openstack/ansible-collections-openstack
Code Issues Proposed changes

Refactored security_group_rule{,_info} modules

Browse Source 
Change-Id: Ie953bee843a43b945d24d6152766b3ae418f797c
This commit is contained in:
Jakob Meng 2023-01-05 12:41:52 +01:00
parent 4cf6842222
commit 4dc6c421db
3 changed files with 450 additions and 470 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

335
ci/roles/security_group_rule/tasks/main.yml
View File

@ -1,18 +1,17 @@
--- ---
- name: Create security group - name: Create security group
openstack.cloud.security_group: openstack.cloud.security_group:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
name: ansible_security_group name: ansible_security_group
state: present state: present
description: Created from Ansible playbook
- name: Create empty ICMP rule - name: Create empty ICMP rule
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: icmp protocol: icmp
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
register: security_group_rule register: security_group_rule
- name: Assert return values of security_group_rule module - name: Assert return values of security_group_rule module
@ -23,11 +22,11 @@
- name: Assert changed - name: Assert changed
assert: assert:
that: security_group_rule is changed that: security_group_rule is changed
- name: Fetch all security group rule - name: Fetch all security group rule
openstack.cloud.security_group_rule_info: openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
register: security_group_rules register: security_group_rules
- name: Assert return values of security_group_rule_info module - name: Assert return values of security_group_rule_info module
@ -39,8 +38,8 @@
- name: Fetch security group rule based on rule - name: Fetch security group rule based on rule
openstack.cloud.security_group_rule_info: openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
id: "{{ security_group_rule.rule.id }}" id: "{{ security_group_rule.rule.id }}"
register: security_group_rules register: security_group_rules
- name: Assert return fields security_group_rule_info - name: Assert return fields security_group_rule_info
@ -49,157 +48,157 @@
- name: Create empty ICMP rule again - name: Create empty ICMP rule again
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: icmp protocol: icmp
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
register: security_group_rule register: security_group_rule
- name: Assert not changed - name: Assert not changed
assert: assert:
that: security_group_rule is not changed that: security_group_rule is not changed
- name: Create -1 ICMP rule - name: Create -1 ICMP rule
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: icmp protocol: icmp
port_range_min: -1 port_range_min: -1
port_range_max: -1 port_range_max: -1
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
register: security_group_rule register: security_group_rule
- name: Assert not changed - name: Assert not changed
assert: assert:
that: security_group_rule is not changed that: security_group_rule is not changed
- name: Create -1 ICMP rule again - name: Create -1 ICMP rule again
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: icmp protocol: icmp
port_range_min: -1 port_range_min: -1
port_range_max: -1 port_range_max: -1
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
register: security_group_rule register: security_group_rule
- name: Assert not changed - name: Assert not changed
assert: assert:
that: security_group_rule is not changed that: security_group_rule is not changed
- name: Create empty TCP rule - name: Create empty TCP rule
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: tcp protocol: tcp
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
register: security_group_rule register: security_group_rule
- name: Assert changed - name: Assert changed
assert: assert:
that: security_group_rule is changed that: security_group_rule is changed
- name: Create TCP rule again with port range (1, 65535) - name: Create TCP rule again with port range (1, 65535)
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: tcp protocol: tcp
port_range_min: 1 port_range_min: 1
port_range_max: 65535 port_range_max: 65535
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
register: security_group_rule register: security_group_rule
- name: Assert changed - name: Assert changed
assert: assert:
that: security_group_rule is not changed that: security_group_rule is not changed
- name: Create TCP rule again with port range (-1, -1) - name: Create TCP rule again with port range (-1, -1)
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: tcp protocol: tcp
port_range_min: -1 port_range_min: -1
port_range_max: -1 port_range_max: -1
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
register: security_group_rule register: security_group_rule
- name: Assert changed - name: Assert changed
assert: assert:
that: security_group_rule is not changed that: security_group_rule is not changed
- name: Create TCP rule again with defined range - name: Create TCP rule again with defined range
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: tcp protocol: tcp
port_range_min: 8000 port_range_min: 8000
port_range_max: 9000 port_range_max: 9000
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
register: security_group_rule register: security_group_rule
- name: Assert changed - name: Assert changed
assert: assert:
that: security_group_rule is changed that: security_group_rule is changed
- name: Create empty UDP rule - name: Create empty UDP rule
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: udp protocol: udp
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
- name: Create UDP rule again with port range (1, 65535) - name: Create UDP rule again with port range (1, 65535)
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: udp protocol: udp
port_range_min: 1 port_range_min: 1
port_range_max: 65535 port_range_max: 65535
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
- name: Create UDP rule again with port range (-1, -1) - name: Create UDP rule again with port range (-1, -1)
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: udp protocol: udp
port_range_min: -1 port_range_min: -1
port_range_max: -1 port_range_max: -1
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
- name: Create HTTP rule - name: Create HTTP rule
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: tcp protocol: tcp
port_range_min: 80 port_range_min: 80
port_range_max: 80 port_range_max: 80
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
- name: Create egress rule - name: Create egress rule
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: present state: present
protocol: tcp protocol: tcp
port_range_min: 30000 port_range_min: 30000
port_range_max: 30001 port_range_max: 30001
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
direction: egress direction: egress
- name: List all available rules of all security groups in a project - name: List all available rules of all security groups in a project
openstack.cloud.security_group_rule_info: openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
register: security_group_rules register: security_group_rules
- name: Check - List all available rules of all security groups in a project - name: Check - List all available rules of all security groups in a project
@ -209,8 +208,8 @@
- name: List all available rules of a specific security group - name: List all available rules of a specific security group
openstack.cloud.security_group_rule_info: openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
register: security_group_rules register: security_group_rules
- name: Check - List all available rules of a specific security group - name: Check - List all available rules of a specific security group
@ -220,70 +219,80 @@
- name: List all available rules with filters - name: List all available rules with filters
openstack.cloud.security_group_rule_info: openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
protocol: tcp protocol: tcp
port_range_min: 80 port_range_min: 80
port_range_max: 80 port_range_max: 80
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
- name: Delete empty ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
- name: Delete -1 ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: icmp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty TCP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty UDP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: udp
remote_ip_prefix: 0.0.0.0/0
- name: Delete HTTP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
port_range_min: 80
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
- name: Delete egress rule - name: Delete egress rule
openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
security_group: ansible_security_group security_group: ansible_security_group
state: absent state: absent
protocol: tcp protocol: tcp
port_range_min: 30000 port_range_min: 30000
port_range_max: 30001 port_range_max: 30001
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
direction: egress direction: egress
- name: Delete HTTP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
port_range_min: 80
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty UDP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: udp
remote_ip_prefix: 0.0.0.0/0
- name: Delete TCP rule again with defined range
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
port_range_min: 8000
port_range_max: 9000
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty TCP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
remote_ip_prefix: 0.0.0.0/0
- name: Delete -1 ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: icmp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
- name: Delete security group - name: Delete security group
openstack.cloud.security_group: openstack.cloud.security_group:
cloud: "{{ cloud }}" cloud: "{{ cloud }}"
name: ansible_security_group name: ansible_security_group
state: absent state: absent

525
plugins/modules/security_group_rule.py
View File

@ -5,82 +5,101 @@
# Copyright (c) 2013, Benno Joy <benno@ansible.com> # Copyright (c) 2013, Benno Joy <benno@ansible.com>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
DOCUMENTATION = ''' DOCUMENTATION = r'''
--- ---
module: security_group_rule module: security_group_rule
short_description: Add/Delete rule from an existing security group short_description: Manage security group rules in OpenStack network (Neutron)
author: OpenStack Ansible SIG author: OpenStack Ansible SIG
description: description:
- Add or Remove rule from an existing security group - Add or remove security group rule to/from OpenStack network (Neutron)
service.
options: options:
security_group: description:
description: description:
- Name or ID of the security group - Description of the security group rule.
required: true type: str
type: str direction:
protocol: description:
description: - The direction in which the security group rule is applied.
- IP protocols ANY TCP UDP ICMP and others, also number in range 0-255 - Not all providers support C(egress).
type: str choices: ['egress', 'ingress']
port_range_min: default: ingress
description: type: str
- Starting port ether_type:
type: int description:
port_range_max: - Must be IPv4 or IPv6, and addresses represented in CIDR must
description: match the ingress or egress rules. Not all providers support IPv6.
- Ending port choices: ['IPv4', 'IPv6']
type: int default: IPv4
remote_ip_prefix: type: str
description: aliases: ['ethertype']
- Source IP address(es) in CIDR notation (exclusive with remote_group) port_range_max:
type: str description:
remote_group: - The maximum port number in the range that is matched by the security
description: group rule.
- Name or ID of the Security group to link (exclusive with - If the protocol is TCP, UDP, DCCP, SCTP or UDP-Lite this value must be
remote_ip_prefix) greater than or equal to the I(port_range_min) attribute value.
type: str - If the protocol is ICMP, this value must be an ICMP code.
ether_type: type: int
description: port_range_min:
- Must be IPv4 or IPv6, and addresses represented in CIDR must description:
match the ingress or egress rules. Not all providers support IPv6. - The minimum port number in the range that is matched by the security
choices: ['IPv4', 'IPv6'] group rule.
default: IPv4 - If the protocol is TCP, UDP, DCCP, SCTP or UDP-Lite this value must be
type: str less than or equal to the port_range_max attribute value.
aliases: [ethertype] - If the protocol is ICMP, this value must be an ICMP type.
direction: type: int
description: project:
- The direction in which the security group rule is applied. Not description:
all providers support egress. - Unique name or ID of the project.
choices: ['egress', 'ingress'] type: str
default: ingress protocol:
type: str description:
state: - The IP protocol can be represented by a string, an integer, or null.
description: - Valid string or integer values are C(any) or C(0), C(ah) or C(51),
- Should the resource be present or absent. C(dccp) or C(33), C(egp) or C(8), C(esp) or C(50), C(gre) or C(47),
choices: [present, absent] C(icmp) or C(1), C(icmpv6) or C(58), C(igmp) or C(2), C(ipip) or C(4),
default: present C(ipv6-encap) or C(41), C(ipv6-frag) or C(44), C(ipv6-icmp) or C(58),
type: str C(ipv6-nonxt) or C(59), C(ipv6-opts) or C(60), C(ipv6-route) or C(43),
project: C(ospf) or C(89), C(pgm) or C(113), C(rsvp) or C(46), C(sctp) or
description: C(132), C(tcp) or C(6), C(udp) or C(17), C(udplite) or C(136), C(vrrp)
- Unique name or ID of the project. or C(112).
required: false - Additionally, any integer value between C([0-255]) is also valid.
type: str - The string any (or integer 0) means all IP protocols.
description: - See the constants in neutron_lib.constants for the most up-to-date
required: false list of supported strings.
description: type: str
- Description of the rule. remote_group:
type: str description:
- Name or ID of the security group to link.
- Mutually exclusive with I(remote_ip_prefix).
type: str
remote_ip_prefix:
description:
- Source IP address(es) in CIDR notation.
- Mutually exclusive with I(remote_group).
type: str
security_group:
description:
- Name or ID of the security group.
required: true
type: str
state:
description:
- Should the resource be present or absent.
choices: [present, absent]
default: present
type: str
requirements: requirements:
- "python >= 3.6" - "python >= 3.6"
- "openstacksdk" - "openstacksdk"
extends_documentation_fragment: extends_documentation_fragment:
- openstack.cloud.openstack - openstack.cloud.openstack
''' '''
EXAMPLES = ''' EXAMPLES = r'''
# Create a security group rule - name: Create a security group rule
- openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: mordred cloud: mordred
security_group: foo security_group: foo
protocol: tcp protocol: tcp
@ -88,15 +107,15 @@ EXAMPLES = '''
port_range_max: 80 port_range_max: 80
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
# Create a security group rule for ping - name: Create a security group rule for ping
- openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: mordred cloud: mordred
security_group: foo security_group: foo
protocol: icmp protocol: icmp
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
# Another way to create the ping rule - name: Another way to create the ping rule
- openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: mordred cloud: mordred
security_group: foo security_group: foo
protocol: icmp protocol: icmp
@ -104,8 +123,8 @@ EXAMPLES = '''
port_range_max: -1 port_range_max: -1
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
# Create a TCP rule covering all ports - name: Create a TCP rule covering all ports
- openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: mordred cloud: mordred
security_group: foo security_group: foo
protocol: tcp protocol: tcp
@ -113,326 +132,278 @@ EXAMPLES = '''
port_range_max: 65535 port_range_max: 65535
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
# Another way to create the TCP rule above (defaults to all ports) - name: Another way to create the TCP rule above (defaults to all ports)
- openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: mordred cloud: mordred
security_group: foo security_group: foo
protocol: tcp protocol: tcp
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
# Create a rule for VRRP with numbered protocol 112 - name: Create a rule for VRRP with numbered protocol 112
- openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
security_group: loadbalancer_sg security_group: loadbalancer_sg
protocol: 112 protocol: 112
remote_group: loadbalancer-node_sg remote_group: loadbalancer-node_sg
# Create a security group rule for a given project - name: Create a security group rule for a given project
- openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: mordred cloud: mordred
security_group: foo security_group: foo
protocol: icmp protocol: icmp
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
project: myproj project: myproj
# Remove the default created egress rule for IPv4 - name: Remove the default created egress rule for IPv4
- openstack.cloud.security_group_rule: openstack.cloud.security_group_rule:
cloud: mordred cloud: mordred
security_group: foo security_group: foo
protocol: any protocol: any
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
''' '''
RETURN = ''' RETURN = r'''
rule: rule:
description: Representation of the security group rule description: Dictionary describing the security group rule
type: dict type: dict
returned: when I(state) is present returned: On success when I(state) is C(present).
contains: contains:
created_at: created_at:
description: Timestamp when the resource was created description: Timestamp when the resource was created
type: str type: str
returned: always
description: description:
description: Description of the resource description: Description of the resource
type: str type: str
returned: always
direction: direction:
description: The direction in which the security group rule is applied. description: The direction in which the security group rule is applied.
type: str type: str
sample: 'egress' sample: 'egress'
returned: always
ether_type: ether_type:
description: Either IPv4 or IPv6 description: Either IPv4 or IPv6
type: str type: str
returned: always
id: id:
description: Unique rule UUID. description: Unique rule UUID.
type: str type: str
returned: always
name: name:
description: Name of the resource. description: Name of the resource.
type: str type: str
returned: always
port_range_max: port_range_max:
description: The maximum port number in the range that is matched by description: The maximum port number in the range that is matched by
the security group rule. the security group rule.
type: int type: int
sample: 8000 sample: 8000
returned: always
port_range_min: port_range_min:
description: The minimum port number in the range that is matched by description: The minimum port number in the range that is matched by
the security group rule. the security group rule.
type: int type: int
sample: 8000 sample: 8000
returned: always
project_id: project_id:
description: ID of the project the resource belongs to. description: ID of the project the resource belongs to.
type: str type: str
returned: always
protocol: protocol:
description: The protocol that is matched by the security group rule. description: The protocol that is matched by the security group rule.
type: str type: str
sample: 'tcp' sample: 'tcp'
returned: always
remote_address_group_id: remote_address_group_id:
description: The remote address group ID to be associated with this description: The remote address group ID to be associated with this
security group rule. security group rule.
type: str type: str
sample: '0.0.0.0/0' sample: '0.0.0.0/0'
returned: always
remote_group_id: remote_group_id:
description: The remote security group ID to be associated with this description: The remote security group ID to be associated with this
security group rule. security group rule.
type: str type: str
sample: '0.0.0.0/0' sample: '0.0.0.0/0'
returned: always
remote_ip_prefix: remote_ip_prefix:
description: The remote IP prefix to be associated with this security description: The remote IP prefix to be associated with this security
group rule. group rule.
type: str type: str
sample: '0.0.0.0/0' sample: '0.0.0.0/0'
returned: always
revision_number: revision_number:
description: Revision number description: Revision number
type: int type: int
sample: 0 sample: 0
returned: always
security_group_id: security_group_id:
description: The security group ID to associate with this security group description: The security group ID to associate with this security group
rule. rule.
type: str type: str
returned: always
tags: tags:
description: Tags associated with resource. description: Tags associated with resource.
type: list type: list
elements: str elements: str
returned: always
tenant_id: tenant_id:
description: ID of the project the resource belongs to. Deprecated. description: ID of the project the resource belongs to. Deprecated.
type: str type: str
returned: always
updated_at: updated_at:
description: Timestamp when the security group rule was last updated. description: Timestamp when the security group rule was last updated.
type: str type: str
returned: always
''' '''
from ansible_collections.openstack.cloud.plugins.module_utils.openstack import ( from ansible_collections.openstack.cloud.plugins.module_utils.openstack import (
OpenStackModule) OpenStackModule)
def _ports_match(protocol, module_min, module_max, rule_min, rule_max):
"""
Capture the complex port matching logic.
The port values coming in for the module might be -1 (for ICMP),
which will work only for Nova, but this is handled by sdk. Likewise,
they might be None, which works for Neutron, but not Nova. This too is
handled by sdk. Since sdk will consistently return these port
values as None, we need to convert any -1 values input to the module
to None here for comparison.
For TCP and UDP protocols, None values for both min and max are
represented as the range 1-65535 for Nova, but remain None for
Neutron. sdk returns the full range when Nova is the backend (since
that is how Nova stores them), and None values for Neutron. If None
values are input to the module for both values, then we need to adjust
for comparison.
"""
# Check if the user is supplying -1 for ICMP.
if protocol in ['icmp', 'ipv6-icmp']:
if module_min and int(module_min) == -1:
module_min = None
if module_max and int(module_max) == -1:
module_max = None
# Rules with 'any' protocol do not match ports
if protocol == 'any':
return True
# Check if the user is supplying -1, 1 to 65535 or None values for full TPC/UDP port range.
if protocol in ['tcp', 'udp'] or protocol is None:
if (
not module_min and not module_max
or (int(module_min) in [-1, 1]
and int(module_max) in [-1, 65535])
):
if (
not rule_min and not rule_max
or (int(rule_min) in [-1, 1]
and int(rule_max) in [-1, 65535])
):
# (None, None) == (1, 65535) == (-1, -1)
return True
# Sanity check to make sure we don't have type comparison issues.
if module_min:
module_min = int(module_min)
if module_max:
module_max = int(module_max)
if rule_min:
rule_min = int(rule_min)
if rule_max:
rule_max = int(rule_max)
return module_min == rule_min and module_max == rule_max
class SecurityGroupRuleModule(OpenStackModule): class SecurityGroupRuleModule(OpenStackModule):
argument_spec = dict( argument_spec = dict(
security_group=dict(required=True),
protocol=dict(),
port_range_min=dict(type='int'),
port_range_max=dict(type='int'),
remote_ip_prefix=dict(),
remote_group=dict(),
ether_type=dict(default='IPv4',
choices=['IPv4', 'IPv6'],
aliases=['ethertype']),
direction=dict(default='ingress',
choices=['egress', 'ingress']),
state=dict(default='present',
choices=['absent', 'present']),
description=dict(), description=dict(),
direction=dict(default='ingress', choices=['egress', 'ingress']),
ether_type=dict(default='IPv4', choices=['IPv4', 'IPv6'],
aliases=['ethertype']),
port_range_max=dict(type='int'),
port_range_min=dict(type='int'),
project=dict(), project=dict(),
protocol=dict(),
remote_group=dict(),
remote_ip_prefix=dict(),
security_group=dict(required=True),
state=dict(default='present', choices=['absent', 'present']),
) )
module_kwargs = dict( module_kwargs = dict(
mutually_exclusive=[ mutually_exclusive=[
['remote_ip_prefix', 'remote_group'], ['remote_ip_prefix', 'remote_group'],
] ],
supports_check_mode=True,
) )
def _build_kwargs(self, secgroup, remote_group, project):
kwargs = dict(
security_group_id=secgroup.id,
description=self.params['description'],
port_range_max=self.params['port_range_max'],
port_range_min=self.params['port_range_min'],
protocol=self.params['protocol'],
remote_ip_prefix=self.params['remote_ip_prefix'],
direction=self.params['direction'],
ether_type=self.params['ether_type'],
)
if self.params['port_range_min'] != -1:
kwargs['port_range_min'] = self.params['port_range_min']
if self.params['port_range_max'] != -1:
kwargs['port_range_max'] = self.params['port_range_max']
if project:
kwargs['project_id'] = project.id
if remote_group:
kwargs['remote_group_id'] = remote_group.id
return {k: v for k, v in kwargs.items() if v is not None}
def _find_matching_rule(self, kwargs, secgroup):
"""
Find a rule in the group that matches the module parameters.
:returns: The matching rule dict, or None if no matches.
"""
fields = ('protocol', 'remote_ip_prefix', 'direction',
'remote_group_id')
for rule in secgroup['security_group_rules']:
if ('ether_type' in kwargs
and rule['ethertype'] != kwargs['ether_type']):
continue
if any(field in kwargs and rule[field] != kwargs[field]
for field in fields):
continue
if _ports_match(
self.params['protocol'],
self.params['port_range_min'],
self.params['port_range_max'],
rule['port_range_min'],
rule['port_range_max']
):
return rule
return None
def _system_state_change(self, secgroup, rule):
state = self.params['state']
if not secgroup:
return False
if state == 'present' and not rule:
return True
if state == 'absent' and rule:
return True
return False
def run(self): def run(self):
state = self.params['state'] state = self.params['state']
security_group = self.params['security_group']
remote_group_name_or_id = self.params['remote_group']
project_name_or_id = self.params['project']
project = None security_group_rule = self._find()
if project_name_or_id:
project = self.conn.identity.find_project(project_name_or_id,
ignore_missing=False)
filters = {}
if project and not remote_group_name_or_id:
filters = {'project_id': project.id}
secgroup = self.conn.network.find_security_group(
security_group, ignore_missing=(state == 'absent'), **filters)
remote_group = None
if remote_group_name_or_id:
remote_group = self.conn.network.find_security_group(
remote_group_name_or_id, ignore_missing=False, filters=filters)
kwargs = self._build_kwargs(secgroup, remote_group, project)
rule = None
if secgroup:
# TODO: Replace with self.conn.network.find_security_group_rule()?
rule = self._find_matching_rule(kwargs, secgroup)
if rule:
rule = self.conn.network.get_security_group_rule(rule['id'])
if self.ansible.check_mode: if self.ansible.check_mode:
self.exit_json(changed=self._system_state_change(secgroup, rule)) self.exit_json(
changed=self._will_change(state, security_group_rule))
changed = False if state == 'present' and not security_group_rule:
if state == 'present': # Create security_group_rule
if self.params['protocol'] == 'any': security_group_rule = self._create()
self.params['protocol'] = None self.exit_json(changed=True,
rule=security_group_rule.to_dict(computed=False))
if not rule: elif state == 'present' and security_group_rule:
rule = self.conn.network.create_security_group_rule(**kwargs) # Only exact matches will cause security_group_rule to be not None
changed = True self.exit_json(changed=False,
rule=security_group_rule.to_dict(computed=False))
elif state == 'absent' and security_group_rule:
# Delete security_group_rule
self._delete(security_group_rule)
self.exit_json(changed=True)
rule = rule.to_dict(computed=False) elif state == 'absent' and not security_group_rule:
self.exit_json(changed=changed, rule=rule) # Do nothing
self.exit_json(changed=False)
if state == 'absent' and rule: def _create(self):
self.conn.network.delete_security_group_rule(rule['id']) prototype = self._define_prototype()
changed = True return self.conn.network.create_security_group_rule(**prototype)
self.exit_json(changed=changed) def _define_prototype(self):
filters = {}
prototype = dict((k, self.params[k])
for k in ['direction', 'protocol', 'remote_ip_prefix']
if self.params[k] is not None)
project_name_or_id = self.params['project']
if project_name_or_id is not None:
project = self.conn.identity.find_project(project_name_or_id,
ignore_missing=False)
filters = {'project_id': project.id}
prototype['project_id'] = project.id
security_group_name_or_id = self.params['security_group']
security_group = self.conn.network.find_security_group(
security_group_name_or_id, ignore_missing=False, **filters)
prototype['security_group_id'] = security_group.id
remote_group = None
remote_group_name_or_id = self.params['remote_group']
if remote_group_name_or_id is not None:
remote_group = self.conn.network.find_security_group(
remote_group_name_or_id, ignore_missing=False)
prototype['remote_group_id'] = remote_group.id
ether_type = self.params['ether_type']
if ether_type is not None:
prototype['ether_type'] = ether_type
protocol = self.params['protocol']
port_range_max = self.params['port_range_max']
port_range_min = self.params['port_range_min']
if protocol in ['icmp', 'ipv6-icmp']:
# Check if the user is supplying -1 for ICMP.
if port_range_max is not None and int(port_range_max) != -1:
prototype['port_range_max'] = int(port_range_max)
if port_range_min is not None and int(port_range_min) != -1:
prototype['port_range_min'] = int(port_range_min)
elif protocol in ['tcp', 'udp']:
if port_range_max is not None and int(port_range_max) != -1:
prototype['port_range_max'] = int(port_range_max)
if port_range_min is not None and int(port_range_min) != -1:
prototype['port_range_min'] = int(port_range_min)
elif protocol in ['any', '0']:
# Rules with 'any' protocol do not match ports
pass
else:
if port_range_max is not None:
prototype['port_range_max'] = int(port_range_max)
if port_range_min is not None:
prototype['port_range_min'] = int(port_range_min)
return prototype
def _delete(self, security_group_rule):
self.conn.network.delete_security_group_rule(security_group_rule.id)
def _find(self):
# Replacing this code with self.conn.network.find_security_group_rule()
# is not possible because the latter requires an id or name.
matches = self._find_matches()
if len(matches) > 1:
self.fail_json(msg='Found more a single matching security group'
' rule which match the given parameters.')
elif len(matches) == 1:
return self.conn.network.get_security_group_rule(matches[0]['id'])
else: # len(matches) == 0
return None
def _find_matches(self):
prototype = self._define_prototype()
security_group = self.conn.network.\
get_security_group(prototype['security_group_id'])
if 'ether_type' in prototype:
prototype['ethertype'] = prototype.pop('ether_type')
if 'protocol' in prototype and prototype['protocol'] in ['any', '0']:
prototype.pop('protocol')
if 'protocol' in prototype and prototype['protocol'] in ['tcp', 'udp']:
# Check if the user is supplying -1, 1 to 65535 or None values
# for full TPC or UDP port range.
# (None, None) == (1, 65535) == (-1, -1)
if 'port_range_max' in prototype \
and prototype['port_range_max'] in [-1, 65535]:
prototype.pop('port_range_max')
if 'port_range_min' in prototype \
and prototype['port_range_min'] in [-1, 1]:
prototype.pop('port_range_min')
return [r for r in security_group.security_group_rules
if all(r[k] == prototype[k] for k in prototype.keys())]
def _will_change(self, state, security_group_rule):
if state == 'present' and not security_group_rule:
return True
elif state == 'present' and security_group_rule:
# Only exact matches will cause security_group_rule to be not None
return False
elif state == 'absent' and security_group_rule:
return True
else:
# state == 'absent' and not security_group_rule:
return False
def main(): def main():

60
plugins/modules/security_group_rule_info.py
View File

@ -4,13 +4,13 @@
# Copyright (c) 2020 by Tino Schreiber (Open Telekom Cloud), operated by T-Systems International GmbH # Copyright (c) 2020 by Tino Schreiber (Open Telekom Cloud), operated by T-Systems International GmbH
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
DOCUMENTATION = ''' DOCUMENTATION = r'''
--- ---
module: security_group_rule_info module: security_group_rule_info
short_description: Querying security group rules short_description: Fetch OpenStack network (Neutron) security group rules
author: OpenStack Ansible SIG author: OpenStack Ansible SIG
description: description:
- Querying security group rules - Fetch security group rules from OpenStack network (Neutron) API.
options: options:
description: description:
description: description:
@ -69,23 +69,20 @@ options:
description: description:
- Name or ID of the security group - Name or ID of the security group
type: str type: str
requirements: requirements:
- "python >= 3.6" - "python >= 3.6"
- "openstacksdk" - "openstacksdk"
extends_documentation_fragment: extends_documentation_fragment:
- openstack.cloud.openstack - openstack.cloud.openstack
''' '''
EXAMPLES = ''' EXAMPLES = r'''
# Get all security group rules - name: Fetch all security group rules
- openstack.cloud.security_group_rule_info: openstack.cloud.security_group_rule_info:
cloud: devstack cloud: devstack
register: sg
# Filter security group rules for port 80 and name - name: Filter security group rules for port 80 and name
- openstack.cloud.security_group_rule_info: openstack.cloud.security_group_rule_info:
cloud: devstack cloud: devstack
security_group: foo security_group: foo
protocol: tcp protocol: tcp
@ -93,13 +90,13 @@ EXAMPLES = '''
port_range_max: 80 port_range_max: 80
remote_ip_prefix: 0.0.0.0/0 remote_ip_prefix: 0.0.0.0/0
# Filter for ICMP rules - name: Filter for ICMP rules
- openstack.cloud.security_group_rule_info: openstack.cloud.security_group_rule_info:
cloud: devstack cloud: devstack
protocol: icmp protocol: icmp
''' '''
RETURN = ''' RETURN = r'''
security_group_rules: security_group_rules:
description: List of dictionaries describing security group rules. description: List of dictionaries describing security group rules.
type: list type: list
@ -213,29 +210,32 @@ class SecurityGroupRuleInfoModule(OpenStackModule):
def run(self): def run(self):
filters = dict((k, self.params[k]) filters = dict((k, self.params[k])
for k in ['description', 'direction', 'ether_type', for k in ['description', 'direction', 'ether_type',
'port_range_min', 'port_range_max', 'id', 'port_range_min', 'port_range_max',
'protocol', 'remote_group', 'protocol', 'remote_group',
'revision_number', 'remote_ip_prefix'] 'revision_number', 'remote_ip_prefix']
if self.params[k] is not None) if self.params[k] is not None)
if self.params['id']: project_name_or_id = self.params['project']
filters['id'] = self.params['id'] if project_name_or_id is not None:
if self.params['project']: project = self.conn.find_project(project_name_or_id)
proj = self.conn.find_project(self.params['project'], if not project:
ignore_missing=False) self.exit_json(changed=False, security_group_rules=[])
filters['project_id'] = proj.id filters['project_id'] = project.id
if self.params['security_group']:
sec_grp = self.conn.network.find_security_group(
name_or_id=self.params['security_group'],
ignore_missing=False)
filters['security_group_id'] = sec_grp.id
security_group_rules = [ security_group_name_or_id = self.params['security_group']
rule.to_dict(computed=False) if security_group_name_or_id is not None:
for rule in self.conn.network.security_group_rules(**filters)] security_group = self.conn.network.\
find_security_group(security_group_name_or_id)
if not security_group:
self.exit_json(changed=False, security_group_rules=[])
filters['security_group_id'] = security_group.id
security_group_rules = \
self.conn.network.security_group_rules(**filters)
self.exit_json(changed=False, self.exit_json(changed=False,
security_group_rules=security_group_rules) security_group_rules=[r.to_dict(computed=False)
for r in security_group_rules])
def main(): def main():