Add ansible stable-2.9 job and run 2.8 and 2.9

We need to run master of openstacksdk against the stable ansible
branches that have openstack modules.

This partially reverts commit 666381d6e4.

We no longer are running jobs against devel of ansible, so we don't
need to do the failure job.

Change-Id: Ic783cfd564001a0bd00182725d26928ae6422c3f

.zuul.yaml

@@ -285,55 +285,12 @@
     vars:
       tox_envlist: ansible
 
-- job:
-    name: openstacksdk-ansible-devel-functional-devstack
-    parent: openstacksdk-ansible-functional-devstack
-    description: |
-      Run openstacksdk ansible functional tests against a master devstack
-      using git devel branch version of ansible.
-    branches: ^(devel|master)$
-    required-projects:
-      - name: github.com/ansible/ansible
-        override-checkout: devel
-      - name: openstack/openstacksdk
-        override-checkout: master
-      - name: openstack/devstack
-        override-checkout: master
-    vars:
-      # test-matrix grabs branch from the zuul branch setting. If the job
-      # is triggered by ansible, that branch will be devel which doesn't
-      # make sense to devstack. Override so that we run the right thing.
-      test_matrix_branch: master
-      tox_install_siblings: true
-
-- job:
-    name: openstacksdk-ansible-stable-2.6-functional-devstack
-    parent: openstacksdk-ansible-functional-devstack
-    description: |
-      Run openstacksdk ansible functional tests against a master devstack
-      using git stable-2.6 branch version of ansible.
-    branches: ^(stable-2.6|master)$
-    required-projects:
-      - name: github.com/ansible/ansible
-        override-checkout: stable-2.6
-      - name: openstack/openstacksdk
-        override-checkout: master
-      - name: openstack/devstack
-        override-checkout: master
-    vars:
-      # test-matrix grabs branch from the zuul branch setting. If the job
-      # is triggered by ansible, that branch will be devel which doesn't
-      # make sense to devstack. Override so that we run the right thing.
-      test_matrix_branch: master
-      tox_install_siblings: true
-
 - job:
     name: openstacksdk-ansible-stable-2.8-functional-devstack
     parent: openstacksdk-ansible-functional-devstack
     description: |
       Run openstacksdk ansible functional tests against a master devstack
       using git stable-2.8 branch version of ansible.
-    branches: ^(stable-2.8|master)$
     required-projects:
       - name: github.com/ansible/ansible
         override-checkout: stable-2.8
@@ -348,6 +305,26 @@
       test_matrix_branch: master
       tox_install_siblings: true
 
+- job:
+    name: openstacksdk-ansible-stable-2.9-functional-devstack
+    parent: openstacksdk-ansible-functional-devstack
+    description: |
+      Run openstacksdk ansible functional tests against a master devstack
+      using git stable-2.9 branch version of ansible.
+    required-projects:
+      - name: github.com/ansible/ansible
+        override-checkout: stable-2.9
+      - name: openstack/openstacksdk
+        override-checkout: master
+      - name: openstack/devstack
+        override-checkout: master
+    vars:
+      # test-matrix grabs branch from the zuul branch setting. If the job
+      # is triggered by ansible, that branch will be devel which doesn't
+      # make sense to devstack. Override so that we run the right thing.
+      test_matrix_branch: master
+      tox_install_siblings: true
+
 - job:
     name: openstacksdk-functional-devstack-masakari
     parent: openstacksdk-functional-devstack-minimum
@@ -423,6 +400,10 @@
             voting: false
         - ansible-collections-openstack-functional-devstack:
             voting: false
+        - openstacksdk-ansible-stable-2.8-functional-devstack:
+            voting: false
+        - openstacksdk-ansible-stable-2.9-functional-devstack:
+            voting: false
     gate:
       jobs:
         - openstacksdk-functional-devstack

extras/run-ansible-tests.sh

@@ -30,12 +30,71 @@
 #    run-ansible-tests.sh -e ansible -c cloudX auth keypair network
 #############################################################################
 
-echo "
-    Thanks for submitting patch for Openstack Ansible modules!
-    We moved Openstack Ansible modules to Openstack repositories.
-    Next patches should be submitted not with Ansible Github but with
-    Openstack Gerrit: https://review.opendev.org/#/q/project:openstack/ansible-collections-openstack
-    Please submit your code there from now.
-    Thanks for your contribution and sorry for inconvienience.
-"
-exit 1
+
+CLOUD="devstack-admin"
+ENVDIR=
+USE_DEV=0
+
+while getopts "c:de:" opt
+do
+    case $opt in
+    d) USE_DEV=1 ;;
+    c) CLOUD=${OPTARG} ;;
+    e) ENVDIR=${OPTARG} ;;
+    ?) echo "Invalid option: -${OPTARG}"
+       exit 1;;
+    esac
+done
+
+if [ -z ${ENVDIR} ]
+then
+    echo "Option -e is required"
+    exit 1
+fi
+
+shift $((OPTIND-1))
+TAGS=$( echo "$*" | tr ' ' , )
+
+# We need to source the current tox environment so that Ansible will
+# be setup for the correct python environment.
+source $ENVDIR/bin/activate
+
+if [ ${USE_DEV} -eq 1 ]
+then
+    if [ -d ${ENVDIR}/ansible ]
+    then
+        echo "Using existing Ansible source repo"
+    else
+        echo "Installing Ansible source repo at $ENVDIR"
+        git clone --recursive https://github.com/ansible/ansible.git ${ENVDIR}/ansible
+    fi
+    source $ENVDIR/ansible/hacking/env-setup
+fi
+
+# Run the shade Ansible tests
+tag_opt=""
+if [ ! -z ${TAGS} ]
+then
+    tag_opt="--tags ${TAGS}"
+fi
+
+# Loop through all ANSIBLE_VAR_ environment variables to allow passing the further
+for var in $(env | grep -e '^ANSIBLE_VAR_'); do
+  VAR_NAME=${var%%=*} # split variable name from value
+  ANSIBLE_VAR_NAME=${VAR_NAME#ANSIBLE_VAR_} # cut ANSIBLE_VAR_ prefix from variable name
+  ANSIBLE_VAR_NAME=${ANSIBLE_VAR_NAME,,} # lowercase ansible variable
+  ANSIBLE_VAR_VALUE=${!VAR_NAME} # Get the variable value
+  ANSIBLE_VARS+="${ANSIBLE_VAR_NAME}=${ANSIBLE_VAR_VALUE} " # concat variables
+done
+
+# Until we have a module that lets us determine the image we want from
+# within a playbook, we have to find the image here and pass it in.
+# We use the openstack client instead of nova client since it can use clouds.yaml.
+IMAGE=`openstack --os-cloud=${CLOUD} image list -f value -c Name | grep cirros | grep -v -e ramdisk -e kernel`
+if [ $? -ne 0 ]
+then
+  echo "Failed to find Cirros image"
+  exit 1
+fi
+
+ansible-playbook -vvv ./openstack/tests/ansible/run.yml -e "cloud=${CLOUD} image=${IMAGE} ${ANSIBLE_VARS}" ${tag_opt}

openstack/tests/ansible/README.txt

@@ -0,0 +1,26 @@
+This directory contains a testing infrastructure for the Ansible
+OpenStack modules. You will need a clouds.yaml file in order to run
+the tests. You must provide a value for the `cloud` variable for each
+run (using the -e option) as a default is not currently provided.
+
+If you want to run these tests against devstack, it is easiest to use
+the tox target. This assumes you have a devstack-admin cloud defined
+in your clouds.yaml file that points to devstack. Some examples of
+using tox:
+
+    tox -e ansible
+
+    tox -e ansible keypair security_group
+
+If you want to run these tests directly, or against different clouds,
+then you'll need to use the ansible-playbook command that comes with
+the Ansible distribution and feed it the run.yml playbook. Some examples:
+
+    # Run all module tests against a provider
+    ansible-playbook run.yml -e "cloud=hp"
+
+    # Run only the keypair and security_group tests
+    ansible-playbook run.yml -e "cloud=hp" --tags "keypair,security_group"
+
+    # Run all tests except security_group
+    ansible-playbook run.yml -e "cloud=hp" --skip-tags "security_group"

openstack/tests/ansible/hooks/post_test_hook.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# TODO(shade) Rework for Zuul v3
+
+export OPENSTACKSDK_DIR="$BASE/new/openstacksdk"
+
+cd $OPENSTACKSDK_DIR
+sudo chown -R jenkins:stack $OPENSTACKSDK_DIR
+
+echo "Running shade Ansible test suite"
+
+if [ ${OPENSTACKSDK_ANSIBLE_DEV:-0} -eq 1 ]
+then
+    # Use the upstream development version of Ansible
+    set +e
+    sudo -E -H -u jenkins tox -eansible -- -d
+    EXIT_CODE=$?
+    set -e
+else
+    # Use the release version of Ansible
+    set +e
+    sudo -E -H -u jenkins tox -eansible
+    EXIT_CODE=$?
+    set -e
+fi
+
+
+exit $EXIT_CODE

openstack/tests/ansible/roles/auth/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Authenticate to the cloud
+  os_auth:
+    cloud={{ cloud }}
+
+- debug: var=service_catalog

openstack/tests/ansible/roles/client_config/tasks/main.yml

@@ -0,0 +1,7 @@
+---
+- name: List all profiles
+  os_client_config:
+  register: list
+
+# WARNING: This will output sensitive authentication information!!!!
+- debug: var=list

openstack/tests/ansible/roles/group/defaults/main.yml

@@ -0,0 +1 @@
+group_name: ansible_group

openstack/tests/ansible/roles/group/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+- name: Create group
+  os_group:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ group_name }}"
+
+- name: Update group
+  os_group:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ group_name }}"
+     description: "updated description"
+
+- name: Delete group
+  os_group:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ group_name }}"

openstack/tests/ansible/roles/image/defaults/main.yml

@@ -0,0 +1 @@
+image_name: ansible_image

openstack/tests/ansible/roles/image/tasks/main.yml

@@ -0,0 +1,54 @@
+---
+- name: Create a test image file
+  shell: mktemp
+  register: tmp_file
+
+- name: Fill test image file to 1MB
+  shell: truncate -s 1048576 {{ tmp_file.stdout }}
+
+- name: Create raw image (defaults)
+  os_image:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ image_name }}"
+     filename: "{{ tmp_file.stdout }}"
+     disk_format: raw
+  register: image
+
+- debug: var=image
+
+- name: Delete raw image (defaults)
+  os_image:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ image_name }}"
+
+- name: Create raw image (complex)
+  os_image:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ image_name }}"
+     filename: "{{ tmp_file.stdout }}"
+     disk_format: raw
+     is_public: True
+     min_disk: 10
+     min_ram: 1024
+     kernel: cirros-vmlinuz
+     ramdisk: cirros-initrd
+     properties:
+        cpu_arch: x86_64
+        distro: ubuntu
+  register: image
+
+- debug: var=image
+
+- name: Delete raw image (complex)
+  os_image:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ image_name }}"
+
+- name: Delete test image file
+  file:
+     name: "{{ tmp_file.stdout }}"
+     state: absent

openstack/tests/ansible/roles/keypair/defaults/main.yml

@@ -0,0 +1 @@
+keypair_name: shade_keypair

openstack/tests/ansible/roles/keypair/tasks/main.yml

@@ -0,0 +1,62 @@
+---
+- name: Create keypair (non-existing)
+  os_keypair:
+     cloud: "{{ cloud }}"
+     name: "{{ keypair_name }}"
+     state: present
+  register:
+    keypair
+
+# This assert verifies that Ansible is capable serializing data returned by SDK
+- name: Ensure private key is returned
+  assert:
+    that:
+      - keypair.key.public_key is defined and keypair.key.public_key
+
+- name: Delete keypair (non-existing)
+  os_keypair:
+      cloud: "{{ cloud }}"
+      name: "{{ keypair_name }}"
+      state: absent
+
+- name: Generate test key file
+  user:
+      name: "{{ ansible_env.USER }}"
+      generate_ssh_key: yes
+      ssh_key_file: .ssh/shade_id_rsa
+
+- name: Create keypair (file)
+  os_keypair:
+      cloud: "{{ cloud }}"
+      name: "{{ keypair_name }}"
+      state: present
+      public_key_file: "{{ ansible_env.HOME }}/.ssh/shade_id_rsa.pub"
+
+- name: Delete keypair (file)
+  os_keypair:
+      cloud: "{{ cloud }}"
+      name: "{{ keypair_name }}"
+      state: absent
+
+- name: Create keypair (key)
+  os_keypair:
+      cloud: "{{ cloud }}"
+      name: "{{ keypair_name }}"
+      state: present
+      public_key: "{{ lookup('file', '~/.ssh/shade_id_rsa.pub') }}"
+
+- name: Delete keypair (key)
+  os_keypair:
+      cloud: "{{ cloud }}"
+      name: "{{ keypair_name }}"
+      state: absent
+
+- name: Delete test key pub file
+  file:
+      name: "{{ ansible_env.HOME }}/.ssh/shade_id_rsa.pub"
+      state: absent
+
+- name: Delete test key pvt file
+  file:
+      name: "{{ ansible_env.HOME }}/.ssh/shade_id_rsa"
+      state: absent

openstack/tests/ansible/roles/keystone_domain/defaults/main.yml

@@ -0,0 +1 @@
+domain_name: ansible_domain

openstack/tests/ansible/roles/keystone_domain/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+- name: Create keystone domain
+  os_keystone_domain:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ domain_name }}"
+     description: "test description"
+
+- name: Update keystone domain
+  os_keystone_domain:
+     cloud: "{{ cloud }}"
+     name: "{{ domain_name }}"
+     description: "updated description"
+
+- name: Delete keystone domain
+  os_keystone_domain:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ domain_name }}"

openstack/tests/ansible/roles/keystone_role/defaults/main.yml

@@ -0,0 +1 @@
+role_name: ansible_keystone_role

openstack/tests/ansible/roles/keystone_role/tasks/main.yml

@@ -0,0 +1,12 @@
+---
+- name: Create keystone role
+  os_keystone_role:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ role_name }}"
+
+- name: Delete keystone role
+  os_keystone_role:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ role_name }}"

openstack/tests/ansible/roles/network/defaults/main.yml

@@ -0,0 +1,3 @@
+network_name: shade_network
+network_shared: false
+network_external: false

openstack/tests/ansible/roles/network/tasks/main.yml

@@ -0,0 +1,14 @@
+---
+- name: Create network
+  os_network:
+     cloud: "{{ cloud }}"
+     name: "{{ network_name }}"
+     state: present
+     shared: "{{ network_shared }}"
+     external: "{{ network_external }}"
+
+- name: Delete network
+  os_network:
+     cloud: "{{ cloud }}"
+     name: "{{ network_name }}"
+     state: absent

openstack/tests/ansible/roles/nova_flavor/tasks/main.yml

@@ -0,0 +1,53 @@
+---
+- name: Create public flavor
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_public_flavor
+     is_public: True
+     ram: 1024
+     vcpus: 1
+     disk: 10
+     ephemeral: 10
+     swap: 1
+     flavorid: 12345
+
+- name: Delete public flavor
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_public_flavor
+
+- name: Create private flavor
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_private_flavor
+     is_public: False
+     ram: 1024
+     vcpus: 1
+     disk: 10
+     ephemeral: 10
+     swap: 1
+     flavorid: 12345
+
+- name: Delete private flavor
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_private_flavor
+
+- name: Create flavor (defaults)
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_defaults_flavor
+     ram: 1024
+     vcpus: 1
+     disk: 10
+
+- name: Delete flavor (defaults)
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_defaults_flavor

openstack/tests/ansible/roles/object/tasks/main.yml

@@ -0,0 +1,37 @@
+---
+- name: Create a test object file
+  shell: mktemp
+  register: tmp_file
+
+- name: Create container
+  os_object:
+     cloud: "{{ cloud }}"
+     state: present
+     container: ansible_container
+     container_access: private
+
+- name: Put object
+  os_object:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_object
+     filename: "{{ tmp_file.stdout }}"
+     container: ansible_container
+
+- name: Delete object
+  os_object:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_object
+     container: ansible_container
+
+- name: Delete container
+  os_object:
+     cloud: "{{ cloud }}"
+     state: absent
+     container: ansible_container
+
+- name: Delete test object file
+  file:
+     name: "{{ tmp_file.stdout }}"
+     state: absent

openstack/tests/ansible/roles/port/defaults/main.yml

@@ -0,0 +1,6 @@
+network_name: ansible_port_network
+network_external: true
+subnet_name: ansible_port_subnet
+port_name: ansible_port
+secgroup_name: ansible_port_secgroup
+no_security_groups: True

openstack/tests/ansible/roles/port/tasks/main.yml

@@ -0,0 +1,101 @@
+---
+- name: Create network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ network_name }}"
+     external: "{{ network_external }}"
+
+- name: Create subnet
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ subnet_name }}"
+     network_name: "{{ network_name }}"
+     cidr: 10.5.5.0/24
+
+- name: Create port (no security group or default security group)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ port_name }}"
+     network: "{{ network_name }}"
+     no_security_groups: "{{ no_security_groups }}"
+     fixed_ips:
+       - ip_address: 10.5.5.69
+  register: port
+
+- debug: var=port
+
+- name: Delete port (no security group or default security group)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ port_name }}"
+
+- name: Create security group
+  os_security_group:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ secgroup_name }}"
+     description: Test group
+
+- name: Create port (with security group)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ port_name }}"
+     network: "{{ network_name }}"
+     fixed_ips:
+       - ip_address: 10.5.5.69
+     security_groups:
+       - "{{ secgroup_name }}"
+  register: port
+
+- debug: var=port
+
+- name: Delete port (with security group)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ port_name }}"
+
+- name: Create port (with allowed_address_pairs and extra_dhcp_opts)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ port_name }}"
+     network: "{{ network_name }}"
+     no_security_groups: "{{ no_security_groups }}"
+     allowed_address_pairs:
+       - ip_address: 10.6.7.0/24
+     extra_dhcp_opts:
+       - opt_name: "bootfile-name"
+         opt_value: "testfile.1"
+  register: port
+
+- debug: var=port
+
+- name: Delete port (with allowed_address_pairs and extra_dhcp_opts)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ port_name }}"
+
+- name: Delete security group
+  os_security_group:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ secgroup_name }}"
+
+- name: Delete subnet
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ subnet_name }}"
+
+- name: Delete network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ network_name }}"

openstack/tests/ansible/roles/router/defaults/main.yml

@@ -0,0 +1,3 @@
+external_network_name: ansible_external_net
+network_external: true
+router_name: ansible_router

openstack/tests/ansible/roles/router/tasks/main.yml

@@ -0,0 +1,95 @@
+---
+# Regular user operation
+- name: Create internal network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ network_name }}"
+     external: false
+
+- name: Create subnet1
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: present
+     network_name: "{{ network_name }}"
+     name: shade_subnet1
+     cidr: 10.7.7.0/24
+
+- name: Create router
+  os_router:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ router_name }}"
+
+- name: Update router (add interface)
+  os_router:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ router_name }}"
+     interfaces:
+         - shade_subnet1
+
+# Admin operation
+- name: Create external network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ external_network_name }}"
+     external: "{{ network_external }}"
+  when:
+    - network_external
+
+- name: Create subnet2
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: present
+     network_name: "{{ external_network_name }}"
+     name: shade_subnet2
+     cidr: 10.6.6.0/24
+  when:
+    - network_external
+
+- name: Update router (add external gateway)
+  os_router:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ router_name }}"
+     network: "{{ external_network_name }}"
+     interfaces:
+         - shade_subnet1
+  when:
+    - network_external
+
+- name: Delete router
+  os_router:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ router_name }}"
+
+- name: Delete subnet1
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: shade_subnet1
+
+- name: Delete subnet2
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: shade_subnet2
+  when:
+    - network_external
+
+- name: Delete internal network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ network_name }}"
+
+- name: Delete external network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ external_network_name }}"
+  when:
+    - network_external

openstack/tests/ansible/roles/security_group/defaults/main.yml

@@ -0,0 +1 @@
+secgroup_name: shade_secgroup

openstack/tests/ansible/roles/security_group/tasks/main.yml

@@ -0,0 +1,123 @@
+---
+- name: Create security group
+  os_security_group:
+     cloud: "{{ cloud }}"
+     name: "{{ secgroup_name }}"
+     state: present
+     description: Created from Ansible playbook
+
+- name: Create empty ICMP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: icmp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Create -1 ICMP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: icmp
+     port_range_min: -1
+     port_range_max: -1
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Create empty TCP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: tcp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Create empty UDP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: udp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Create HTTP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: tcp
+     port_range_min: 80
+     port_range_max: 80
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Create egress rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: tcp
+     port_range_min: 30000
+     port_range_max: 30001
+     remote_ip_prefix: 0.0.0.0/0
+     direction: egress
+
+- name: Delete empty ICMP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: icmp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Delete -1 ICMP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: icmp
+     port_range_min: -1
+     port_range_max: -1
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Delete empty TCP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: tcp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Delete empty UDP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: udp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Delete HTTP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: tcp
+     port_range_min: 80
+     port_range_max: 80
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Delete egress rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: tcp
+     port_range_min: 30000
+     port_range_max: 30001
+     remote_ip_prefix: 0.0.0.0/0
+     direction: egress
+
+- name: Delete security group
+  os_security_group:
+     cloud: "{{ cloud }}"
+     name: "{{ secgroup_name }}"
+     state: absent

openstack/tests/ansible/roles/server/defaults/main.yaml

@@ -0,0 +1,5 @@
+server_network: private
+server_name: ansible_server
+flavor: m1.tiny
+floating_ip_pool_name: public
+boot_volume_size: 5

openstack/tests/ansible/roles/server/tasks/main.yml

@@ -0,0 +1,92 @@
+---
+- name: Create server with meta as CSV
+  os_server:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ server_name }}"
+     image: "{{ image }}"
+     flavor: "{{ flavor }}"
+     network: "{{ server_network }}"
+     auto_floating_ip: false
+     meta: "key1=value1,key2=value2"
+     wait: true
+  register: server
+
+- debug: var=server
+
+- name: Delete server with meta as CSV
+  os_server:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ server_name }}"
+     wait: true
+
+- name: Create server with meta as dict
+  os_server:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ server_name }}"
+     image: "{{ image }}"
+     flavor: "{{ flavor }}"
+     auto_floating_ip: false
+     network: "{{ server_network }}"
+     meta:
+       key1: value1
+       key2: value2
+     wait: true
+  register: server
+
+- debug: var=server
+
+- name: Delete server with meta as dict
+  os_server:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ server_name }}"
+     wait: true
+
+- name: Create server (FIP from pool/network)
+  os_server:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ server_name }}"
+     image: "{{ image }}"
+     flavor: "{{ flavor }}"
+     network: "{{ server_network }}"
+     floating_ip_pools:
+       - "{{ floating_ip_pool_name }}"
+     wait: true
+  register: server
+
+- debug: var=server
+
+- name: Delete server (FIP from pool/network)
+  os_server:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ server_name }}"
+     wait: true
+
+- name: Create server from volume
+  os_server:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ server_name }}"
+     image: "{{ image }}"
+     flavor: "{{ flavor }}"
+     network: "{{ server_network }}"
+     auto_floating_ip: false
+     boot_from_volume: true
+     volume_size: "{{ boot_volume_size }}"
+     terminate_volume: true
+     wait: true
+  register: server
+
+- debug: var=server
+
+- name: Delete server with volume
+  os_server:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ server_name }}"
+     wait: true

openstack/tests/ansible/roles/subnet/defaults/main.yml

@@ -0,0 +1,2 @@
+subnet_name: shade_subnet
+enable_subnet_dhcp: false

openstack/tests/ansible/roles/subnet/tasks/main.yml

@@ -0,0 +1,43 @@
+---
+- name: Create network {{ network_name }}
+  os_network:
+    cloud: "{{ cloud }}"
+    name: "{{ network_name }}"
+    state: present
+
+- name: Create subnet {{ subnet_name }} on network {{ network_name }}
+  os_subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    name: "{{ subnet_name }}"
+    state: present
+    enable_dhcp: "{{ enable_subnet_dhcp }}"
+    dns_nameservers:
+      - 8.8.8.7
+      - 8.8.8.8
+    cidr: 192.168.0.0/24
+    gateway_ip: 192.168.0.1
+    allocation_pool_start: 192.168.0.2
+    allocation_pool_end: 192.168.0.254
+
+- name: Update subnet
+  os_subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    name: "{{ subnet_name }}"
+    state: present
+    dns_nameservers:
+      - 8.8.8.7
+    cidr: 192.168.0.0/24
+
+- name: Delete subnet {{ subnet_name }}
+  os_subnet:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_name }}"
+    state: absent
+
+- name: Delete network {{ network_name }}
+  os_network:
+    cloud: "{{ cloud }}"
+    name: "{{ network_name }}"
+    state: absent

openstack/tests/ansible/roles/user/tasks/main.yml

@@ -0,0 +1,30 @@
+---
+- name: Create user
+  os_user:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_user
+     password: secret
+     email: ansible.user@nowhere.net
+     domain: default
+     default_project: demo
+  register: user
+
+- debug: var=user
+
+- name: Update user
+  os_user:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_user
+     password: secret
+     email: updated.ansible.user@nowhere.net
+  register: updateduser
+
+- debug: var=updateduser
+
+- name: Delete user
+  os_user:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_user

openstack/tests/ansible/roles/user_group/tasks/main.yml

@@ -0,0 +1,31 @@
+---
+- name: Create user
+  os_user:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_user
+     password: secret
+     email: ansible.user@nowhere.net
+     domain: default
+     default_project: demo
+  register: user
+
+- name: Assign user to nonadmins group
+  os_user_group:
+     cloud: "{{ cloud }}"
+     state: present
+     user: ansible_user
+     group: nonadmins
+
+- name: Remove user from nonadmins group
+  os_user_group:
+     cloud: "{{ cloud }}"
+     state: absent
+     user: ansible_user
+     group: nonadmins
+
+- name: Delete user
+  os_user:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_user

openstack/tests/ansible/roles/volume/tasks/main.yml

@@ -0,0 +1,17 @@
+---
+- name: Create volume
+  os_volume:
+     cloud: "{{ cloud }}"
+     state: present
+     size: 1
+     display_name: ansible_volume
+     display_description: Test volume
+  register: vol
+
+- debug: var=vol
+
+- name: Delete volume
+  os_volume:
+     cloud: "{{ cloud }}"
+     state: absent
+     display_name: ansible_volume

openstack/tests/ansible/run.yml

@@ -0,0 +1,26 @@
+---
+- hosts: localhost
+  connection: local
+  gather_facts: true
+
+  roles:
+    - { role: auth, tags: auth }
+    - { role: client_config, tags: client_config }
+    - { role: group, tags: group }
+    # TODO(mordred) Reenable this once the fixed os_image winds up in an
+    # upstream ansible release.
+    # - { role: image, tags: image }
+    - { role: keypair, tags: keypair }
+    - { role: keystone_domain, tags: keystone_domain }
+    - { role: keystone_role, tags: keystone_role }
+    - { role: network, tags: network }
+    - { role: nova_flavor, tags: nova_flavor }
+    - { role: object, tags: object }
+    - { role: port, tags: port }
+    - { role: router, tags: router }
+    - { role: security_group, tags: security_group }
+    - { role: server, tags: server }
+    - { role: subnet, tags: subnet }
+    - { role: user, tags: user }
+    - { role: user_group, tags: user_group }
+    - { role: volume, tags: volume }