From 588cd749ac460d559dad4e83c435af0b286e0216 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Moser?= Date: Sun, 4 Feb 2018 19:23:57 +0100 Subject: [PATCH] cs_network: implement support acl (#35706) --- .../modules/cloud/cloudstack/cs_network.py | 114 ++++++- test/integration/targets/cs_network/aliases | 2 + .../targets/cs_network/meta/main.yml | 3 + .../targets/cs_network/tasks/main.yml | 3 + .../cs_network/tasks/vpc_network_tier.yml | 298 ++++++++++++++++++ 5 files changed, 414 insertions(+), 6 deletions(-) create mode 100644 test/integration/targets/cs_network/aliases create mode 100644 test/integration/targets/cs_network/meta/main.yml create mode 100644 test/integration/targets/cs_network/tasks/main.yml create mode 100644 test/integration/targets/cs_network/tasks/vpc_network_tier.yml diff --git a/lib/ansible/modules/cloud/cloudstack/cs_network.py b/lib/ansible/modules/cloud/cloudstack/cs_network.py index 46a1625d1a..f9e1e762b5 100644 --- a/lib/ansible/modules/cloud/cloudstack/cs_network.py +++ b/lib/ansible/modules/cloud/cloudstack/cs_network.py @@ -85,10 +85,14 @@ options: type: bool acl_type: description: - - Access control type. + - Access control type for the VPC network tier. - Only considered on create. default: account choices: [ account, domain ] + acl: + description: + - The name of the access control list for the VPC network tier. + version_added: "2.5" subdomain_access: description: - Defines whether to allow subdomains to use networks dedicated to their parent domain(s). @@ -134,6 +138,17 @@ EXAMPLES = ''' network_offering: DefaultIsolatedNetworkOfferingWithSourceNatService network_domain: example.com +- name: Create a VPC tier + local_action: + module: cs_network + name: my VPC tier 1 + zone: gva-01 + vpc: my VPC + network_offering: DefaultIsolatedNetworkOfferingForVpcNetworks + gateway: 10.43.0.1 + netmask: 255.255.255.0 + acl: my web acl + - name: Update a network local_action: module: cs_network @@ -233,10 +248,22 @@ tags: type: dict sample: '[ { "key": "foo", "value": "bar" } ]' acl_type: - description: Access type of the network (Domain, Account). + description: Access type of the VPC network tier (Domain, Account). returned: success type: string sample: Account +acl: + description: Name of the access control list for the VPC network tier. + returned: success + type: string + sample: My ACL + version_added: "2.5" +acl_id: + description: ID of the access control list for the VPC network tier. + returned: success + type: string + sample: dfafcd55-0510-4b8c-b6c5-b8cedb4cfd88 + version_added: "2.5" broadcast_domain_type: description: Broadcast domain type of the network. returned: success @@ -272,6 +299,30 @@ network_offering: returned: success type: string sample: DefaultIsolatedNetworkOfferingWithSourceNatService +network_offering_display_text: + description: The network offering display text. + returned: success + type: string + sample: Offering for Isolated Vpc networks with Source Nat service enabled + version_added: "2.5" +network_offering_conserve_mode: + description: Whether the network offering has IP conserve mode enabled or not. + returned: success + type: bool + sample: false + version_added: "2.5" +network_offering_availability: + description: The availability of the network offering the network is created from + returned: success + type: string + sample: Optional + version_added: "2.5" +is_system: + description: Whether the network is system related or not. + returned: success + type: bool + sample: false + version_added: "2.5" ''' from ansible.module_utils.basic import AnsibleModule @@ -287,8 +338,13 @@ class AnsibleCloudStackNetwork(AnsibleCloudStack): def __init__(self, module): super(AnsibleCloudStackNetwork, self).__init__(module) self.returns = { - 'networkdomain': 'network domain', + 'networkdomain': 'network_domain', 'networkofferingname': 'network_offering', + 'networkofferingdisplaytext': 'network_offering_display_text', + 'networkofferingconservemode': 'network_offering_conserve_mode', + 'networkofferingavailability': 'network_offering_availability', + 'aclid': 'acl_id', + 'issystem': 'is_system', 'ispersistent': 'is_persistent', 'acltype': 'acl_type', 'type': 'type', @@ -304,6 +360,26 @@ class AnsibleCloudStackNetwork(AnsibleCloudStack): } self.network = None + def get_network_acl(self, key=None, acl_id=None): + if acl_id is not None: + args = { + 'id': acl_id, + 'vpcid': self.get_vpc(key='id'), + } + else: + acl_name = self.module.params.get('acl') + if not acl_name: + return + + args = { + 'name': acl_name, + 'vpcid': self.get_vpc(key='id'), + } + network_acls = self.query_api('listNetworkACLLists', **args) + if network_acls: + acl = network_acls['networkacllist'][0] + return self._get_by_key(key, acl) + def get_network_offering(self, key=None): network_offering = self.module.params.get('network_offering') if not network_offering: @@ -329,24 +405,29 @@ class AnsibleCloudStackNetwork(AnsibleCloudStack): } return args - def get_network(self): - if not self.network: + def get_network(self, refresh=False): + if not self.network or refresh: network = self.module.params.get('name') args = { 'zoneid': self.get_zone(key='id'), 'projectid': self.get_project(key='id'), 'account': self.get_account(key='name'), - 'domainid': self.get_domain(key='id') + 'domainid': self.get_domain(key='id'), + 'vpcid': self.get_vpc(key='id'), } networks = self.query_api('listNetworks', **args) if networks: for n in networks['network']: if network in [n['name'], n['displaytext'], n['id']]: self.network = n + self.network['acl'] = self.get_network_acl(key='name', acl_id=n.get('aclid')) break return self.network def present_network(self): + if self.module.params.get('acl') is not None and self.module.params.get('vpc') is None: + self.module.fail_json(msg="Missing required params: vpc") + network = self.get_network() if not network: network = self.create_network(network) @@ -366,6 +447,19 @@ class AnsibleCloudStackNetwork(AnsibleCloudStack): poll_async = self.module.params.get('poll_async') if network and poll_async: network = self.poll_job(network, 'network') + + # Skip ACL check if the network is not a VPC tier + if network.get('aclid') != self.get_network_acl(key='id'): + self.result['changed'] = True + if not self.module.check_mode: + args = { + 'aclid': self.get_network_acl(key='id'), + 'networkid': network['id'], + } + network = self.query_api('replaceNetworkACLList', **args) + if self.module.params.get('poll_async'): + self.poll_job(network, 'networkacllist') + network = self.get_network(refresh=True) return network def create_network(self, network): @@ -374,6 +468,7 @@ class AnsibleCloudStackNetwork(AnsibleCloudStack): args = self._get_args() args.update({ 'acltype': self.module.params.get('acl_type'), + 'aclid': self.get_network_acl(key='id'), 'zoneid': self.get_zone(key='id'), 'projectid': self.get_project(key='id'), 'account': self.get_account(key='name'), @@ -438,6 +533,12 @@ class AnsibleCloudStackNetwork(AnsibleCloudStack): self.poll_job(res, 'network') return network + def get_result(self, network): + super(AnsibleCloudStackNetwork, self).get_result(network) + if network: + self.result['acl'] = self.get_network_acl(key='name', acl_id=network.get('aclid')) + return self.result + def main(): argument_spec = cs_argument_spec() @@ -461,6 +562,7 @@ def main(): network_domain=dict(), subdomain_access=dict(type='bool'), state=dict(choices=['present', 'absent', 'restarted'], default='present'), + acl=dict(), acl_type=dict(choices=['account', 'domain']), project=dict(), domain=dict(), diff --git a/test/integration/targets/cs_network/aliases b/test/integration/targets/cs_network/aliases new file mode 100644 index 0000000000..ee8454c6d1 --- /dev/null +++ b/test/integration/targets/cs_network/aliases @@ -0,0 +1,2 @@ +cloud/cs +posix/ci/cloud/group1/cs diff --git a/test/integration/targets/cs_network/meta/main.yml b/test/integration/targets/cs_network/meta/main.yml new file mode 100644 index 0000000000..e9a5b9eeae --- /dev/null +++ b/test/integration/targets/cs_network/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - cs_common diff --git a/test/integration/targets/cs_network/tasks/main.yml b/test/integration/targets/cs_network/tasks/main.yml new file mode 100644 index 0000000000..cfe24c41fb --- /dev/null +++ b/test/integration/targets/cs_network/tasks/main.yml @@ -0,0 +1,3 @@ +--- + +- include_tasks: vpc_network_tier.yml diff --git a/test/integration/targets/cs_network/tasks/vpc_network_tier.yml b/test/integration/targets/cs_network/tasks/vpc_network_tier.yml new file mode 100644 index 0000000000..c53faf1a87 --- /dev/null +++ b/test/integration/targets/cs_network/tasks/vpc_network_tier.yml @@ -0,0 +1,298 @@ +--- +- name: setup cleanup vpc network tier + cs_network: + name: vpc tier 1 + zone: "{{ cs_common_zone_adv }}" + vpc: vpc_network_test + state: absent + ignore_errors: yes + +- name: setup cleanup existing vpc + cs_vpc: + name: vpc_network_test + zone: "{{ cs_common_zone_adv }}" + state: absent + register: vpc +- name: verify cleanup existing vpc + assert: + that: + - vpc is successful + +- name: setup vpc + cs_vpc: + name: vpc_network_test + cidr: 10.43.0.0/16 + zone: "{{ cs_common_zone_adv }}" + network_domain: cs2sandbox.simulator.example.com + register: vpc +- name: verify setup vpc + assert: + that: + - vpc is successful + +- name: setup network acl + cs_network_acl: + name: my_network_acl1 + vpc: vpc_network_test + zone: "{{ cs_common_zone_adv }}" + register: acl +- name: verify setup network acl + assert: + that: + - acl is successful + +- name: setup network acl rule + cs_network_acl_rule: + network_acl: my_network_acl1 + rule_position: 1 + vpc: vpc_network_test + traffic_type: ingress + action_policy: allow + port: 80 + cidr: 0.0.0.0/0 + zone: "{{ cs_common_zone_adv }}" + register: acl_rule +- name: verify setup network acl rule + assert: + that: + - acl_rule is successful + +- name: setup vpc network tier + cs_network: + name: vpc tier 1 + zone: "{{ cs_common_zone_adv }}" + vpc: vpc_network_test + state: absent + register: network +- name: verify setup vpc network tier + assert: + that: + - network is successful + +- name: test fail vpc network tier if vpc not given + cs_network: + name: vpc tier 1 + zone: "{{ cs_common_zone_adv }}" + network_domain: cs2sandbox.simulator.example.com + network_offering: DefaultIsolatedNetworkOfferingForVpcNetworks + gateway: 10.43.0.1 + netmask: 255.255.255.0 + acl: my_network_acl1 + check_mode: yes + register: network + ignore_errors: yes +- name: verify test fail vpc network tier if vpc not given + assert: + that: + - network is failed + - "network.msg == 'Missing required params: vpc'" + +- name: test create a vpc network tier in check mode + cs_network: + name: vpc tier 1 + zone: "{{ cs_common_zone_adv }}" + network_domain: cs2sandbox.simulator.example.com + vpc: vpc_network_test + network_offering: DefaultIsolatedNetworkOfferingForVpcNetworks + gateway: 10.43.0.1 + netmask: 255.255.255.0 + check_mode: yes + register: network +- name: verify test create a vpc network tier in check mode + assert: + that: + - network is changed + +- name: test create a vpc network tier + cs_network: + name: vpc tier 1 + zone: "{{ cs_common_zone_adv }}" + network_domain: cs2sandbox.simulator.example.com + vpc: vpc_network_test + network_offering: DefaultIsolatedNetworkOfferingForVpcNetworks + gateway: 10.43.0.1 + netmask: 255.255.255.0 + register: network +- name: verify test create a vpc network tier + assert: + that: + - network is changed + - network.acl_type == 'Account' + - not network.acl + - network.broadcast_domain_type == 'Vlan' + - network.cidr == '10.43.0.0/24' + - network.gateway == '10.43.0.1' + - network.display_text == 'vpc tier 1' + - network.network_offering == 'DefaultIsolatedNetworkOfferingForVpcNetworks' + - network.vpc == 'vpc_network_test' + - network.network_domain == 'cs2sandbox.simulator.example.com' + +- name: test create a vpc network tier idempotence + cs_network: + name: vpc tier 1 + zone: "{{ cs_common_zone_adv }}" + network_domain: cs2sandbox.simulator.example.com + vpc: vpc_network_test + network_offering: DefaultIsolatedNetworkOfferingForVpcNetworks + gateway: 10.43.0.1 + netmask: 255.255.255.0 + register: network +- name: verify test create a vpc network tier idempotence + assert: + that: + - network is not changed + - network.acl_type == 'Account' + - not network.acl + - network.broadcast_domain_type == 'Vlan' + - network.cidr == '10.43.0.0/24' + - network.gateway == '10.43.0.1' + - network.display_text == 'vpc tier 1' + - network.network_offering == 'DefaultIsolatedNetworkOfferingForVpcNetworks' + - network.vpc == 'vpc_network_test' + - network.network_domain == 'cs2sandbox.simulator.example.com' + +- name: test update a vpc network tier in check mode + cs_network: + name: vpc tier 1 + display_text: vpc tier 1 description + zone: "{{ cs_common_zone_adv }}" + network_domain: cs2sandbox.simulator.example.com + vpc: vpc_network_test + network_offering: DefaultIsolatedNetworkOfferingForVpcNetworks + gateway: 10.43.0.1 + netmask: 255.255.255.0 + acl: my_network_acl1 + check_mode: yes + register: network +- name: verify test update a vpc network tier in check mode + assert: + that: + - network is changed + - network.acl_type == 'Account' + - network.acl == 'my_network_acl1' + - network.broadcast_domain_type == 'Vlan' + - network.cidr == '10.43.0.0/24' + - network.gateway == '10.43.0.1' + - network.display_text == 'vpc tier 1' + - network.network_offering == 'DefaultIsolatedNetworkOfferingForVpcNetworks' + - network.vpc == 'vpc_network_test' + - network.network_domain == 'cs2sandbox.simulator.example.com' + +- name: test update a vpc network tier + cs_network: + name: vpc tier 1 + display_text: vpc tier 1 description + zone: "{{ cs_common_zone_adv }}" + network_domain: cs2sandbox.simulator.example.com + vpc: vpc_network_test + network_offering: DefaultIsolatedNetworkOfferingForVpcNetworks + gateway: 10.43.0.1 + netmask: 255.255.255.0 + acl: my_network_acl1 + register: network +- name: verify test update a vpc network tier + assert: + that: + - network is changed + - network.acl_type == 'Account' + - network.acl == 'my_network_acl1' + - network.broadcast_domain_type == 'Vlan' + - network.cidr == '10.43.0.0/24' + - network.gateway == '10.43.0.1' + - network.display_text == 'vpc tier 1 description' + - network.network_offering == 'DefaultIsolatedNetworkOfferingForVpcNetworks' + - network.vpc == 'vpc_network_test' + - network.network_domain == 'cs2sandbox.simulator.example.com' + +- name: test update a vpc network tier idempotence + cs_network: + name: vpc tier 1 + display_text: vpc tier 1 description + zone: "{{ cs_common_zone_adv }}" + network_domain: cs2sandbox.simulator.example.com + vpc: vpc_network_test + network_offering: DefaultIsolatedNetworkOfferingForVpcNetworks + gateway: 10.43.0.1 + netmask: 255.255.255.0 + acl: my_network_acl1 + register: network +- name: verify test update a vpc network tier idempotence + assert: + that: + - network is not changed + - network.acl_type == 'Account' + - network.acl == 'my_network_acl1' + - network.broadcast_domain_type == 'Vlan' + - network.cidr == '10.43.0.0/24' + - network.gateway == '10.43.0.1' + - network.display_text == 'vpc tier 1 description' + - network.network_offering == 'DefaultIsolatedNetworkOfferingForVpcNetworks' + - network.vpc == 'vpc_network_test' + - network.network_domain == 'cs2sandbox.simulator.example.com' + +- name: test absent a vpc network tier in check mode + cs_network: + name: vpc tier 1 + zone: "{{ cs_common_zone_adv }}" + vpc: vpc_network_test + state: absent + register: network + check_mode: yes +- name: verify test absent a vpc network tier in check mode + assert: + that: + - network is changed + - network.acl_type == 'Account' + - network.acl == 'my_network_acl1' + - network.broadcast_domain_type == 'Vlan' + - network.cidr == '10.43.0.0/24' + - network.gateway == '10.43.0.1' + - network.display_text == 'vpc tier 1 description' + - network.network_offering == 'DefaultIsolatedNetworkOfferingForVpcNetworks' + - network.vpc == 'vpc_network_test' + - network.network_domain == 'cs2sandbox.simulator.example.com' + +- name: test absent a vpc network tier + cs_network: + name: vpc tier 1 + zone: "{{ cs_common_zone_adv }}" + vpc: vpc_network_test + state: absent + register: network +- name: verify test absent a vpc network tier + assert: + that: + - network is changed + - network.acl_type == 'Account' + - network.acl == 'my_network_acl1' + - network.broadcast_domain_type == 'Vlan' + - network.cidr == '10.43.0.0/24' + - network.gateway == '10.43.0.1' + - network.display_text == 'vpc tier 1 description' + - network.network_offering == 'DefaultIsolatedNetworkOfferingForVpcNetworks' + - network.vpc == 'vpc_network_test' + - network.network_domain == 'cs2sandbox.simulator.example.com' + +- name: test absent a vpc network tier idempotence + cs_network: + name: vpc tier 1 + zone: "{{ cs_common_zone_adv }}" + vpc: vpc_network_test + state: absent + register: network +- name: verify test absent a vpc network tier idempotence + assert: + that: + - network is not changed + +- name: cleanup vpc + cs_vpc: + name: vpc_network_test + cidr: 10.43.0.0/16 + zone: "{{ cs_common_zone_adv }}" + state: absent + register: vpc +- name: verify cleanup vpc + assert: + that: + - vpc is successful