From f405857f50d6e197b1337ebf7be1681465f361b3 Mon Sep 17 00:00:00 2001 From: Alex Stephen Date: Mon, 13 Aug 2018 11:55:10 -0700 Subject: [PATCH] Bug fixes for gcp_compute_firewall (#42807) --- .../cloud/google/gcp_compute_firewall.py | 45 +++--- .../gcp_compute_firewall/tasks/main.yml | 132 +++++++++--------- 2 files changed, 88 insertions(+), 89 deletions(-) diff --git a/lib/ansible/modules/cloud/google/gcp_compute_firewall.py b/lib/ansible/modules/cloud/google/gcp_compute_firewall.py index 01d77b26084..747ea290ae7 100644 --- a/lib/ansible/modules/cloud/google/gcp_compute_firewall.py +++ b/lib/ansible/modules/cloud/google/gcp_compute_firewall.py @@ -88,11 +88,10 @@ options: required: false network: description: - - 'URL of the network resource for this firewall rule. If not - specified when creating a firewall rule, the default network is - used: global/networks/default If you choose to specify this - property, you can specify the network as a full or partial URL. - For example, the following are all valid URLs: + - 'URL of the network resource for this firewall rule. If not specified when creating + a firewall rule, the default network is used: global/networks/default If you choose to + specify this property, you can specify the network as a full or partial URL. For + example, the following are all valid URLs: U(https://www.googleapis.com/compute/v1/projects/myproject/global/) networks/my-network projects/myproject/global/networks/my-network global/networks/default .' @@ -130,21 +129,19 @@ extends_documentation_fragment: gcp EXAMPLES = ''' - name: create a firewall gcp_compute_firewall: - name: testObject + name: "test_object" allowed: - - ip_protocol: 'tcp' - ports: - - "22" + - ip_protocol: tcp + ports: + - '22' target_tags: - - test-ssh-server - - staging-ssh-server + - test-ssh-server + - staging-ssh-server source_tags: - - test-ssh-clients - project: testProject - auth_kind: service_account - service_account_file: /tmp/auth.pem - scopes: - - https://www.googleapis.com/auth/compute + - test-ssh-clients + project: "test_project" + auth_kind: "service_account" + service_account_file: "/tmp/auth.pem" state: present ''' @@ -199,11 +196,10 @@ RETURN = ''' type: str network: description: - - 'URL of the network resource for this firewall rule. If not - specified when creating a firewall rule, the default network is - used: global/networks/default If you choose to specify this - property, you can specify the network as a full or partial URL. - For example, the following are all valid URLs: + - 'URL of the network resource for this firewall rule. If not specified when creating + a firewall rule, the default network is used: global/networks/default If you choose to + specify this property, you can specify the network as a full or partial URL. For + example, the following are all valid URLs: U(https://www.googleapis.com/compute/v1/projects/myproject/global/) networks/my-network projects/myproject/global/networks/my-network global/networks/default .' @@ -273,6 +269,9 @@ def main(): ) ) + if not module.params['scopes']: + module.params['scopes'] = ['https://www.googleapis.com/auth/compute'] + state = module.params['state'] kind = 'compute#firewall' @@ -416,7 +415,7 @@ def async_op_url(module, extra_data=None): def wait_for_operation(module, response): op_result = return_if_object(module, response, 'compute#operation') if op_result is None: - return None + return {} status = navigate_hash(op_result, ['status']) wait_done = wait_for_completion(status, op_result, module) return fetch_resource(module, navigate_hash(wait_done, ['targetLink']), 'compute#firewall') diff --git a/test/integration/targets/gcp_compute_firewall/tasks/main.yml b/test/integration/targets/gcp_compute_firewall/tasks/main.yml index 84674c336ef..35ff0e4a1c1 100644 --- a/test/integration/targets/gcp_compute_firewall/tasks/main.yml +++ b/test/integration/targets/gcp_compute_firewall/tasks/main.yml @@ -17,38 +17,34 @@ gcp_compute_firewall: name: "{{ resource_name }}" allowed: - - ip_protocol: 'tcp' - ports: - - "22" + - ip_protocol: tcp + ports: + - '22' target_tags: - - test-ssh-server - - staging-ssh-server + - test-ssh-server + - staging-ssh-server source_tags: - - test-ssh-clients + - test-ssh-clients project: "{{ gcp_project }}" auth_kind: "{{ gcp_cred_kind }}" service_account_file: "{{ gcp_cred_file }}" - scopes: - - https://www.googleapis.com/auth/compute state: absent #---------------------------------------------------------- - name: create a firewall gcp_compute_firewall: name: "{{ resource_name }}" allowed: - - ip_protocol: 'tcp' - ports: - - "22" + - ip_protocol: tcp + ports: + - '22' target_tags: - - test-ssh-server - - staging-ssh-server + - test-ssh-server + - staging-ssh-server source_tags: - - test-ssh-clients + - test-ssh-clients project: "{{ gcp_project }}" auth_kind: "{{ gcp_cred_kind }}" service_account_file: "{{ gcp_cred_file }}" - scopes: - - https://www.googleapis.com/auth/compute state: present register: result - name: assert changed is true @@ -57,31 +53,35 @@ - result.changed == true - "result.kind == 'compute#firewall'" - name: verify that firewall was created - shell: | - gcloud compute firewall-rules describe --project="{{ gcp_project}}" "{{ resource_name }}" - register: results -- name: verify that command succeeded - assert: - that: - - results.rc == 0 -# ---------------------------------------------------------------------------- -- name: create a firewall that already exists - gcp_compute_firewall: - name: "{{ resource_name }}" - allowed: - - ip_protocol: 'tcp' - ports: - - "22" - target_tags: - - test-ssh-server - - staging-ssh-server - source_tags: - - test-ssh-clients + gcp_compute_firewall_facts: + filters: + - name = {{ resource_name }} project: "{{ gcp_project }}" auth_kind: "{{ gcp_cred_kind }}" service_account_file: "{{ gcp_cred_file }}" scopes: - https://www.googleapis.com/auth/compute + register: results +- name: verify that command succeeded + assert: + that: + - results['items'] | length == 1 +# ---------------------------------------------------------------------------- +- name: create a firewall that already exists + gcp_compute_firewall: + name: "{{ resource_name }}" + allowed: + - ip_protocol: tcp + ports: + - '22' + target_tags: + - test-ssh-server + - staging-ssh-server + source_tags: + - test-ssh-clients + project: "{{ gcp_project }}" + auth_kind: "{{ gcp_cred_kind }}" + service_account_file: "{{ gcp_cred_file }}" state: present register: result - name: assert changed is false @@ -94,19 +94,17 @@ gcp_compute_firewall: name: "{{ resource_name }}" allowed: - - ip_protocol: 'tcp' - ports: - - "22" + - ip_protocol: tcp + ports: + - '22' target_tags: - - test-ssh-server - - staging-ssh-server + - test-ssh-server + - staging-ssh-server source_tags: - - test-ssh-clients + - test-ssh-clients project: "{{ gcp_project }}" auth_kind: "{{ gcp_cred_kind }}" service_account_file: "{{ gcp_cred_file }}" - scopes: - - https://www.googleapis.com/auth/compute state: absent register: result - name: assert changed is true @@ -115,33 +113,35 @@ - result.changed == true - result.has_key('kind') == False - name: verify that firewall was deleted - shell: | - gcloud compute firewall-rules describe --project="{{ gcp_project}}" "{{ resource_name }}" - register: results - failed_when: results.rc == 0 -- name: verify that command succeeded - assert: - that: - - results.rc == 1 - - "\"'projects/{{ gcp_project }}/global/firewalls/{{ resource_name }}' was not found\" in results.stderr" -# ---------------------------------------------------------------------------- -- name: delete a firewall that does not exist - gcp_compute_firewall: - name: "{{ resource_name }}" - allowed: - - ip_protocol: 'tcp' - ports: - - "22" - target_tags: - - test-ssh-server - - staging-ssh-server - source_tags: - - test-ssh-clients + gcp_compute_firewall_facts: + filters: + - name = {{ resource_name }} project: "{{ gcp_project }}" auth_kind: "{{ gcp_cred_kind }}" service_account_file: "{{ gcp_cred_file }}" scopes: - https://www.googleapis.com/auth/compute + register: results +- name: verify that command succeeded + assert: + that: + - results['items'] | length == 0 +# ---------------------------------------------------------------------------- +- name: delete a firewall that does not exist + gcp_compute_firewall: + name: "{{ resource_name }}" + allowed: + - ip_protocol: tcp + ports: + - '22' + target_tags: + - test-ssh-server + - staging-ssh-server + source_tags: + - test-ssh-clients + project: "{{ gcp_project }}" + auth_kind: "{{ gcp_cred_kind }}" + service_account_file: "{{ gcp_cred_file }}" state: absent register: result - name: assert changed is false