[GCE] Support default credentials (#22723)

Add support for default credentials. Practically, this means that a playbook creator would not have to specify the service_account_email or credentials_file Ansible parameters.

Default Credentials only work when running on Google Cloud Platform. The 'project_id' is still required.

A test has been added to trigger this condition.

lib/ansible/module_utils/gcp.py

@@ -155,6 +155,8 @@ def _get_gcp_credentials(module, require_valid_json=True, check_libcloud=False):
     Additionally, flags may be set to require valid json and check the libcloud
     version.
 
+    AnsibleModule.fail_json is called only if the project_id cannot be found.
+
     :param module: initialized Ansible module object
     :type module: `class AnsibleModule`
 
@@ -190,19 +192,27 @@ def _get_gcp_credentials(module, require_valid_json=True, check_libcloud=False):
 
     if credentials_file is None or project_id is None or service_account_email is None:
         if check_libcloud is True:
-            # TODO(supertom): this message is legacy and integration tests depend on it.
+            if project_id is None:
-            module.fail_json(msg='Missing GCE connection parameters in libcloud '
+                # TODO(supertom): this message is legacy and integration tests depend on it.
-                             'secrets file.')
+                module.fail_json(msg='Missing GCE connection parameters in libcloud '
-            return None
+                                 'secrets file.')
         else:
-            if credentials_file is None or project_id is None:
+            if project_id is None:
                 module.fail_json(msg=('GCP connection error: unable to determine project (%s) or '
                 'credentials file (%s)' % (project_id, credentials_file)))
+        # Set these fields to empty strings if they are None
+        # consumers of this will make the distinction between an empty string
+        # and None.
+        if credentials_file is None:
+            credentials_file = ''
+        if service_account_email is None:
+            service_account_email = ''
 
     # ensure the credentials file is found and is in the proper format.
-    _validate_credentials_file(module, credentials_file,
+    if credentials_file:
-                               require_valid_json=require_valid_json,
+        _validate_credentials_file(module, credentials_file,
-                               check_libcloud=check_libcloud)
+                                   require_valid_json=require_valid_json,
+                                   check_libcloud=check_libcloud)
 
     return {'service_account_email': service_account_email,
             'credentials_file': credentials_file,
@@ -279,6 +289,9 @@ def get_google_cloud_credentials(module, scopes=[]):
     """
     Get credentials object for use with Google Cloud client.
 
+    Attempts to obtain credentials by calling _get_gcp_credentials. If those are
+    not present will attempt to connect via Application Default Credentials.
+
     To connect via libcloud, don't use this function, use gcp_connect instead.  For
     Google Python API Client, see get_google_api_auth for how to connect.
 
@@ -314,8 +327,10 @@ def get_google_cloud_credentials(module, scopes=[]):
             if scopes:
                 credentials = credentials.with_scopes(scopes)
         else:
-            credentials = google.auth.default(
+            (credentials, project_id) = google.auth.default(
-                scopes=scopes)[0]
+                scopes=scopes)
+            if project_id is not None:
+                conn_params['project_id'] = project_id
 
         return (credentials, conn_params)
     except Exception as e:

test/units/module_utils/gcp/test_auth.py

@@ -1,5 +1,5 @@
 # -*- coding: utf-8 -*-
-# (c) 2016, Tom Melendez <tom@supertom.com>
+# (c) 2016, Tom Melendez (@supertom) <tom@supertom.com>
 #
 # This file is part of Ansible
 #
@@ -18,8 +18,10 @@
 import os
 import sys
 
+import pytest
+
 from ansible.compat.tests import mock, unittest
-from ansible.module_utils.gcp import (_get_gcp_ansible_credentials, _get_gcp_environ_var,
+from ansible.module_utils.gcp import (_get_gcp_ansible_credentials, _get_gcp_credentials, _get_gcp_environ_var,
                                       _get_gcp_libcloud_credentials, _get_gcp_environment_credentials,
                                       _validate_credentials_file)
 
@@ -31,21 +33,32 @@ def fake_get_gcp_environ_var(var_name, default_value):
     else:
         return fake_env_data[var_name]
 
+# Fake AnsibleModule for use in tests
+class FakeModule(object):
+    class Params():
+        data = {}
+
+        def get(self, key, alt=None):
+            if key in self.data:
+                return self.data[key]
+            else:
+                return alt
+
+    def __init__(self, data={}):
+        self.params = FakeModule.Params()
+        self.params.data = data
+
+    def fail_json(self, **kwargs):
+        raise ValueError("fail_json")
+
 class GCPAuthTestCase(unittest.TestCase):
     """Tests to verify different Auth mechanisms."""
+
+    def setup_method(self, method):
+        global fake_env_data
+        fake_env_data = {'GCE_EMAIL': 'gce-email'}
+
     def test_get_gcp_ansible_credentials(self):
-        # create a fake (AnsibleModule) object to pass to the function
-        class FakeModule(object):
-            class Params():
-                data = {}
-                def get(self, key, alt=None):
-                    if key in self.data:
-                        return self.data[key]
-                    else:
-                        return alt
-            def __init__(self, data={}):
-                self.params = FakeModule.Params()
-                self.params.data = data
         input_data = {'service_account_email': 'mysa',
                       'credentials_file': 'path-to-file.json',
                       'project_id': 'my-cool-project'}
@@ -179,3 +192,23 @@ class GCPAuthTestCase(unittest.TestCase):
         expected = tuple(['my-sa-email', '/path/to/creds.json', 'my-project'])
         actual = _get_gcp_environment_credentials('my-sa-email', '/path/to/creds.json', None)
         self.assertEqual(expected, actual)
+
+    @mock.patch('ansible.module_utils.gcp._get_gcp_environ_var',
+                side_effect=fake_get_gcp_environ_var)
+    def test_get_gcp_credentials(self, mockobj):
+        global fake_env_data
+
+        fake_env_data = {}
+        module = FakeModule()
+        module.params.data = {}
+        # Nothing is set, calls fail_json
+        with pytest.raises(ValueError):
+            _get_gcp_credentials(module)
+
+        # project_id (only) is set from Ansible params.
+        module.params.data['project_id'] = 'my-project'
+        actual = _get_gcp_credentials(module, require_valid_json=True, check_libcloud=False)
+        expected = {'service_account_email': '',
+                    'project_id': 'my-project',
+                    'credentials_file': ''}
+        self.assertEqual(expected, actual)