diff --git a/.zuul.yaml b/.zuul.yaml
index 26a204990..282094cb8 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -285,55 +285,12 @@
     vars:
       tox_envlist: ansible
 
-- job:
-    name: openstacksdk-ansible-devel-functional-devstack
-    parent: openstacksdk-ansible-functional-devstack
-    description: |
-      Run openstacksdk ansible functional tests against a master devstack
-      using git devel branch version of ansible.
-    branches: ^(devel|master)$
-    required-projects:
-      - name: github.com/ansible/ansible
-        override-checkout: devel
-      - name: openstack/openstacksdk
-        override-checkout: master
-      - name: openstack/devstack
-        override-checkout: master
-    vars:
-      # test-matrix grabs branch from the zuul branch setting. If the job
-      # is triggered by ansible, that branch will be devel which doesn't
-      # make sense to devstack. Override so that we run the right thing.
-      test_matrix_branch: master
-      tox_install_siblings: true
-
-- job:
-    name: openstacksdk-ansible-stable-2.6-functional-devstack
-    parent: openstacksdk-ansible-functional-devstack
-    description: |
-      Run openstacksdk ansible functional tests against a master devstack
-      using git stable-2.6 branch version of ansible.
-    branches: ^(stable-2.6|master)$
-    required-projects:
-      - name: github.com/ansible/ansible
-        override-checkout: stable-2.6
-      - name: openstack/openstacksdk
-        override-checkout: master
-      - name: openstack/devstack
-        override-checkout: master
-    vars:
-      # test-matrix grabs branch from the zuul branch setting. If the job
-      # is triggered by ansible, that branch will be devel which doesn't
-      # make sense to devstack. Override so that we run the right thing.
-      test_matrix_branch: master
-      tox_install_siblings: true
-
 - job:
     name: openstacksdk-ansible-stable-2.8-functional-devstack
     parent: openstacksdk-ansible-functional-devstack
     description: |
       Run openstacksdk ansible functional tests against a master devstack
       using git stable-2.8 branch version of ansible.
-    branches: ^(stable-2.8|master)$
     required-projects:
       - name: github.com/ansible/ansible
         override-checkout: stable-2.8
@@ -348,6 +305,26 @@
       test_matrix_branch: master
       tox_install_siblings: true
 
+- job:
+    name: openstacksdk-ansible-stable-2.9-functional-devstack
+    parent: openstacksdk-ansible-functional-devstack
+    description: |
+      Run openstacksdk ansible functional tests against a master devstack
+      using git stable-2.9 branch version of ansible.
+    required-projects:
+      - name: github.com/ansible/ansible
+        override-checkout: stable-2.9
+      - name: openstack/openstacksdk
+        override-checkout: master
+      - name: openstack/devstack
+        override-checkout: master
+    vars:
+      # test-matrix grabs branch from the zuul branch setting. If the job
+      # is triggered by ansible, that branch will be devel which doesn't
+      # make sense to devstack. Override so that we run the right thing.
+      test_matrix_branch: master
+      tox_install_siblings: true
+
 - job:
     name: openstacksdk-functional-devstack-masakari
     parent: openstacksdk-functional-devstack-minimum
@@ -423,6 +400,10 @@
             voting: false
         - ansible-collections-openstack-functional-devstack:
             voting: false
+        - openstacksdk-ansible-stable-2.8-functional-devstack:
+            voting: false
+        - openstacksdk-ansible-stable-2.9-functional-devstack:
+            voting: false
     gate:
       jobs:
         - openstacksdk-functional-devstack
diff --git a/extras/run-ansible-tests.sh b/extras/run-ansible-tests.sh
index e4ce80ea5..14ed166f2 100755
--- a/extras/run-ansible-tests.sh
+++ b/extras/run-ansible-tests.sh
@@ -30,12 +30,71 @@
 #    run-ansible-tests.sh -e ansible -c cloudX auth keypair network
 #############################################################################
 
-echo "
-    Thanks for submitting patch for Openstack Ansible modules!
-    We moved Openstack Ansible modules to Openstack repositories.
-    Next patches should be submitted not with Ansible Github but with
-    Openstack Gerrit: https://review.opendev.org/#/q/project:openstack/ansible-collections-openstack
-    Please submit your code there from now.
-    Thanks for your contribution and sorry for inconvienience.
-"
-exit 1
+
+CLOUD="devstack-admin"
+ENVDIR=
+USE_DEV=0
+
+while getopts "c:de:" opt
+do
+    case $opt in
+    d) USE_DEV=1 ;;
+    c) CLOUD=${OPTARG} ;;
+    e) ENVDIR=${OPTARG} ;;
+    ?) echo "Invalid option: -${OPTARG}"
+       exit 1;;
+    esac
+done
+
+if [ -z ${ENVDIR} ]
+then
+    echo "Option -e is required"
+    exit 1
+fi
+
+shift $((OPTIND-1))
+TAGS=$( echo "$*" | tr ' ' , )
+
+# We need to source the current tox environment so that Ansible will
+# be setup for the correct python environment.
+source $ENVDIR/bin/activate
+
+if [ ${USE_DEV} -eq 1 ]
+then
+    if [ -d ${ENVDIR}/ansible ]
+    then
+        echo "Using existing Ansible source repo"
+    else
+        echo "Installing Ansible source repo at $ENVDIR"
+        git clone --recursive https://github.com/ansible/ansible.git ${ENVDIR}/ansible
+    fi
+    source $ENVDIR/ansible/hacking/env-setup
+fi
+
+# Run the shade Ansible tests
+tag_opt=""
+if [ ! -z ${TAGS} ]
+then
+    tag_opt="--tags ${TAGS}"
+fi
+
+# Loop through all ANSIBLE_VAR_ environment variables to allow passing the further
+for var in $(env | grep -e '^ANSIBLE_VAR_'); do
+  VAR_NAME=${var%%=*} # split variable name from value
+  ANSIBLE_VAR_NAME=${VAR_NAME#ANSIBLE_VAR_} # cut ANSIBLE_VAR_ prefix from variable name
+  ANSIBLE_VAR_NAME=${ANSIBLE_VAR_NAME,,} # lowercase ansible variable
+  ANSIBLE_VAR_VALUE=${!VAR_NAME} # Get the variable value
+  ANSIBLE_VARS+="${ANSIBLE_VAR_NAME}=${ANSIBLE_VAR_VALUE} " # concat variables
+done
+
+# Until we have a module that lets us determine the image we want from
+# within a playbook, we have to find the image here and pass it in.
+# We use the openstack client instead of nova client since it can use clouds.yaml.
+IMAGE=`openstack --os-cloud=${CLOUD} image list -f value -c Name | grep cirros | grep -v -e ramdisk -e kernel`
+if [ $? -ne 0 ]
+then
+  echo "Failed to find Cirros image"
+  exit 1
+fi
+
+ansible-playbook -vvv ./openstack/tests/ansible/run.yml -e "cloud=${CLOUD} image=${IMAGE} ${ANSIBLE_VARS}" ${tag_opt}
diff --git a/openstack/tests/ansible/README.txt b/openstack/tests/ansible/README.txt
new file mode 100644
index 000000000..3931b4af9
--- /dev/null
+++ b/openstack/tests/ansible/README.txt
@@ -0,0 +1,26 @@
+This directory contains a testing infrastructure for the Ansible
+OpenStack modules. You will need a clouds.yaml file in order to run
+the tests. You must provide a value for the `cloud` variable for each
+run (using the -e option) as a default is not currently provided.
+
+If you want to run these tests against devstack, it is easiest to use
+the tox target. This assumes you have a devstack-admin cloud defined
+in your clouds.yaml file that points to devstack. Some examples of
+using tox:
+
+    tox -e ansible
+
+    tox -e ansible keypair security_group
+
+If you want to run these tests directly, or against different clouds,
+then you'll need to use the ansible-playbook command that comes with
+the Ansible distribution and feed it the run.yml playbook. Some examples:
+
+    # Run all module tests against a provider
+    ansible-playbook run.yml -e "cloud=hp"
+
+    # Run only the keypair and security_group tests
+    ansible-playbook run.yml -e "cloud=hp" --tags "keypair,security_group"
+
+    # Run all tests except security_group
+    ansible-playbook run.yml -e "cloud=hp" --skip-tags "security_group"
diff --git a/openstack/tests/ansible/hooks/post_test_hook.sh b/openstack/tests/ansible/hooks/post_test_hook.sh
new file mode 100755
index 000000000..bbda4af3b
--- /dev/null
+++ b/openstack/tests/ansible/hooks/post_test_hook.sh
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# TODO(shade) Rework for Zuul v3
+
+export OPENSTACKSDK_DIR="$BASE/new/openstacksdk"
+
+cd $OPENSTACKSDK_DIR
+sudo chown -R jenkins:stack $OPENSTACKSDK_DIR
+
+echo "Running shade Ansible test suite"
+
+if [ ${OPENSTACKSDK_ANSIBLE_DEV:-0} -eq 1 ]
+then
+    # Use the upstream development version of Ansible
+    set +e
+    sudo -E -H -u jenkins tox -eansible -- -d
+    EXIT_CODE=$?
+    set -e
+else
+    # Use the release version of Ansible
+    set +e
+    sudo -E -H -u jenkins tox -eansible
+    EXIT_CODE=$?
+    set -e
+fi
+
+
+exit $EXIT_CODE
diff --git a/openstack/tests/ansible/roles/auth/tasks/main.yml b/openstack/tests/ansible/roles/auth/tasks/main.yml
new file mode 100644
index 000000000..ca894e50a
--- /dev/null
+++ b/openstack/tests/ansible/roles/auth/tasks/main.yml
@@ -0,0 +1,6 @@
+---
+- name: Authenticate to the cloud
+  os_auth:
+    cloud={{ cloud }}
+
+- debug: var=service_catalog
diff --git a/openstack/tests/ansible/roles/client_config/tasks/main.yml b/openstack/tests/ansible/roles/client_config/tasks/main.yml
new file mode 100644
index 000000000..1506f6d69
--- /dev/null
+++ b/openstack/tests/ansible/roles/client_config/tasks/main.yml
@@ -0,0 +1,7 @@
+---
+- name: List all profiles
+  os_client_config:
+  register: list
+
+# WARNING: This will output sensitive authentication information!!!!
+- debug: var=list
diff --git a/openstack/tests/ansible/roles/group/defaults/main.yml b/openstack/tests/ansible/roles/group/defaults/main.yml
new file mode 100644
index 000000000..361c01190
--- /dev/null
+++ b/openstack/tests/ansible/roles/group/defaults/main.yml
@@ -0,0 +1 @@
+group_name: ansible_group
diff --git a/openstack/tests/ansible/roles/group/tasks/main.yml b/openstack/tests/ansible/roles/group/tasks/main.yml
new file mode 100644
index 000000000..535ed4318
--- /dev/null
+++ b/openstack/tests/ansible/roles/group/tasks/main.yml
@@ -0,0 +1,19 @@
+---
+- name: Create group
+  os_group:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ group_name }}"
+
+- name: Update group
+  os_group:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ group_name }}"
+     description: "updated description"
+
+- name: Delete group
+  os_group:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ group_name }}"
diff --git a/openstack/tests/ansible/roles/image/defaults/main.yml b/openstack/tests/ansible/roles/image/defaults/main.yml
new file mode 100644
index 000000000..13efe7144
--- /dev/null
+++ b/openstack/tests/ansible/roles/image/defaults/main.yml
@@ -0,0 +1 @@
+image_name: ansible_image
diff --git a/openstack/tests/ansible/roles/image/tasks/main.yml b/openstack/tests/ansible/roles/image/tasks/main.yml
new file mode 100644
index 000000000..587e887b8
--- /dev/null
+++ b/openstack/tests/ansible/roles/image/tasks/main.yml
@@ -0,0 +1,54 @@
+---
+- name: Create a test image file
+  shell: mktemp
+  register: tmp_file
+
+- name: Fill test image file to 1MB
+  shell: truncate -s 1048576 {{ tmp_file.stdout }}
+
+- name: Create raw image (defaults)
+  os_image:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ image_name }}"
+     filename: "{{ tmp_file.stdout }}"
+     disk_format: raw
+  register: image
+
+- debug: var=image
+
+- name: Delete raw image (defaults)
+  os_image:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ image_name }}"
+
+- name: Create raw image (complex)
+  os_image:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ image_name }}"
+     filename: "{{ tmp_file.stdout }}"
+     disk_format: raw
+     is_public: True
+     min_disk: 10
+     min_ram: 1024
+     kernel: cirros-vmlinuz
+     ramdisk: cirros-initrd
+     properties:
+        cpu_arch: x86_64
+        distro: ubuntu
+  register: image
+
+- debug: var=image
+
+- name: Delete raw image (complex)
+  os_image:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ image_name }}"
+
+- name: Delete test image file
+  file:
+     name: "{{ tmp_file.stdout }}"
+     state: absent
diff --git a/openstack/tests/ansible/roles/keypair/defaults/main.yml b/openstack/tests/ansible/roles/keypair/defaults/main.yml
new file mode 100644
index 000000000..3956b56a2
--- /dev/null
+++ b/openstack/tests/ansible/roles/keypair/defaults/main.yml
@@ -0,0 +1 @@
+keypair_name: shade_keypair
diff --git a/openstack/tests/ansible/roles/keypair/tasks/main.yml b/openstack/tests/ansible/roles/keypair/tasks/main.yml
new file mode 100644
index 000000000..636bf1aca
--- /dev/null
+++ b/openstack/tests/ansible/roles/keypair/tasks/main.yml
@@ -0,0 +1,62 @@
+---
+- name: Create keypair (non-existing)
+  os_keypair:
+     cloud: "{{ cloud }}"
+     name: "{{ keypair_name }}"
+     state: present
+  register:
+    keypair
+
+# This assert verifies that Ansible is capable serializing data returned by SDK
+- name: Ensure private key is returned
+  assert:
+    that:
+      - keypair.key.public_key is defined and keypair.key.public_key
+
+- name: Delete keypair (non-existing)
+  os_keypair:
+      cloud: "{{ cloud }}"
+      name: "{{ keypair_name }}"
+      state: absent
+
+- name: Generate test key file
+  user:
+      name: "{{ ansible_env.USER }}"
+      generate_ssh_key: yes
+      ssh_key_file: .ssh/shade_id_rsa
+
+- name: Create keypair (file)
+  os_keypair:
+      cloud: "{{ cloud }}"
+      name: "{{ keypair_name }}"
+      state: present
+      public_key_file: "{{ ansible_env.HOME }}/.ssh/shade_id_rsa.pub"
+
+- name: Delete keypair (file)
+  os_keypair:
+      cloud: "{{ cloud }}"
+      name: "{{ keypair_name }}"
+      state: absent
+
+- name: Create keypair (key)
+  os_keypair:
+      cloud: "{{ cloud }}"
+      name: "{{ keypair_name }}"
+      state: present
+      public_key: "{{ lookup('file', '~/.ssh/shade_id_rsa.pub') }}"
+
+- name: Delete keypair (key)
+  os_keypair:
+      cloud: "{{ cloud }}"
+      name: "{{ keypair_name }}"
+      state: absent
+
+- name: Delete test key pub file
+  file:
+      name: "{{ ansible_env.HOME }}/.ssh/shade_id_rsa.pub"
+      state: absent
+
+- name: Delete test key pvt file
+  file:
+      name: "{{ ansible_env.HOME }}/.ssh/shade_id_rsa"
+      state: absent
diff --git a/openstack/tests/ansible/roles/keystone_domain/defaults/main.yml b/openstack/tests/ansible/roles/keystone_domain/defaults/main.yml
new file mode 100644
index 000000000..049e7c378
--- /dev/null
+++ b/openstack/tests/ansible/roles/keystone_domain/defaults/main.yml
@@ -0,0 +1 @@
+domain_name: ansible_domain
diff --git a/openstack/tests/ansible/roles/keystone_domain/tasks/main.yml b/openstack/tests/ansible/roles/keystone_domain/tasks/main.yml
new file mode 100644
index 000000000..d1ca1273b
--- /dev/null
+++ b/openstack/tests/ansible/roles/keystone_domain/tasks/main.yml
@@ -0,0 +1,19 @@
+---
+- name: Create keystone domain
+  os_keystone_domain:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ domain_name }}"
+     description: "test description"
+
+- name: Update keystone domain
+  os_keystone_domain:
+     cloud: "{{ cloud }}"
+     name: "{{ domain_name }}"
+     description: "updated description"
+
+- name: Delete keystone domain
+  os_keystone_domain:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ domain_name }}"
diff --git a/openstack/tests/ansible/roles/keystone_role/defaults/main.yml b/openstack/tests/ansible/roles/keystone_role/defaults/main.yml
new file mode 100644
index 000000000..d1ebe5d1c
--- /dev/null
+++ b/openstack/tests/ansible/roles/keystone_role/defaults/main.yml
@@ -0,0 +1 @@
+role_name: ansible_keystone_role
diff --git a/openstack/tests/ansible/roles/keystone_role/tasks/main.yml b/openstack/tests/ansible/roles/keystone_role/tasks/main.yml
new file mode 100644
index 000000000..110b4386b
--- /dev/null
+++ b/openstack/tests/ansible/roles/keystone_role/tasks/main.yml
@@ -0,0 +1,12 @@
+---
+- name: Create keystone role
+  os_keystone_role:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ role_name }}"
+
+- name: Delete keystone role
+  os_keystone_role:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ role_name }}"
diff --git a/openstack/tests/ansible/roles/network/defaults/main.yml b/openstack/tests/ansible/roles/network/defaults/main.yml
new file mode 100644
index 000000000..d5435ecb1
--- /dev/null
+++ b/openstack/tests/ansible/roles/network/defaults/main.yml
@@ -0,0 +1,3 @@
+network_name: shade_network
+network_shared: false
+network_external: false
diff --git a/openstack/tests/ansible/roles/network/tasks/main.yml b/openstack/tests/ansible/roles/network/tasks/main.yml
new file mode 100644
index 000000000..8a85c25cc
--- /dev/null
+++ b/openstack/tests/ansible/roles/network/tasks/main.yml
@@ -0,0 +1,14 @@
+---
+- name: Create network
+  os_network:
+     cloud: "{{ cloud }}"
+     name: "{{ network_name }}"
+     state: present
+     shared: "{{ network_shared }}"
+     external: "{{ network_external }}"
+
+- name: Delete network
+  os_network:
+     cloud: "{{ cloud }}"
+     name: "{{ network_name }}"
+     state: absent
diff --git a/openstack/tests/ansible/roles/nova_flavor/tasks/main.yml b/openstack/tests/ansible/roles/nova_flavor/tasks/main.yml
new file mode 100644
index 000000000..c034bfc70
--- /dev/null
+++ b/openstack/tests/ansible/roles/nova_flavor/tasks/main.yml
@@ -0,0 +1,53 @@
+---
+- name: Create public flavor
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_public_flavor
+     is_public: True
+     ram: 1024
+     vcpus: 1
+     disk: 10
+     ephemeral: 10
+     swap: 1
+     flavorid: 12345
+
+- name: Delete public flavor
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_public_flavor
+
+- name: Create private flavor
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_private_flavor
+     is_public: False
+     ram: 1024
+     vcpus: 1
+     disk: 10
+     ephemeral: 10
+     swap: 1
+     flavorid: 12345
+
+- name: Delete private flavor
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_private_flavor
+
+- name: Create flavor (defaults)
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_defaults_flavor
+     ram: 1024
+     vcpus: 1
+     disk: 10
+
+- name: Delete flavor (defaults)
+  os_nova_flavor:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_defaults_flavor
diff --git a/openstack/tests/ansible/roles/object/tasks/main.yml b/openstack/tests/ansible/roles/object/tasks/main.yml
new file mode 100644
index 000000000..ae54b6ba2
--- /dev/null
+++ b/openstack/tests/ansible/roles/object/tasks/main.yml
@@ -0,0 +1,37 @@
+---
+- name: Create a test object file
+  shell: mktemp
+  register: tmp_file
+
+- name: Create container
+  os_object:
+     cloud: "{{ cloud }}"
+     state: present
+     container: ansible_container
+     container_access: private
+
+- name: Put object
+  os_object:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_object
+     filename: "{{ tmp_file.stdout }}"
+     container: ansible_container
+
+- name: Delete object
+  os_object:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_object
+     container: ansible_container
+
+- name: Delete container
+  os_object:
+     cloud: "{{ cloud }}"
+     state: absent
+     container: ansible_container
+
+- name: Delete test object file
+  file:
+     name: "{{ tmp_file.stdout }}"
+     state: absent
diff --git a/openstack/tests/ansible/roles/port/defaults/main.yml b/openstack/tests/ansible/roles/port/defaults/main.yml
new file mode 100644
index 000000000..de022001b
--- /dev/null
+++ b/openstack/tests/ansible/roles/port/defaults/main.yml
@@ -0,0 +1,6 @@
+network_name: ansible_port_network
+network_external: true
+subnet_name: ansible_port_subnet
+port_name: ansible_port
+secgroup_name: ansible_port_secgroup
+no_security_groups: True
diff --git a/openstack/tests/ansible/roles/port/tasks/main.yml b/openstack/tests/ansible/roles/port/tasks/main.yml
new file mode 100644
index 000000000..1a39140e5
--- /dev/null
+++ b/openstack/tests/ansible/roles/port/tasks/main.yml
@@ -0,0 +1,101 @@
+---
+- name: Create network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ network_name }}"
+     external: "{{ network_external }}"
+
+- name: Create subnet
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ subnet_name }}"
+     network_name: "{{ network_name }}"
+     cidr: 10.5.5.0/24
+
+- name: Create port (no security group or default security group)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ port_name }}"
+     network: "{{ network_name }}"
+     no_security_groups: "{{ no_security_groups }}"
+     fixed_ips:
+       - ip_address: 10.5.5.69
+  register: port
+
+- debug: var=port
+
+- name: Delete port (no security group or default security group)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ port_name }}"
+
+- name: Create security group
+  os_security_group:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ secgroup_name }}"
+     description: Test group
+
+- name: Create port (with security group)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ port_name }}"
+     network: "{{ network_name }}"
+     fixed_ips:
+       - ip_address: 10.5.5.69
+     security_groups:
+       - "{{ secgroup_name }}"
+  register: port
+
+- debug: var=port
+
+- name: Delete port (with security group)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ port_name }}"
+
+- name: Create port (with allowed_address_pairs and extra_dhcp_opts)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ port_name }}"
+     network: "{{ network_name }}"
+     no_security_groups: "{{ no_security_groups }}"
+     allowed_address_pairs:
+       - ip_address: 10.6.7.0/24
+     extra_dhcp_opts:
+       - opt_name: "bootfile-name"
+         opt_value: "testfile.1"
+  register: port
+
+- debug: var=port
+
+- name: Delete port (with allowed_address_pairs and extra_dhcp_opts)
+  os_port:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ port_name }}"
+
+- name: Delete security group
+  os_security_group:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ secgroup_name }}"
+
+- name: Delete subnet
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ subnet_name }}"
+
+- name: Delete network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ network_name }}"
diff --git a/openstack/tests/ansible/roles/router/defaults/main.yml b/openstack/tests/ansible/roles/router/defaults/main.yml
new file mode 100644
index 000000000..f7d53933a
--- /dev/null
+++ b/openstack/tests/ansible/roles/router/defaults/main.yml
@@ -0,0 +1,3 @@
+external_network_name: ansible_external_net
+network_external: true
+router_name: ansible_router
diff --git a/openstack/tests/ansible/roles/router/tasks/main.yml b/openstack/tests/ansible/roles/router/tasks/main.yml
new file mode 100644
index 000000000..083d4f066
--- /dev/null
+++ b/openstack/tests/ansible/roles/router/tasks/main.yml
@@ -0,0 +1,95 @@
+---
+# Regular user operation
+- name: Create internal network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ network_name }}"
+     external: false
+
+- name: Create subnet1
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: present
+     network_name: "{{ network_name }}"
+     name: shade_subnet1
+     cidr: 10.7.7.0/24
+
+- name: Create router
+  os_router:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ router_name }}"
+
+- name: Update router (add interface)
+  os_router:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ router_name }}"
+     interfaces:
+         - shade_subnet1
+
+# Admin operation
+- name: Create external network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ external_network_name }}"
+     external: "{{ network_external }}"
+  when:
+    - network_external
+
+- name: Create subnet2
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: present
+     network_name: "{{ external_network_name }}"
+     name: shade_subnet2
+     cidr: 10.6.6.0/24
+  when:
+    - network_external
+
+- name: Update router (add external gateway)
+  os_router:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ router_name }}"
+     network: "{{ external_network_name }}"
+     interfaces:
+         - shade_subnet1
+  when:
+    - network_external
+
+- name: Delete router
+  os_router:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ router_name }}"
+
+- name: Delete subnet1
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: shade_subnet1
+
+- name: Delete subnet2
+  os_subnet:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: shade_subnet2
+  when:
+    - network_external
+
+- name: Delete internal network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ network_name }}"
+
+- name: Delete external network
+  os_network:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ external_network_name }}"
+  when:
+    - network_external
diff --git a/openstack/tests/ansible/roles/security_group/defaults/main.yml b/openstack/tests/ansible/roles/security_group/defaults/main.yml
new file mode 100644
index 000000000..00310dd10
--- /dev/null
+++ b/openstack/tests/ansible/roles/security_group/defaults/main.yml
@@ -0,0 +1 @@
+secgroup_name: shade_secgroup
diff --git a/openstack/tests/ansible/roles/security_group/tasks/main.yml b/openstack/tests/ansible/roles/security_group/tasks/main.yml
new file mode 100644
index 000000000..ddc7e50cd
--- /dev/null
+++ b/openstack/tests/ansible/roles/security_group/tasks/main.yml
@@ -0,0 +1,123 @@
+---
+- name: Create security group
+  os_security_group:
+     cloud: "{{ cloud }}"
+     name: "{{ secgroup_name }}"
+     state: present
+     description: Created from Ansible playbook
+
+- name: Create empty ICMP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: icmp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Create -1 ICMP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: icmp
+     port_range_min: -1
+     port_range_max: -1
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Create empty TCP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: tcp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Create empty UDP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: udp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Create HTTP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: tcp
+     port_range_min: 80
+     port_range_max: 80
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Create egress rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: present
+     protocol: tcp
+     port_range_min: 30000
+     port_range_max: 30001
+     remote_ip_prefix: 0.0.0.0/0
+     direction: egress
+
+- name: Delete empty ICMP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: icmp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Delete -1 ICMP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: icmp
+     port_range_min: -1
+     port_range_max: -1
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Delete empty TCP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: tcp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Delete empty UDP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: udp
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Delete HTTP rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: tcp
+     port_range_min: 80
+     port_range_max: 80
+     remote_ip_prefix: 0.0.0.0/0
+
+- name: Delete egress rule
+  os_security_group_rule:
+     cloud: "{{ cloud }}"
+     security_group: "{{ secgroup_name }}"
+     state: absent
+     protocol: tcp
+     port_range_min: 30000
+     port_range_max: 30001
+     remote_ip_prefix: 0.0.0.0/0
+     direction: egress
+
+- name: Delete security group
+  os_security_group:
+     cloud: "{{ cloud }}"
+     name: "{{ secgroup_name }}"
+     state: absent
diff --git a/openstack/tests/ansible/roles/server/defaults/main.yaml b/openstack/tests/ansible/roles/server/defaults/main.yaml
new file mode 100644
index 000000000..e3bd5f33b
--- /dev/null
+++ b/openstack/tests/ansible/roles/server/defaults/main.yaml
@@ -0,0 +1,5 @@
+server_network: private
+server_name: ansible_server
+flavor: m1.tiny
+floating_ip_pool_name: public
+boot_volume_size: 5
diff --git a/openstack/tests/ansible/roles/server/tasks/main.yml b/openstack/tests/ansible/roles/server/tasks/main.yml
new file mode 100644
index 000000000..ac0311554
--- /dev/null
+++ b/openstack/tests/ansible/roles/server/tasks/main.yml
@@ -0,0 +1,92 @@
+---
+- name: Create server with meta as CSV
+  os_server:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ server_name }}"
+     image: "{{ image }}"
+     flavor: "{{ flavor }}"
+     network: "{{ server_network }}"
+     auto_floating_ip: false
+     meta: "key1=value1,key2=value2"
+     wait: true
+  register: server
+
+- debug: var=server
+
+- name: Delete server with meta as CSV
+  os_server:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ server_name }}"
+     wait: true
+
+- name: Create server with meta as dict
+  os_server:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ server_name }}"
+     image: "{{ image }}"
+     flavor: "{{ flavor }}"
+     auto_floating_ip: false
+     network: "{{ server_network }}"
+     meta:
+       key1: value1
+       key2: value2
+     wait: true
+  register: server
+
+- debug: var=server
+
+- name: Delete server with meta as dict
+  os_server:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ server_name }}"
+     wait: true
+
+- name: Create server (FIP from pool/network)
+  os_server:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ server_name }}"
+     image: "{{ image }}"
+     flavor: "{{ flavor }}"
+     network: "{{ server_network }}"
+     floating_ip_pools:
+       - "{{ floating_ip_pool_name }}"
+     wait: true
+  register: server
+
+- debug: var=server
+
+- name: Delete server (FIP from pool/network)
+  os_server:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ server_name }}"
+     wait: true
+
+- name: Create server from volume
+  os_server:
+     cloud: "{{ cloud }}"
+     state: present
+     name: "{{ server_name }}"
+     image: "{{ image }}"
+     flavor: "{{ flavor }}"
+     network: "{{ server_network }}"
+     auto_floating_ip: false
+     boot_from_volume: true
+     volume_size: "{{ boot_volume_size }}"
+     terminate_volume: true
+     wait: true
+  register: server
+
+- debug: var=server
+
+- name: Delete server with volume
+  os_server:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: "{{ server_name }}"
+     wait: true
diff --git a/openstack/tests/ansible/roles/subnet/defaults/main.yml b/openstack/tests/ansible/roles/subnet/defaults/main.yml
new file mode 100644
index 000000000..5ccc85abc
--- /dev/null
+++ b/openstack/tests/ansible/roles/subnet/defaults/main.yml
@@ -0,0 +1,2 @@
+subnet_name: shade_subnet
+enable_subnet_dhcp: false
diff --git a/openstack/tests/ansible/roles/subnet/tasks/main.yml b/openstack/tests/ansible/roles/subnet/tasks/main.yml
new file mode 100644
index 000000000..a7ca490ad
--- /dev/null
+++ b/openstack/tests/ansible/roles/subnet/tasks/main.yml
@@ -0,0 +1,43 @@
+---
+- name: Create network {{ network_name }}
+  os_network:
+    cloud: "{{ cloud }}"
+    name: "{{ network_name }}"
+    state: present
+
+- name: Create subnet {{ subnet_name }} on network {{ network_name }}
+  os_subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    name: "{{ subnet_name }}"
+    state: present
+    enable_dhcp: "{{ enable_subnet_dhcp }}"
+    dns_nameservers:
+      - 8.8.8.7
+      - 8.8.8.8
+    cidr: 192.168.0.0/24
+    gateway_ip: 192.168.0.1
+    allocation_pool_start: 192.168.0.2
+    allocation_pool_end: 192.168.0.254
+
+- name: Update subnet
+  os_subnet:
+    cloud: "{{ cloud }}"
+    network_name: "{{ network_name }}"
+    name: "{{ subnet_name }}"
+    state: present
+    dns_nameservers:
+      - 8.8.8.7
+    cidr: 192.168.0.0/24
+
+- name: Delete subnet {{ subnet_name }}
+  os_subnet:
+    cloud: "{{ cloud }}"
+    name: "{{ subnet_name }}"
+    state: absent
+
+- name: Delete network {{ network_name }}
+  os_network:
+    cloud: "{{ cloud }}"
+    name: "{{ network_name }}"
+    state: absent
diff --git a/openstack/tests/ansible/roles/user/tasks/main.yml b/openstack/tests/ansible/roles/user/tasks/main.yml
new file mode 100644
index 000000000..6585ca582
--- /dev/null
+++ b/openstack/tests/ansible/roles/user/tasks/main.yml
@@ -0,0 +1,30 @@
+---
+- name: Create user
+  os_user:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_user
+     password: secret
+     email: ansible.user@nowhere.net
+     domain: default
+     default_project: demo
+  register: user
+
+- debug: var=user
+
+- name: Update user
+  os_user:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_user
+     password: secret
+     email: updated.ansible.user@nowhere.net
+  register: updateduser
+
+- debug: var=updateduser
+
+- name: Delete user
+  os_user:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_user
diff --git a/openstack/tests/ansible/roles/user_group/tasks/main.yml b/openstack/tests/ansible/roles/user_group/tasks/main.yml
new file mode 100644
index 000000000..a0074e2dc
--- /dev/null
+++ b/openstack/tests/ansible/roles/user_group/tasks/main.yml
@@ -0,0 +1,31 @@
+---
+- name: Create user
+  os_user:
+     cloud: "{{ cloud }}"
+     state: present
+     name: ansible_user
+     password: secret
+     email: ansible.user@nowhere.net
+     domain: default
+     default_project: demo
+  register: user
+
+- name: Assign user to nonadmins group
+  os_user_group:
+     cloud: "{{ cloud }}"
+     state: present
+     user: ansible_user
+     group: nonadmins
+
+- name: Remove user from nonadmins group
+  os_user_group:
+     cloud: "{{ cloud }}"
+     state: absent
+     user: ansible_user
+     group: nonadmins
+
+- name: Delete user
+  os_user:
+     cloud: "{{ cloud }}"
+     state: absent
+     name: ansible_user
diff --git a/openstack/tests/ansible/roles/volume/tasks/main.yml b/openstack/tests/ansible/roles/volume/tasks/main.yml
new file mode 100644
index 000000000..1479a0030
--- /dev/null
+++ b/openstack/tests/ansible/roles/volume/tasks/main.yml
@@ -0,0 +1,17 @@
+---
+- name: Create volume
+  os_volume:
+     cloud: "{{ cloud }}"
+     state: present
+     size: 1
+     display_name: ansible_volume
+     display_description: Test volume
+  register: vol
+
+- debug: var=vol
+
+- name: Delete volume
+  os_volume:
+     cloud: "{{ cloud }}"
+     state: absent
+     display_name: ansible_volume
diff --git a/openstack/tests/ansible/run.yml b/openstack/tests/ansible/run.yml
new file mode 100644
index 000000000..9340ccd06
--- /dev/null
+++ b/openstack/tests/ansible/run.yml
@@ -0,0 +1,26 @@
+---
+- hosts: localhost
+  connection: local
+  gather_facts: true
+
+  roles:
+    - { role: auth, tags: auth }
+    - { role: client_config, tags: client_config }
+    - { role: group, tags: group }
+    # TODO(mordred) Reenable this once the fixed os_image winds up in an
+    # upstream ansible release.
+    # - { role: image, tags: image }
+    - { role: keypair, tags: keypair }
+    - { role: keystone_domain, tags: keystone_domain }
+    - { role: keystone_role, tags: keystone_role }
+    - { role: network, tags: network }
+    - { role: nova_flavor, tags: nova_flavor }
+    - { role: object, tags: object }
+    - { role: port, tags: port }
+    - { role: router, tags: router }
+    - { role: security_group, tags: security_group }
+    - { role: server, tags: server }
+    - { role: subnet, tags: subnet }
+    - { role: user, tags: user }
+    - { role: user_group, tags: user_group }
+    - { role: volume, tags: volume }