["roles"]
+        if roles:
+            kwroles = []
+            for role in roles:
+                kwroles.append(
+                    dict(
+                        (k, role[k])
+                        for k in ["name", "id", "domain_id"]
+                        if role[k] is not None
+                    )
+                )
+            kwargs["roles"] = kwroles
+
+        kwargs["user"] = self._get_user_id()
+        creds = self.conn.identity.create_application_credential(**kwargs)
+        return creds
+
+    def _get_cloud_config(self, creds):
+        cloud_region = openstack.config.OpenStackConfig().get_one(self.cloud)
+
+        conf = cloud_region.config
+        cloud_config = copy.deepcopy(conf)
+        cloud_config["auth_type"] = "v3applicationcredential"
+        cloud_config["auth"] = {
+            "application_credential_id": creds["id"],
+            "application_credential_secret": creds["secret"],
+            "auth_url": conf["auth"]["auth_url"],
+        }
+
+        return cloud_config
+
+    def _delete(self, creds):
+        user = self._get_user_id()
+        self.conn.identity.delete_application_credential(user, creds.id)
+
+    def _find(self):
+        name = self.params["name"]
+        user = self._get_user_id()
+        return self.conn.identity.find_application_credential(
+            user=user, name_or_id=name
+        )
+
+
+def main():
+    module = IdentityApplicationCredentialModule()
+    module()
+
+
+if __name__ == "__main__":
+    main()

plugins/modules/baremetal_deploy_template.py

@@ -0,0 +1,198 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2023 StackHPC Ltd.
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+DOCUMENTATION = r'''
+module: baremetal_deploy_template
+short_description: Create/Delete Bare Metal deploy template Resources from OpenStack
+author: OpenStack Ansible SIG
+description:
+    - Create, Update and Remove ironic deploy templates from OpenStack.
+options:
+    extra:
+      description:
+        - A set of one or more arbitrary metadata key and value pairs.
+      type: dict
+    id:
+      description:
+        - ID of the deploy template.
+        - Will be auto-generated if not specified.
+      type: str
+      aliases: ['uuid']
+    name:
+      description:
+        - Name of the deploy template.
+        - Must be formatted as a trait name (see API reference).
+        - Required when the deploy template is created, after which the
+          name or ID may be used.
+      type: str
+    steps:
+      description:
+        - List of deploy steps to apply.
+        - Required when the deploy template is created.
+      type: list
+      elements: dict
+    state:
+      description:
+        - Indicates desired state of the resource
+      choices: ['present', 'absent']
+      default: present
+      type: str
+extends_documentation_fragment:
+- openstack.cloud.openstack
+'''
+
+EXAMPLES = r'''
+- name: Create Bare Metal deploy template
+  openstack.cloud.baremetal_deploy_template:
+    cloud: devstack
+    state: present
+    name: CUSTOM_FOO
+    steps:
+      - interface: bios
+        step: apply_configuration
+        args:
+          settings:
+            - name: LogicalProc
+              value: Enabled
+        priority: 110
+    extra:
+      something: extra
+  register: result
+
+- name: Delete Bare Metal deploy template
+  openstack.cloud.baremetal_deploy_template:
+    cloud: devstack
+    state: absent
+    id: 1a85ebca-22bf-42eb-ad9e-f640789b8098
+  register: result
+
+- name: Update Bare Metal deploy template
+  openstack.cloud.baremetal_deploy_template:
+    cloud: devstack
+    state: present
+    id: 1a85ebca-22bf-42eb-ad9e-f640789b8098
+    extra:
+      something: new
+'''
+
+RETURN = r'''
+template:
+    description: A deploy template dictionary, subset of the dictionary keys
+                 listed below may be returned, depending on your cloud
+                 provider.
+    returned: success
+    type: dict
+    contains:
+        created_at:
+            description: Bare Metal deploy template created at timestamp.
+            returned: success
+            type: str
+        extra:
+            description: A set of one or more arbitrary metadata key and value
+                         pairs.
+            returned: success
+            type: dict
+        id:
+            description: The UUID for the Baremetal Deploy Template resource.
+            returned: success
+            type: str
+        links:
+            description: A list of relative links, including the self and
+                         bookmark links.
+            returned: success
+            type: list
+        location:
+            description: Cloud location of this resource (cloud, project,
+                         region, zone)
+            returned: success
+            type: dict
+        name:
+            description: Bare Metal deploy template name.
+            returned: success
+            type: str
+        steps:
+            description: A list of deploy steps.
+            returned: success
+            type: list
+            elements: dict
+        updated_at:
+            description: Bare Metal deploy template updated at timestamp.
+            returned: success
+            type: str
+'''
+
+from ansible_collections.openstack.cloud.plugins.module_utils.openstack import (
+    OpenStackModule
+)
+
+
+class BaremetalDeployTemplateModule(OpenStackModule):
+    argument_spec = dict(
+        extra=dict(type='dict'),
+        id=dict(aliases=['uuid']),
+        name=dict(),
+        steps=dict(type='list', elements='dict'),
+        state=dict(default='present', choices=['present', 'absent']),
+    )
+
+    module_kwargs = dict(
+        required_one_of=[
+            ('id', 'name'),
+        ],
+    )
+
+    def run(self):
+        template = self._find_deploy_template()
+        state = self.params['state']
+        if state == 'present':
+            # create or update deploy template
+
+            kwargs = {}
+            for k in ['extra', 'id', 'name', 'steps']:
+                if self.params[k] is not None:
+                    kwargs[k] = self.params[k]
+
+            changed = True
+            if not template:
+                # create deploy template
+                template = self.conn.baremetal.create_deploy_template(**kwargs)
+            else:
+                # update deploy template
+                updates = dict((k, v)
+                               for k, v in kwargs.items()
+                               if v != template[k])
+
+                if updates:
+                    template = \
+                        self.conn.baremetal.update_deploy_template(template['id'], **updates)
+                else:
+                    changed = False
+
+            self.exit_json(changed=changed, template=template.to_dict(computed=False))
+
+        if state == 'absent':
+            # remove deploy template
+            if not template:
+                self.exit_json(changed=False)
+
+            template = self.conn.baremetal.delete_deploy_template(template['id'])
+            self.exit_json(changed=True)
+
+    def _find_deploy_template(self):
+        id_or_name = self.params['id'] if self.params['id'] else self.params['name']
+        try:
+            return self.conn.baremetal.get_deploy_template(id_or_name)
+        except self.sdk.exceptions.ResourceNotFound:
+            return None
+
+
+def main():
+    module = BaremetalDeployTemplateModule()
+    module()
+
+
+if __name__ == "__main__":
+    main()

plugins/modules/baremetal_inspect.py

@@ -243,6 +243,10 @@ node:
     retired_reason:
       description: TODO
       type: str
+    shard:
+      description: The shard key for a node.
+      returned: success
+      type: str
     states:
       description: |
         Links to the collection of states. Note that this resource is also

plugins/modules/baremetal_node.py

@@ -437,6 +437,10 @@ node:
             description: The reason the node is marked as retired.
             returned: success
             type: str
+        shard:
+            description: The shard key for a node.
+            returned: success
+            type: str
         states:
             description: Links to the collection of states.
             returned: success

plugins/modules/baremetal_node_action.py

@@ -93,10 +93,10 @@ EXAMPLES = r'''
       image_checksum: "356a6b55ecc511a20c33c946c4e678af"
       image_disk_format: "qcow"
     delegate_to: localhost
-    deploy: yes
+    deploy: true
     cloud: "openstack"
     config_drive: "http://192.168.1.1/host-configdrive.iso"
-    maintenance: no
+    maintenance: false
     power: present
     uuid: "d44666e1-35b3-4f6b-acb0-88ab7052da69"
     state: present

plugins/modules/baremetal_node_info.py

@@ -289,6 +289,10 @@ nodes:
             description: The reason the node is marked as retired.
             returned: success
             type: str
+        shard:
+            description: The shard key for a node.
+            returned: success
+            type: str
         states:
             description: Links to the collection of states.
             returned: success

plugins/modules/baremetal_port_group.py

@@ -0,0 +1,258 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2026 OpenStack Ansible SIG
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+DOCUMENTATION = r'''
+module: baremetal_port_group
+short_description: Create/Delete Bare Metal port group resources from OpenStack
+author: OpenStack Ansible SIG
+description:
+    - Create, update and remove Bare Metal port groups from OpenStack.
+options:
+    id:
+      description:
+        - ID of the port group.
+        - Will be auto-generated if not specified.
+      type: str
+      aliases: ['uuid']
+    name:
+      description:
+        - Name of the port group.
+      type: str
+    node:
+      description:
+        - ID or Name of the node this resource belongs to.
+        - Required when creating a new port group.
+      type: str
+    address:
+      description:
+        - Physical hardware address of this port group, typically the hardware
+          MAC address.
+      type: str
+    extra:
+      description:
+        - A set of one or more arbitrary metadata key and value pairs.
+      type: dict
+    standalone_ports_supported:
+      description:
+        - Whether the port group supports ports that are not members of this
+          port group.
+      type: bool
+    mode:
+      description:
+        - The port group mode.
+      type: str
+    properties:
+      description:
+        - Key/value properties for the port group.
+      type: dict
+    state:
+      description:
+        - Indicates desired state of the resource.
+      choices: ['present', 'absent']
+      default: present
+      type: str
+version_added: 2.6.0
+extends_documentation_fragment:
+- openstack.cloud.openstack
+'''
+
+EXAMPLES = r'''
+- name: Create Bare Metal port group
+  openstack.cloud.baremetal_port_group:
+    cloud: devstack
+    state: present
+    name: bond0
+    node: bm-0
+    address: fa:16:3e:aa:aa:aa
+    mode: '802.3ad'
+    standalone_ports_supported: true
+  register: result
+
+- name: Update Bare Metal port group
+  openstack.cloud.baremetal_port_group:
+    cloud: devstack
+    state: present
+    id: 1a85ebca-22bf-42eb-ad9e-f640789b8098
+    mode: 'active-backup'
+    properties:
+      miimon: '100'
+  register: result
+
+- name: Delete Bare Metal port group
+  openstack.cloud.baremetal_port_group:
+    cloud: devstack
+    state: absent
+    id: 1a85ebca-22bf-42eb-ad9e-f640789b8098
+  register: result
+'''
+
+RETURN = r'''
+port_group:
+    description: A port group dictionary, subset of the dictionary keys listed
+                 below may be returned, depending on your cloud provider.
+    returned: success
+    type: dict
+    contains:
+        address:
+            description: Physical hardware address of the port group.
+            returned: success
+            type: str
+        created_at:
+            description: Bare Metal port group created at timestamp.
+            returned: success
+            type: str
+        extra:
+            description: A set of one or more arbitrary metadata key and value
+                         pairs.
+            returned: success
+            type: dict
+        id:
+            description: The UUID for the Bare Metal port group resource.
+            returned: success
+            type: str
+        links:
+            description: A list of relative links, including the self and
+                         bookmark links.
+            returned: success
+            type: list
+        mode:
+            description: The port group mode.
+            returned: success
+            type: str
+        name:
+            description: Bare Metal port group name.
+            returned: success
+            type: str
+        node_id:
+            description: UUID of the Bare Metal node this resource belongs to.
+            returned: success
+            type: str
+        properties:
+            description: Key/value properties for this port group.
+            returned: success
+            type: dict
+        standalone_ports_supported:
+            description: Whether standalone ports are supported.
+            returned: success
+            type: bool
+        updated_at:
+            description: Bare Metal port group updated at timestamp.
+            returned: success
+            type: str
+'''
+
+from ansible_collections.openstack.cloud.plugins.module_utils.openstack import (
+    OpenStackModule
+)
+
+
+class BaremetalPortGroupModule(OpenStackModule):
+    argument_spec = dict(
+        id=dict(aliases=['uuid']),
+        name=dict(),
+        node=dict(),
+        address=dict(),
+        extra=dict(type='dict'),
+        standalone_ports_supported=dict(type='bool'),
+        mode=dict(),
+        properties=dict(type='dict'),
+        state=dict(default='present', choices=['present', 'absent']),
+    )
+
+    module_kwargs = dict(
+        required_one_of=[
+            ('id', 'name'),
+        ],
+        supports_check_mode=True,
+    )
+
+    def _find_port_group(self):
+        id_or_name = self.params['id'] if self.params['id'] else self.params['name']
+        if not id_or_name:
+            return None
+
+        try:
+            return self.conn.baremetal.find_port_group(id_or_name)
+        except self.sdk.exceptions.ResourceNotFound:
+            return None
+
+    def _build_create_attrs(self):
+        attrs = {}
+
+        for key in ['id', 'name', 'address', 'extra',
+                    'standalone_ports_supported', 'mode', 'properties']:
+            if self.params[key] is not None:
+                attrs[key] = self.params[key]
+
+        node_name_or_id = self.params['node']
+        if not node_name_or_id:
+            self.fail_json(msg="Parameter 'node' is required when creating a new port group")
+
+        node = self.conn.baremetal.find_node(node_name_or_id, ignore_missing=False)
+        attrs['node_id'] = node['id']
+        return attrs
+
+    def _build_update_attrs(self, port_group):
+        attrs = {}
+
+        for key in ['name', 'address', 'extra',
+                    'standalone_ports_supported', 'mode', 'properties']:
+            if self.params[key] is not None and self.params[key] != port_group.get(key):
+                attrs[key] = self.params[key]
+
+        return attrs
+
+    def _will_change(self, port_group, state):
+        if state == 'absent':
+            return bool(port_group)
+
+        if not port_group:
+            return True
+
+        return bool(self._build_update_attrs(port_group))
+
+    def run(self):
+        state = self.params['state']
+        port_group = self._find_port_group()
+
+        if self.ansible.check_mode:
+            if state == 'present' and not port_group:
+                self._build_create_attrs()
+            self.exit_json(changed=self._will_change(port_group, state))
+
+        if state == 'present':
+            if not port_group:
+                port_group = self.conn.baremetal.create_port_group(
+                    **self._build_create_attrs())
+                self.exit_json(
+                    changed=True,
+                    port_group=port_group.to_dict(computed=False))
+
+            update_attrs = self._build_update_attrs(port_group)
+            changed = bool(update_attrs)
+
+            if changed:
+                port_group = self.conn.baremetal.update_port_group(
+                    port_group['id'], **update_attrs)
+
+            self.exit_json(
+                changed=changed,
+                port_group=port_group.to_dict(computed=False))
+
+        if not port_group:
+            self.exit_json(changed=False)
+
+        self.conn.baremetal.delete_port_group(port_group['id'])
+        self.exit_json(changed=True)
+
+
+def main():
+    module = BaremetalPortGroupModule()
+    module()
+
+
+if __name__ == "__main__":
+    main()

plugins/modules/coe_cluster_template.py

@@ -80,6 +80,10 @@ options:
       - Magnum's default value for I(is_registry_enabled) is C(false).
     type: bool
     aliases: ['registry_enabled']
+  insecure_registry:
+    description:
+      - The URL pointing to users own private insecure docker registry.
+    type: str
   is_tls_disabled:
     description:
       - Indicates whether the TLS should be disabled.
@@ -317,7 +321,7 @@ EXAMPLES = r'''
     image_id: 2a8c9888-9054-4b06-a1ca-2bb61f9adb72
     keypair_id: mykey
     name: k8s
-    is_public: no
+    is_public: false
 '''
 
 from ansible_collections.openstack.cloud.plugins.module_utils.openstack import OpenStackModule
@@ -342,6 +346,7 @@ class COEClusterTemplateModule(OpenStackModule):
         keypair_id=dict(),
         labels=dict(type='raw'),
         master_flavor_id=dict(),
+        insecure_registry=dict(),
         is_master_lb_enabled=dict(type='bool', default=False,
                                   aliases=['master_lb_enabled']),
         is_public=dict(type='bool', aliases=['public']),
@@ -412,6 +417,7 @@ class COEClusterTemplateModule(OpenStackModule):
                                            'fixed_subnet', 'flavor_id',
                                            'http_proxy', 'https_proxy',
                                            'image_id',
+                                           'insecure_registry',
                                            'is_floating_ip_enabled',
                                            'is_master_lb_enabled',
                                            'is_public', 'is_registry_enabled',
@@ -427,6 +433,9 @@ class COEClusterTemplateModule(OpenStackModule):
             if isinstance(labels, str):
                 labels = dict([tuple(kv.split(":"))
                                for kv in labels.split(",")])
+            elif isinstance(labels, dict):
+                labels = dict({str(k): str(v)
+                               for k, v in labels.items()})
             if labels != cluster_template['labels']:
                 non_updateable_keys.append('labels')
 
@@ -458,7 +467,7 @@ class COEClusterTemplateModule(OpenStackModule):
                                 'external_network_id', 'fixed_network',
                                 'fixed_subnet', 'flavor_id', 'http_proxy',
                                 'https_proxy', 'image_id',
-                                'is_floating_ip_enabled',
+                                'insecure_registry', 'is_floating_ip_enabled',
                                 'is_master_lb_enabled', 'is_public',
                                 'is_registry_enabled', 'is_tls_disabled',
                                 'keypair_id', 'master_flavor_id', 'name',

plugins/modules/compute_flavor_access.py

@@ -34,7 +34,7 @@ options:
     type: str
     choices: ['present', 'absent']
 notes:
-    - A compute flavor must not be private to manage project access.
+    - A compute flavor must be private to manage project access.
 extends_documentation_fragment:
 - openstack.cloud.openstack
 '''

plugins/modules/compute_service.py

@@ -0,0 +1,152 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2025 Boehringer Ingelheim
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+DOCUMENTATION = r'''
+---
+module: compute_service
+short_description: Update OpenStack Compute (Nova) services
+author: OpenStack Ansible SIG
+description:
+  - Update OpenStack Compute (Nova) service properties.
+options:
+  host:
+    description:
+      - Compute host name
+    type: str
+    required: true
+  binary:
+    description:
+      - Binary name of the service (e.g. C(nova-compute)).
+    type: str
+    required: true
+  status:
+    description:
+      - Desired status of the service.
+    type: str
+    choices: ['enabled', 'disabled']
+    default: enabled
+  disabled_reason:
+    description:
+      - Reason for disabling the service. Should be used with state `disabled`.
+    type: str
+version_added: 2.6.0
+extends_documentation_fragment:
+  - openstack.cloud.openstack
+'''
+
+EXAMPLES = r'''
+- name: Disable nova-compute on node1
+  openstack.cloud.compute_service:
+    cloud: awesomecloud
+    host: node1
+    binary: nova-compute
+    status: disabled
+
+- name: Enable nova-compute on node1
+  openstack.cloud.compute_service:
+    cloud: awesomecloud
+    host: node1
+    binary: nova-compute
+    status: enabled
+'''
+
+RETURN = r'''
+compute_services:
+  description: List of dictionaries describing Compute (Nova) services.
+  returned: always
+  type: list
+  elements: dict
+  contains:
+    availability_zone:
+      description: The availability zone name.
+      type: str
+    binary:
+      description: The binary name of the service.
+      type: str
+    disabled_reason:
+      description: The reason why the service is disabled
+      type: str
+    id:
+      description: Unique UUID.
+      type: str
+    is_forced_down:
+      description: If the service has been forced down or nova-compute
+      type: bool
+    host:
+      description: The name of the host.
+      type: str
+    name:
+      description: Service name
+      type: str
+    state:
+      description: The state of the service. One of up or down.
+      type: str
+    status:
+      description: The status of the service. One of enabled or disabled.
+      type: str
+    update_at:
+      description: The date and time when the resource was updated
+      type: str
+'''
+
+from ansible_collections.openstack.cloud.plugins.module_utils.openstack import OpenStackModule
+
+
+class ComputeServiceModule(OpenStackModule):
+    argument_spec = dict(
+        host=dict(required=True),
+        binary=dict(required=True),
+        status=dict(default="enabled", choices=['enabled', 'disabled']),
+        disabled_reason=dict(default=None)
+    )
+
+    module_kwargs = dict(
+        supports_check_mode=True
+    )
+
+    def run(self):
+        changed = False
+
+        kwargs = {k: self.params[k]
+                  for k in ['binary', 'host']
+                  if self.params[k] is not None}
+
+        # retrieve current state of service(s)
+        compute_services = self.conn.compute.services(**kwargs)
+
+        # extract desired status
+        desired_status = self.params['status']
+        disabled_reason = self.params['disabled_reason']
+
+        # apply updates to diverging status
+        for service in compute_services:
+
+            current_status = service.status
+
+            if current_status != desired_status:
+                changed = True
+                if not self.check_mode:
+
+                    if desired_status == 'disabled':
+                        self.conn.compute.disable_service(service=service, host=service.host, binary=service.binary, disabled_reason=disabled_reason)
+                    else:
+                        self.conn.compute.enable_service(service=service, host=service.host, binary=service.binary)
+
+        # retrieve final state of the service(s)
+        compute_services = self.conn.compute.services(**kwargs)
+
+        self.exit_json(changed=changed,
+                       compute_services=[s.to_dict(computed=False)
+                                         for s in compute_services],)
+
+
+def main():
+    module = ComputeServiceModule()
+    module()
+
+
+if __name__ == '__main__':
+    main()

plugins/modules/dns_zone_info.py

@@ -41,11 +41,11 @@ extends_documentation_fragment:
 
 EXAMPLES = r'''
 - name: Fetch all DNS zones
-  openstack.cloud.dns_zones:
+  openstack.cloud.dns_zone_info:
     cloud: devstack
 
 - name: Fetch DNS zones by name
-  openstack.cloud.dns_zones:
+  openstack.cloud.dns_zone_info:
     cloud: devstack
     name: ansible.test.zone.
 '''