New netgroup management module

There is a new netgroup management module placed in the plugins folder:

    plugins/modules/ipanetgroup.py

The netgroup module allows to ensure presence or absence of netgroup
and manage netgroup members.

Here is the documentation for the module:

    README-netgroup.md

New example playbooks have been added:

    playbooks/netgroup/netgroup-absent.yml
    playbooks/netgroup/netgroup-member-absent.yml
    playbooks/netgroup/netgroup-member-present.yml
    playbooks/netgroup/netgroup-present.yml

New tests for the module:

    tests/netgroup/test_netgroup.yml
    tests/netgroup/test_netgroup_client_context.yml
    tests/netgroup/test_netgroup_member.yml
    tests/netgroup/test_netgroup_member_absent.yml
    tests/netgroup/test_netgroup_member_case_insensitive.yml

Signed-off-by: Denis Karpelevich <dkarpele@redhat.com>

tests/netgroup/test_netgroup.yml

@@ -0,0 +1,149 @@
+---
+- name: Test netgroup
+  hosts: "{{ ipa_test_host | default('ipaserver') }}"
+  become: no
+  gather_facts: no
+
+  tasks:
+  - block:
+    # CLEANUP TEST ITEMS
+    - name: Ensure netgroups are absent
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name:
+          - my_netgroup1
+          - my_netgroup2
+          - my_netgroup3
+        state: absent
+
+    # CREATE TEST ITEMS
+    - name: Get Domain from server name
+      set_fact:
+        ipaserver_domain: "{{ ansible_facts['fqdn'].split('.')[1:] | join ('.') }}"
+      when: ipaserver_domain is not defined
+
+    - name: Ensure netgroup my_netgroup2 is present
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name: my_netgroup2
+
+    - name: Ensure netgroup my_netgroup3 is present
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name: my_netgroup3
+
+    # TESTS
+
+    - name: Ensure netgroup my_netgroup1 is present
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name: my_netgroup1
+      register: result
+      failed_when: not result.changed or result.failed
+
+    - name: Ensure netgroup my_netgroup1 is present again
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name: my_netgroup1
+      register: result
+      failed_when: result.changed or result.failed
+
+    - name: Ensure netgroup my_netgroup1 is present with description and
+        nisdomain
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name: my_netgroup1
+        description: My netgroup 1
+        nisdomain: domain.test
+      register: result
+      failed_when: not result.changed or result.failed
+
+    - name: Ensure netgroup my_netgroup1 is present with new description
+        and new nisdomain
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name: my_netgroup1
+        description: New description
+        nisdomain: new-domain.test
+      register: result
+      failed_when: not result.changed or result.failed
+
+    - name: Ensure netgroup my_netgroup1 is present with description and
+        nisdomain again
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name: my_netgroup1
+        description: New description
+        nisdomain: new-domain.test
+      register: result
+      failed_when: result.changed or result.failed
+
+    - name: Ensure 2 netgroups aren't present
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name:
+          - my_netgroup1
+          - my_netgroup2
+      register: result
+      failed_when: result.changed or not result.failed or
+        "Only one netgroup can be added at a time." not in result.msg
+
+    - name: Ensure netgroup my_netgroup1 is absent
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name: my_netgroup1
+        state: absent
+      register: result
+      failed_when: not result.changed or result.failed
+
+    - name: Ensure netgroup my_netgroup1 is absent again
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name: my_netgroup1
+        state: absent
+      register: result
+      failed_when: result.changed or result.failed
+
+    # netgroup and hostgroup with the same name are deprecated
+    - name: Ensure hostgroup my_netgroup2 isn't present
+      ipahostgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name: my_netgroup2
+      register: result
+      failed_when: result.changed or not result.failed or
+        "Hostgroups and netgroups share a common namespace" not in result.msg
+
+    - name: Ensure netgroups my_netgroup2, my_netgroup3 are absent
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name:
+          - my_netgroup2
+          - my_netgroup3
+        state: absent
+      register: result
+      failed_when: not result.changed
+
+    always:
+    # cleanup
+    - name: Ensure netgroups are absent
+      ipanetgroup:
+        ipaadmin_password: SomeADMINpassword
+        ipaapi_context: "{{ ipa_context | default(omit) }}"
+        name:
+          - my_netgroup1
+          - my_netgroup2
+          - my_netgroup3
+        state: absent