Split out route table and subnet functionality from VPC module.

lib/ansible/modules/extras/cloud/amazon/ec2_vpc_route_table.py

@@ -0,0 +1,498 @@
+#!/usr/bin/python
+# This file is part of Ansible
+#
+# Ansible is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ansible is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
+
+DOCUMENTATION = '''
+---
+module: ec2_vpc_route_table
+short_description: Configure route tables for AWS virtual private clouds
+description:
+    - Create or removes route tables from AWS virtual private clouds.'''
+'''This module has a dependency on python-boto.
+version_added: "1.8"
+options:
+  vpc_id:
+    description:
+      - "The VPC in which to create the route table."
+    required: true
+  route_table_id:
+    description:
+      - "The ID of the route table to update or delete."
+    required: false
+    default: null
+  resource_tags:
+    description:
+      - 'A dictionary array of resource tags of the form: { tag1: value1,'''
+''' tag2: value2 }. Tags in this list are used to uniquely identify route'''
+''' tables within a VPC when the route_table_id is not supplied.
+    required: false
+    default: null
+    aliases: []
+    version_added: "1.6"
+  routes:
+    description:
+      - List of routes in the route table. Routes are specified'''
+''' as dicts containing the keys 'dest' and one of 'gateway_id','''
+''' 'instance_id', 'interface_id', or 'vpc_peering_connection'.
+    required: true
+    aliases: []
+  subnets:
+    description:
+      - An array of subnets to add to this route table. Subnets may either be'''
+''' specified by subnet ID or by a CIDR such as '10.0.0.0/24'.
+    required: true
+    aliases: []
+  wait:
+    description:
+      - wait for the VPC to be in state 'available' before returning
+    required: false
+    default: "no"
+    choices: [ "yes", "no" ]
+    aliases: []
+  wait_timeout:
+    description:
+      - how long before wait gives up, in seconds
+    default: 300
+    aliases: []
+  state:
+    description:
+      - Create or terminate the VPC
+    required: true
+    default: present
+    aliases: []
+  region:
+    description:
+      - region in which the resource exists.
+    required: false
+    default: null
+    aliases: ['aws_region', 'ec2_region']
+  aws_secret_key:
+    description:
+      - AWS secret key. If not set then the value of the AWS_SECRET_KEY'''
+''' environment variable is used.
+    required: false
+    default: None
+    aliases: ['ec2_secret_key', 'secret_key' ]
+  aws_access_key:
+    description:
+      - AWS access key. If not set then the value of the AWS_ACCESS_KEY'''
+''' environment variable is used.
+    required: false
+    default: None
+    aliases: ['ec2_access_key', 'access_key' ]
+  validate_certs:
+    description:
+      - When set to "no", SSL certificates will not be validated for boto'''
+''' versions >= 2.6.0.
+    required: false
+    default: "yes"
+    choices: ["yes", "no"]
+    aliases: []
+    version_added: "1.5"
+
+requirements: [ "boto" ]
+author: Robert Estelle
+'''
+
+EXAMPLES = '''
+# Note: None of these examples set aws_access_key, aws_secret_key, or region.
+# It is assumed that their matching environment variables are set.
+
+# Basic creation example:
+- name: Set up public subnet route table
+  local_action:
+    module: ec2_vpc_route_table
+    vpc_id: vpc-1245678
+    region: us-west-1
+    resource_tags:
+      Name: Public
+    subnets:
+      - '{{jumpbox_subnet.subnet_id}}'
+      - '{{frontend_subnet.subnet_id}}'
+      - '{{vpn_subnet.subnet_id}}'
+    routes:
+      - dest: 0.0.0.0/0
+        gateway_id: '{{igw.gateway_id}}'
+  register: public_route_table
+
+- name: Set up NAT-protected route table
+  local_action:
+    module: ec2_vpc_route_table
+    vpc_id: vpc-1245678
+    region: us-west-1
+    resource_tags:
+      - Name: Internal
+    subnets:
+      - '{{application_subnet.subnet_id}}'
+      - '{{database_subnet.subnet_id}}'
+      - '{{splunk_subnet.subnet_id}}'
+    routes:
+      - dest: 0.0.0.0/0
+        instance_id: '{{nat.instance_id}}'
+  register: nat_route_table
+'''
+
+
+import sys
+
+try:
+    import boto.ec2
+    import boto.vpc
+    from boto.exception import EC2ResponseError
+except ImportError:
+    print "failed=True msg='boto required for this module'"
+    sys.exit(1)
+
+
+class RouteTableException(Exception):
+    pass
+
+
+class TagCreationException(RouteTableException):
+    pass
+
+
+def get_resource_tags(vpc_conn, resource_id):
+    return {t.name: t.value for t in
+            vpc_conn.get_all_tags(filters={'resource-id': resource_id})}
+
+
+def dict_diff(old, new):
+    x = {}
+    old_keys = set(old.keys())
+    new_keys = set(new.keys())
+
+    for k in old_keys.difference(new_keys):
+        x[k] = {'old': old[k]}
+
+    for k in new_keys.difference(old_keys):
+        x[k] = {'new': new[k]}
+
+    for k in new_keys.intersection(old_keys):
+        if new[k] != old[k]:
+            x[k] = {'new': new[k], 'old': old[k]}
+
+    return x
+
+
+def tags_match(match_tags, candidate_tags):
+    return all((k in candidate_tags and candidate_tags[k] == v
+                for k, v in match_tags.iteritems()))
+
+
+def ensure_tags(vpc_conn, resource_id, tags, add_only, dry_run):
+    try:
+        cur_tags = get_resource_tags(vpc_conn, resource_id)
+        diff = dict_diff(cur_tags, tags)
+        if not diff:
+            return {'changed': False, 'tags': cur_tags}
+
+        to_delete = {k: diff[k]['old'] for k in diff if 'new' not in diff[k]}
+        if to_delete and not add_only:
+            vpc_conn.delete_tags(resource_id, to_delete, dry_run=dry_run)
+
+        to_add = {k: diff[k]['new'] for k in diff if 'old' not in diff[k]}
+        if to_add:
+            vpc_conn.create_tags(resource_id, to_add, dry_run=dry_run)
+
+        latest_tags = get_resource_tags(vpc_conn, resource_id)
+        return {'changed': True, 'tags': latest_tags}
+    except EC2ResponseError as e:
+        raise TagCreationException('Unable to update tags for {0}, error: {1}'
+                                   .format(resource_id, e))
+
+
+def get_route_table_by_id(vpc_conn, vpc_id, route_table_id):
+    route_tables = vpc_conn.get_all_route_tables(
+        route_table_ids=[route_table_id], filters={'vpc_id': vpc_id})
+    return route_tables[0] if route_tables else None
+
+
+def get_route_table_by_tags(vpc_conn, vpc_id, tags):
+    route_tables = vpc_conn.get_all_route_tables(filters={'vpc_id': vpc_id})
+    for route_table in route_tables:
+        this_tags = get_resource_tags(vpc_conn, route_table.id)
+        if tags_match(tags, this_tags):
+            return route_table
+
+
+def route_spec_matches_route(route_spec, route):
+    key_attr_map = {
+        'destination_cidr_block': 'destination_cidr_block',
+        'gateway_id': 'gateway_id',
+        'instance_id': 'instance_id',
+        'interface_id': 'interface_id',
+        'vpc_peering_connection_id': 'vpc_peering_connection_id',
+    }
+    for k in key_attr_map.iterkeys():
+        if k in route_spec:
+            if route_spec[k] != getattr(route, k):
+                return False
+    return True
+
+
+def rename_key(d, old_key, new_key):
+    d[new_key] = d[old_key]
+    del d[old_key]
+
+
+def index_of_matching_route(route_spec, routes_to_match):
+    for i, route in enumerate(routes_to_match):
+        if route_spec_matches_route(route_spec, route):
+            return i
+
+
+def ensure_routes(vpc_conn, route_table, route_specs, check_mode):
+    routes_to_match = list(route_table.routes)
+    route_specs_to_create = []
+    for route_spec in route_specs:
+        i = index_of_matching_route(route_spec, routes_to_match)
+        if i is None:
+            route_specs_to_create.append(route_spec)
+        else:
+            del routes_to_match[i]
+    routes_to_delete = [r for r in routes_to_match
+                        if r.gateway_id != 'local']
+
+    changed = routes_to_delete or route_specs_to_create
+    if check_mode and changed:
+        return {'changed': True}
+    elif changed:
+        for route_spec in route_specs_to_create:
+            vpc_conn.create_route(route_table.id, **route_spec)
+
+        for route in routes_to_delete:
+            vpc_conn.delete_route(route_table.id, route.destination_cidr_block)
+        return {'changed': True}
+    else:
+        return {'changed': False}
+
+
+def get_subnet_by_cidr(vpc_conn, vpc_id, cidr):
+    subnets = vpc_conn.get_all_subnets(
+        filters={'cidr': cidr, 'vpc_id': vpc_id})
+    if len(subnets) != 1:
+        raise RouteTableException(
+            'Subnet with CIDR {0} has {1} matches'.format(cidr, len(subnets))
+        )
+    return subnets[0]
+
+
+def get_subnet_by_id(vpc_conn, vpc_id, subnet_id):
+    subnets = vpc_conn.get_all_subnets(filters={'subnet-id': subnet_id})
+    if len(subnets) != 1:
+        raise RouteTableException(
+            'Subnet with ID {0} has {1} matches'.format(subnet_id, len(subnets))
+        )
+    return subnets[0]
+
+
+def ensure_subnet_association(vpc_conn, vpc_id, route_table_id, subnet_id,
+                              check_mode):
+    route_tables = vpc_conn.get_all_route_tables(
+        filters={'association.subnet_id': subnet_id, 'vpc_id': vpc_id}
+    )
+    for route_table in route_tables:
+        if route_table.id is None:
+            continue
+        for a in route_table.associations:
+            if a.subnet_id == subnet_id:
+                if route_table.id == route_table_id:
+                    return {'changed': False, 'association_id': a.id}
+                else:
+                    if check_mode:
+                        return {'changed': True}
+                    vpc_conn.disassociate_route_table(a.id)
+
+    association_id = vpc_conn.associate_route_table(route_table_id, subnet_id)
+    return {'changed': True, 'association_id': association_id}
+
+
+def ensure_subnet_associations(vpc_conn, vpc_id, route_table, subnets,
+                               check_mode):
+    current_association_ids = [a.id for a in route_table.associations]
+    new_association_ids = []
+    changed = False
+    for subnet in subnets:
+        result = ensure_subnet_association(
+            vpc_conn, vpc_id, route_table.id, subnet.id, check_mode)
+        changed = changed or result['changed']
+        if changed and check_mode:
+            return {'changed': True}
+        new_association_ids.append(result['association_id'])
+
+    to_delete = [a_id for a_id in current_association_ids
+                 if a_id not in new_association_ids]
+
+    for a_id in to_delete:
+        if check_mode:
+            return {'changed': True}
+        changed = True
+        vpc_conn.disassociate_route_table(a_id)
+
+    return {'changed': changed}
+
+
+def ensure_route_table_absent(vpc_conn, vpc_id, route_table_id, resource_tags,
+                              check_mode):
+    if route_table_id:
+        route_table = get_route_table_by_id(vpc_conn, vpc_id, route_table_id)
+    elif resource_tags:
+        route_table = get_route_table_by_tags(vpc_conn, vpc_id, resource_tags)
+    else:
+        raise RouteTableException(
+            'must provide route_table_id or resource_tags')
+
+    if route_table is None:
+        return {'changed': False}
+
+    if check_mode:
+        return {'changed': True}
+
+    vpc_conn.delete_route_table(route_table.id)
+    return {'changed': True}
+
+
+def ensure_route_table_present(vpc_conn, vpc_id, route_table_id, resource_tags,
+                               routes, subnets, check_mode):
+    changed = False
+    tags_valid = False
+    if route_table_id:
+        route_table = get_route_table_by_id(vpc_conn, vpc_id, route_table_id)
+    elif resource_tags:
+        route_table = get_route_table_by_tags(vpc_conn, vpc_id, resource_tags)
+        tags_valid = route_table is not None
+    else:
+        raise RouteTableException(
+            'must provide route_table_id or resource_tags')
+
+    if check_mode and route_table is None:
+        return {'changed': True}
+
+    if route_table is None:
+        try:
+            route_table = vpc_conn.create_route_table(vpc_id)
+        except EC2ResponseError as e:
+            raise RouteTableException(
+                'Unable to create route table {0}, error: {1}'
+                .format(route_table_id or resource_tags, e)
+            )
+
+    if not tags_valid and resource_tags is not None:
+        result = ensure_tags(vpc_conn, route_table.id, resource_tags,
+                             add_only=True, dry_run=check_mode)
+        changed = changed or result['changed']
+
+    if routes is not None:
+        try:
+            result = ensure_routes(vpc_conn, route_table, routes, check_mode)
+            changed = changed or result['changed']
+        except EC2ResponseError as e:
+            raise RouteTableException(
+                'Unable to ensure routes for route table {0}, error: {1}'
+                .format(route_table, e)
+            )
+
+    if subnets:
+        associated_subnets = []
+        try:
+            for subnet_name in subnets:
+                if ('.' in subnet_name) and ('/' in subnet_name):
+                    subnet = get_subnet_by_cidr(vpc_conn, vpc_id, subnet_name)
+                else:
+                    subnet = get_subnet_by_id(vpc_conn, vpc_id, subnet_name)
+                associated_subnets.append(subnet)
+        except EC2ResponseError as e:
+            raise RouteTableException(
+                'Unable to find subnets for route table {0}, error: {1}'
+                .format(route_table, e)
+            )
+
+        try:
+            result = ensure_subnet_associations(
+                vpc_conn, vpc_id, route_table, associated_subnets, check_mode)
+            changed = changed or result['changed']
+        except EC2ResponseError as e:
+            raise RouteTableException(
+                'Unable to associate subnets for route table {0}, error: {1}'
+                .format(route_table, e)
+            )
+
+    return {
+        'changed': changed,
+        'route_table_id': route_table.id,
+    }
+
+
+def main():
+    argument_spec = ec2_argument_spec()
+    argument_spec.update({
+        'vpc_id': {'required': True},
+        'route_table_id': {'required': False},
+        'resource_tags': {'type': 'dict', 'required': False},
+        'routes': {'type': 'list', 'required': False},
+        'subnets': {'type': 'list', 'required': False},
+        'state': {'choices': ['present', 'absent'], 'default': 'present'},
+    })
+    module = AnsibleModule(
+        argument_spec=argument_spec,
+        supports_check_mode=True,
+    )
+
+    ec2_url, aws_access_key, aws_secret_key, region = get_ec2_creds(module)
+    if not region:
+        module.fail_json(msg='Region must be specified')
+
+    try:
+        vpc_conn = boto.vpc.connect_to_region(
+            region,
+            aws_access_key_id=aws_access_key,
+            aws_secret_access_key=aws_secret_key
+        )
+    except boto.exception.NoAuthHandlerFound as e:
+        module.fail_json(msg=str(e))
+
+    vpc_id = module.params.get('vpc_id')
+    route_table_id = module.params.get('route_table_id')
+    resource_tags = module.params.get('resource_tags')
+
+    routes = module.params.get('routes')
+    for route_spec in routes:
+        rename_key(route_spec, 'dest', 'destination_cidr_block')
+
+    subnets = module.params.get('subnets')
+    state = module.params.get('state', 'present')
+
+    try:
+        if state == 'present':
+            result = ensure_route_table_present(
+                vpc_conn, vpc_id, route_table_id, resource_tags,
+                routes, subnets, module.check_mode
+            )
+        elif state == 'absent':
+            result = ensure_route_table_absent(
+                vpc_conn, vpc_id, route_table_id, resource_tags,
+                module.check_mode
+            )
+    except RouteTableException as e:
+        module.fail_json(msg=str(e))
+
+    module.exit_json(**result)
+
+from ansible.module_utils.basic import *  # noqa
+from ansible.module_utils.ec2 import *  # noqa
+
+if __name__ == '__main__':
+    main()