diff --git a/lib/ansible/module_utils/openstack.py b/lib/ansible/module_utils/openstack.py
index 64f95437143..5c4503f94ce 100644
--- a/lib/ansible/module_utils/openstack.py
+++ b/lib/ansible/module_utils/openstack.py
@@ -30,6 +30,9 @@ import os
 
 
 def openstack_argument_spec():
+    # DEPRECATED: This argument spec is only used for the deprecated old
+    # OpenStack modules. It turns out that modern OpenStack auth is WAY
+    # more complex than this.
     # Consume standard OpenStack environment variables.
     # This is mainly only useful for ad-hoc command line operation as
     # in playbooks one would assume variables would be used appropriately
@@ -67,3 +70,40 @@ def openstack_find_nova_addresses(addresses, ext_tag, key_name=None):
                     ret.append(interface_spec['addr'])
     return ret
 
+def openstack_full_argument_spec(**kwargs):
+    spec = dict(
+        cloud=dict(default=None),
+        auth_plugin=dict(default=None),
+        auth=dict(default=None),
+        auth_token=dict(default=None),
+        region_name=dict(default=None),
+        availability_zone=dict(default=None),
+        state=dict(default='present', choices=['absent', 'present']),
+        wait=dict(default=True, type='bool'),
+        timeout=dict(default=180, type='int'),
+        endpoint_type=dict(
+            default='publicURL', choices=['publicURL', 'internalURL']
+        )
+    )
+    spec.update(kwargs)
+    return spec
+
+
+def openstack_module_kwargs(**kwargs):
+    ret = dict(
+        required_one_of=[
+            ['cloud', 'auth'],
+        ],
+        mutually_exclusive=[
+            ['auth', 'auth_token'],
+            ['auth_plugin', 'auth_token'],
+        ],
+    )
+    for key in ('mutually_exclusive', 'required_together', 'required_one_of'):
+        if key in kwargs:
+            if key in ret:
+                ret[key].extend(kwargs[key])
+            else:
+                ret[key] = kwargs[key]
+
+    return ret