Ansible - Regional SSL Certs + Health Check (#3210) (#174)

* done

* first try!

* copyright

* changing examples

* removing google provider

* test fixes

Signed-off-by: Modular Magician <magic-modules@google.com>

README.md

@@ -41,6 +41,7 @@ ansible-galaxy collection install google.cloud
   * Compute Engine NodeGroup (gcp_compute_node_group, gcp_compute_node_group_facts)
   * Compute Engine NodeTemplate (gcp_compute_node_template, gcp_compute_node_template_facts)
   * Compute Engine RegionDisk (gcp_compute_region_disk, gcp_compute_region_disk_facts)
+  * Compute Engine RegionHealthCheck (gcp_compute_region_health_check, gcp_compute_region_health_check_facts)
   * Compute Engine Route (gcp_compute_route, gcp_compute_route_facts)
   * Compute Engine Router (gcp_compute_router, gcp_compute_router_facts)
   * Compute Engine Snapshot (gcp_compute_snapshot, gcp_compute_snapshot_facts)

plugins/modules/gcp_compute_region_health_check_info.py

@@ -0,0 +1,536 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright (C) 2017 Google
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+# ----------------------------------------------------------------------------
+#
+#     ***     AUTO GENERATED CODE    ***    AUTO GENERATED CODE     ***
+#
+# ----------------------------------------------------------------------------
+#
+#     This file is automatically generated by Magic Modules and manual
+#     changes will be clobbered when the file is regenerated.
+#
+#     Please read more about how to change this file at
+#     https://www.github.com/GoogleCloudPlatform/magic-modules
+#
+# ----------------------------------------------------------------------------
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+################################################################################
+# Documentation
+################################################################################
+
+ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ["preview"], 'supported_by': 'community'}
+
+DOCUMENTATION = '''
+---
+module: gcp_compute_region_health_check_info
+description:
+- Gather info for GCP RegionHealthCheck
+short_description: Gather info for GCP RegionHealthCheck
+version_added: '2.10'
+author: Google Inc. (@googlecloudplatform)
+requirements:
+- python >= 2.6
+- requests >= 2.18.4
+- google-auth >= 1.3.0
+options:
+  filters:
+    description:
+    - A list of filter value pairs. Available filters are listed here U(https://cloud.google.com/sdk/gcloud/reference/topic/filters).
+    - Each additional filter in the list will act be added as an AND condition (filter1
+      and filter2) .
+    type: list
+  region:
+    description:
+    - The region where the regional health check resides.
+    required: false
+    type: str
+  project:
+    description:
+    - The Google Cloud Platform project to use.
+    type: str
+  auth_kind:
+    description:
+    - The type of credential used.
+    type: str
+    required: true
+    choices:
+    - application
+    - machineaccount
+    - serviceaccount
+  service_account_contents:
+    description:
+    - The contents of a Service Account JSON file, either in a dictionary or as a
+      JSON string that represents it.
+    type: jsonarg
+  service_account_file:
+    description:
+    - The path of a Service Account JSON file if serviceaccount is selected as type.
+    type: path
+  service_account_email:
+    description:
+    - An optional service account email address if machineaccount is selected and
+      the user does not wish to use the default email.
+    type: str
+  scopes:
+    description:
+    - Array of scopes to be used
+    type: list
+  env_type:
+    description:
+    - Specifies which Ansible environment you're running this module within.
+    - This should not be set unless you know what you're doing.
+    - This only alters the User Agent string for any API requests.
+    type: str
+notes:
+- for authentication, you can set service_account_file using the C(gcp_service_account_file)
+  env variable.
+- for authentication, you can set service_account_contents using the C(GCP_SERVICE_ACCOUNT_CONTENTS)
+  env variable.
+- For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
+  env variable.
+- For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
+- For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
+- Environment variables values will only be used if the playbook values are not set.
+- The I(service_account_email) and I(service_account_file) options are mutually exclusive.
+'''
+
+EXAMPLES = '''
+- name: get info on a region health check
+  gcp_compute_region_health_check_info:
+    region: us-central1
+    filters:
+    - name = test_object
+    project: test_project
+    auth_kind: serviceaccount
+    service_account_file: "/tmp/auth.pem"
+'''
+
+RETURN = '''
+resources:
+  description: List of resources
+  returned: always
+  type: complex
+  contains:
+    checkIntervalSec:
+      description:
+      - How often (in seconds) to send a health check. The default value is 5 seconds.
+      returned: success
+      type: int
+    creationTimestamp:
+      description:
+      - Creation timestamp in RFC3339 text format.
+      returned: success
+      type: str
+    description:
+      description:
+      - An optional description of this resource. Provide this property when you create
+        the resource.
+      returned: success
+      type: str
+    healthyThreshold:
+      description:
+      - A so-far unhealthy instance will be marked healthy after this many consecutive
+        successes. The default value is 2.
+      returned: success
+      type: int
+    id:
+      description:
+      - The unique identifier for the resource. This identifier is defined by the
+        server.
+      returned: success
+      type: int
+    name:
+      description:
+      - Name of the resource. Provided by the client when the resource is created.
+        The name must be 1-63 characters long, and comply with RFC1035. Specifically,
+        the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`
+        which means the first character must be a lowercase letter, and all following
+        characters must be a dash, lowercase letter, or digit, except the last character,
+        which cannot be a dash.
+      returned: success
+      type: str
+    unhealthyThreshold:
+      description:
+      - A so-far healthy instance will be marked unhealthy after this many consecutive
+        failures. The default value is 2.
+      returned: success
+      type: int
+    timeoutSec:
+      description:
+      - How long (in seconds) to wait before claiming failure.
+      - The default value is 5 seconds. It is invalid for timeoutSec to have greater
+        value than checkIntervalSec.
+      returned: success
+      type: int
+    type:
+      description:
+      - Specifies the type of the healthCheck, either TCP, SSL, HTTP or HTTPS. If
+        not specified, the default is TCP. Exactly one of the protocol-specific health
+        check field must be specified, which must match type field.
+      returned: success
+      type: str
+    httpHealthCheck:
+      description:
+      - A nested object resource.
+      returned: success
+      type: complex
+      contains:
+        host:
+          description:
+          - The value of the host header in the HTTP health check request.
+          - If left empty (default value), the public IP on behalf of which this health
+            check is performed will be used.
+          returned: success
+          type: str
+        requestPath:
+          description:
+          - The request path of the HTTP health check request.
+          - The default value is /.
+          returned: success
+          type: str
+        response:
+          description:
+          - The bytes to match against the beginning of the response data. If left
+            empty (the default value), any response will indicate health. The response
+            data can only be ASCII.
+          returned: success
+          type: str
+        port:
+          description:
+          - The TCP port number for the HTTP health check request.
+          - The default value is 80.
+          returned: success
+          type: int
+        portName:
+          description:
+          - Port name as defined in InstanceGroup#NamedPort#name. If both port and
+            port_name are defined, port takes precedence.
+          returned: success
+          type: str
+        proxyHeader:
+          description:
+          - Specifies the type of proxy header to append before sending data to the
+            backend, either NONE or PROXY_V1. The default is NONE.
+          returned: success
+          type: str
+        portSpecification:
+          description:
+          - 'Specifies how port is selected for health checking, can be one of the
+            following values: * `USE_FIXED_PORT`: The port number in `port` is used
+            for health checking.'
+          - "* `USE_NAMED_PORT`: The `portName` is used for health checking."
+          - "* `USE_SERVING_PORT`: For NetworkEndpointGroup, the port specified for
+            each network endpoint is used for health checking. For other backends,
+            the port or named port specified in the Backend Service is used for health
+            checking."
+          - If not specified, HTTP health check follows behavior specified in `port`
+            and `portName` fields.
+          returned: success
+          type: str
+    httpsHealthCheck:
+      description:
+      - A nested object resource.
+      returned: success
+      type: complex
+      contains:
+        host:
+          description:
+          - The value of the host header in the HTTPS health check request.
+          - If left empty (default value), the public IP on behalf of which this health
+            check is performed will be used.
+          returned: success
+          type: str
+        requestPath:
+          description:
+          - The request path of the HTTPS health check request.
+          - The default value is /.
+          returned: success
+          type: str
+        response:
+          description:
+          - The bytes to match against the beginning of the response data. If left
+            empty (the default value), any response will indicate health. The response
+            data can only be ASCII.
+          returned: success
+          type: str
+        port:
+          description:
+          - The TCP port number for the HTTPS health check request.
+          - The default value is 443.
+          returned: success
+          type: int
+        portName:
+          description:
+          - Port name as defined in InstanceGroup#NamedPort#name. If both port and
+            port_name are defined, port takes precedence.
+          returned: success
+          type: str
+        proxyHeader:
+          description:
+          - Specifies the type of proxy header to append before sending data to the
+            backend, either NONE or PROXY_V1. The default is NONE.
+          returned: success
+          type: str
+        portSpecification:
+          description:
+          - 'Specifies how port is selected for health checking, can be one of the
+            following values: * `USE_FIXED_PORT`: The port number in `port` is used
+            for health checking.'
+          - "* `USE_NAMED_PORT`: The `portName` is used for health checking."
+          - "* `USE_SERVING_PORT`: For NetworkEndpointGroup, the port specified for
+            each network endpoint is used for health checking. For other backends,
+            the port or named port specified in the Backend Service is used for health
+            checking."
+          - If not specified, HTTPS health check follows behavior specified in `port`
+            and `portName` fields.
+          returned: success
+          type: str
+    tcpHealthCheck:
+      description:
+      - A nested object resource.
+      returned: success
+      type: complex
+      contains:
+        request:
+          description:
+          - The application data to send once the TCP connection has been established
+            (default value is empty). If both request and response are empty, the
+            connection establishment alone will indicate health. The request data
+            can only be ASCII.
+          returned: success
+          type: str
+        response:
+          description:
+          - The bytes to match against the beginning of the response data. If left
+            empty (the default value), any response will indicate health. The response
+            data can only be ASCII.
+          returned: success
+          type: str
+        port:
+          description:
+          - The TCP port number for the TCP health check request.
+          - The default value is 80.
+          returned: success
+          type: int
+        portName:
+          description:
+          - Port name as defined in InstanceGroup#NamedPort#name. If both port and
+            port_name are defined, port takes precedence.
+          returned: success
+          type: str
+        proxyHeader:
+          description:
+          - Specifies the type of proxy header to append before sending data to the
+            backend, either NONE or PROXY_V1. The default is NONE.
+          returned: success
+          type: str
+        portSpecification:
+          description:
+          - 'Specifies how port is selected for health checking, can be one of the
+            following values: * `USE_FIXED_PORT`: The port number in `port` is used
+            for health checking.'
+          - "* `USE_NAMED_PORT`: The `portName` is used for health checking."
+          - "* `USE_SERVING_PORT`: For NetworkEndpointGroup, the port specified for
+            each network endpoint is used for health checking. For other backends,
+            the port or named port specified in the Backend Service is used for health
+            checking."
+          - If not specified, TCP health check follows behavior specified in `port`
+            and `portName` fields.
+          returned: success
+          type: str
+    sslHealthCheck:
+      description:
+      - A nested object resource.
+      returned: success
+      type: complex
+      contains:
+        request:
+          description:
+          - The application data to send once the SSL connection has been established
+            (default value is empty). If both request and response are empty, the
+            connection establishment alone will indicate health. The request data
+            can only be ASCII.
+          returned: success
+          type: str
+        response:
+          description:
+          - The bytes to match against the beginning of the response data. If left
+            empty (the default value), any response will indicate health. The response
+            data can only be ASCII.
+          returned: success
+          type: str
+        port:
+          description:
+          - The TCP port number for the SSL health check request.
+          - The default value is 443.
+          returned: success
+          type: int
+        portName:
+          description:
+          - Port name as defined in InstanceGroup#NamedPort#name. If both port and
+            port_name are defined, port takes precedence.
+          returned: success
+          type: str
+        proxyHeader:
+          description:
+          - Specifies the type of proxy header to append before sending data to the
+            backend, either NONE or PROXY_V1. The default is NONE.
+          returned: success
+          type: str
+        portSpecification:
+          description:
+          - 'Specifies how port is selected for health checking, can be one of the
+            following values: * `USE_FIXED_PORT`: The port number in `port` is used
+            for health checking.'
+          - "* `USE_NAMED_PORT`: The `portName` is used for health checking."
+          - "* `USE_SERVING_PORT`: For NetworkEndpointGroup, the port specified for
+            each network endpoint is used for health checking. For other backends,
+            the port or named port specified in the Backend Service is used for health
+            checking."
+          - If not specified, SSL health check follows behavior specified in `port`
+            and `portName` fields.
+          returned: success
+          type: str
+    http2HealthCheck:
+      description:
+      - A nested object resource.
+      returned: success
+      type: complex
+      contains:
+        host:
+          description:
+          - The value of the host header in the HTTP2 health check request.
+          - If left empty (default value), the public IP on behalf of which this health
+            check is performed will be used.
+          returned: success
+          type: str
+        requestPath:
+          description:
+          - The request path of the HTTP2 health check request.
+          - The default value is /.
+          returned: success
+          type: str
+        response:
+          description:
+          - The bytes to match against the beginning of the response data. If left
+            empty (the default value), any response will indicate health. The response
+            data can only be ASCII.
+          returned: success
+          type: str
+        port:
+          description:
+          - The TCP port number for the HTTP2 health check request.
+          - The default value is 443.
+          returned: success
+          type: int
+        portName:
+          description:
+          - Port name as defined in InstanceGroup#NamedPort#name. If both port and
+            port_name are defined, port takes precedence.
+          returned: success
+          type: str
+        proxyHeader:
+          description:
+          - Specifies the type of proxy header to append before sending data to the
+            backend, either NONE or PROXY_V1. The default is NONE.
+          returned: success
+          type: str
+        portSpecification:
+          description:
+          - 'Specifies how port is selected for health checking, can be one of the
+            following values: * `USE_FIXED_PORT`: The port number in `port` is used
+            for health checking.'
+          - "* `USE_NAMED_PORT`: The `portName` is used for health checking."
+          - "* `USE_SERVING_PORT`: For NetworkEndpointGroup, the port specified for
+            each network endpoint is used for health checking. For other backends,
+            the port or named port specified in the Backend Service is used for health
+            checking."
+          - If not specified, HTTP2 health check follows behavior specified in `port`
+            and `portName` fields.
+          returned: success
+          type: str
+    region:
+      description:
+      - The region where the regional health check resides.
+      returned: success
+      type: str
+'''
+
+################################################################################
+# Imports
+################################################################################
+from ansible.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+import json
+
+################################################################################
+# Main
+################################################################################
+
+
+def main():
+    module = GcpModule(argument_spec=dict(filters=dict(type='list', elements='str'), region=dict(type='str')))
+
+    if not module.params['scopes']:
+        module.params['scopes'] = ['https://www.googleapis.com/auth/compute']
+
+    return_value = {'resources': fetch_list(module, collection(module), query_options(module.params['filters']))}
+    module.exit_json(**return_value)
+
+
+def collection(module):
+    return "https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/healthChecks".format(**module.params)
+
+
+def fetch_list(module, link, query):
+    auth = GcpSession(module, 'compute')
+    return auth.list(link, return_if_object, array_name='items', params={'filter': query})
+
+
+def query_options(filters):
+    if not filters:
+        return ''
+
+    if len(filters) == 1:
+        return filters[0]
+    else:
+        queries = []
+        for f in filters:
+            # For multiple queries, all queries should have ()
+            if f[0] != '(' and f[-1] != ')':
+                queries.append("(%s)" % ''.join(f))
+            else:
+                queries.append(f)
+
+        return ' '.join(queries)
+
+
+def return_if_object(module, response):
+    # If not found, return nothing.
+    if response.status_code == 404:
+        return None
+
+    # If no content, return nothing.
+    if response.status_code == 204:
+        return None
+
+    try:
+        module.raise_for_status(response)
+        result = response.json()
+    except getattr(json.decoder, 'JSONDecodeError', ValueError) as inst:
+        module.fail_json(msg="Invalid JSON response with error: %s" % inst)
+
+    if navigate_hash(result, ['error', 'errors']):
+        module.fail_json(msg=navigate_hash(result, ['error', 'errors']))
+
+    return result
+
+
+if __name__ == "__main__":
+    main()

plugins/modules/gcp_compute_ssl_certificate.py

@@ -133,6 +133,7 @@ EXAMPLES = '''
 - name: create a SSL certificate
   google.cloud.gcp_compute_ssl_certificate:
     name: test_object
+    region: us-central1
     description: A certificate for testing. Do not use this certificate in production
     certificate: |-
       -----BEGIN CERTIFICATE-----

tests/integration/targets/gcp_compute_region_health_check/aliases

@@ -0,0 +1,2 @@
+cloud/gcp
+unsupported

tests/integration/targets/gcp_compute_region_health_check/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+resource_name: "{{ resource_prefix }}"

tests/integration/targets/gcp_compute_region_health_check/tasks/autogen.yml

@@ -0,0 +1,149 @@
+---
+# ----------------------------------------------------------------------------
+#
+#     ***     AUTO GENERATED CODE    ***    AUTO GENERATED CODE     ***
+#
+# ----------------------------------------------------------------------------
+#
+#     This file is automatically generated by Magic Modules and manual
+#     changes will be clobbered when the file is regenerated.
+#
+#     Please read more about how to change this file at
+#     https://www.github.com/GoogleCloudPlatform/magic-modules
+#
+# ----------------------------------------------------------------------------
+# Pre-test setup
+- name: delete a region health check
+  google.cloud.gcp_compute_region_health_check:
+    name: "{{ resource_name }}"
+    type: TCP
+    tcp_health_check:
+      port_name: service-health
+      request: ping
+      response: pong
+    healthy_threshold: 10
+    timeout_sec: 2
+    unhealthy_threshold: 5
+    region: us-central1
+    project: "{{ gcp_project }}"
+    auth_kind: "{{ gcp_cred_kind }}"
+    service_account_file: "{{ gcp_cred_file }}"
+    state: absent
+#----------------------------------------------------------
+- name: create a region health check
+  google.cloud.gcp_compute_region_health_check:
+    name: "{{ resource_name }}"
+    type: TCP
+    tcp_health_check:
+      port_name: service-health
+      request: ping
+      response: pong
+    healthy_threshold: 10
+    timeout_sec: 2
+    unhealthy_threshold: 5
+    region: us-central1
+    project: "{{ gcp_project }}"
+    auth_kind: "{{ gcp_cred_kind }}"
+    service_account_file: "{{ gcp_cred_file }}"
+    state: present
+  register: result
+- name: assert changed is true
+  assert:
+    that:
+      - result.changed == true
+- name: verify that region_health_check was created
+  google.cloud.gcp_compute_region_health_check_info:
+      filters:
+         - name = {{ resource_name }}
+      region: us-central1
+      project: "{{ gcp_project }}"
+      auth_kind: "{{ gcp_cred_kind }}"
+      service_account_file: "{{ gcp_cred_file }}"
+      scopes:
+        - https://www.googleapis.com/auth/compute
+  register: results
+- name: verify that command succeeded
+  assert:
+    that:
+      - results['resources'] | length == 1
+# ----------------------------------------------------------------------------
+- name: create a region health check that already exists
+  google.cloud.gcp_compute_region_health_check:
+    name: "{{ resource_name }}"
+    type: TCP
+    tcp_health_check:
+      port_name: service-health
+      request: ping
+      response: pong
+    healthy_threshold: 10
+    timeout_sec: 2
+    unhealthy_threshold: 5
+    region: us-central1
+    project: "{{ gcp_project }}"
+    auth_kind: "{{ gcp_cred_kind }}"
+    service_account_file: "{{ gcp_cred_file }}"
+    state: present
+  register: result
+- name: assert changed is false
+  assert:
+    that:
+      - result.changed == false
+#----------------------------------------------------------
+- name: delete a region health check
+  google.cloud.gcp_compute_region_health_check:
+    name: "{{ resource_name }}"
+    type: TCP
+    tcp_health_check:
+      port_name: service-health
+      request: ping
+      response: pong
+    healthy_threshold: 10
+    timeout_sec: 2
+    unhealthy_threshold: 5
+    region: us-central1
+    project: "{{ gcp_project }}"
+    auth_kind: "{{ gcp_cred_kind }}"
+    service_account_file: "{{ gcp_cred_file }}"
+    state: absent
+  register: result
+- name: assert changed is true
+  assert:
+    that:
+      - result.changed == true
+- name: verify that region_health_check was deleted
+  google.cloud.gcp_compute_region_health_check_info:
+      filters:
+         - name = {{ resource_name }}
+      region: us-central1
+      project: "{{ gcp_project }}"
+      auth_kind: "{{ gcp_cred_kind }}"
+      service_account_file: "{{ gcp_cred_file }}"
+      scopes:
+        - https://www.googleapis.com/auth/compute
+  register: results
+- name: verify that command succeeded
+  assert:
+    that:
+      - results['resources'] | length == 0
+# ----------------------------------------------------------------------------
+- name: delete a region health check that does not exist
+  google.cloud.gcp_compute_region_health_check:
+    name: "{{ resource_name }}"
+    type: TCP
+    tcp_health_check:
+      port_name: service-health
+      request: ping
+      response: pong
+    healthy_threshold: 10
+    timeout_sec: 2
+    unhealthy_threshold: 5
+    region: us-central1
+    project: "{{ gcp_project }}"
+    auth_kind: "{{ gcp_cred_kind }}"
+    service_account_file: "{{ gcp_cred_file }}"
+    state: absent
+  register: result
+- name: assert changed is false
+  assert:
+    that:
+      - result.changed == false

tests/integration/targets/gcp_compute_region_health_check/tasks/main.yml

@@ -0,0 +1,2 @@
+---
+- include_tasks: autogen.yml

tests/integration/targets/gcp_compute_ssl_certificate/tasks/autogen.yml

@@ -16,6 +16,7 @@
 - name: delete a SSL certificate
   google.cloud.gcp_compute_ssl_certificate:
     name: "{{ resource_name }}"
+    region: us-central1
     description: A certificate for testing. Do not use this certificate in production
     certificate: |-
       -----BEGIN CERTIFICATE-----
@@ -49,6 +50,7 @@
 - name: create a SSL certificate
   google.cloud.gcp_compute_ssl_certificate:
     name: "{{ resource_name }}"
+    region: us-central1
     description: A certificate for testing. Do not use this certificate in production
     certificate: |-
       -----BEGIN CERTIFICATE-----
@@ -101,6 +103,7 @@
 - name: create a SSL certificate that already exists
   google.cloud.gcp_compute_ssl_certificate:
     name: "{{ resource_name }}"
+    region: us-central1
     description: A certificate for testing. Do not use this certificate in production
     certificate: |-
       -----BEGIN CERTIFICATE-----
@@ -139,6 +142,7 @@
 - name: delete a SSL certificate
   google.cloud.gcp_compute_ssl_certificate:
     name: "{{ resource_name }}"
+    region: us-central1
     description: A certificate for testing. Do not use this certificate in production
     certificate: |-
       -----BEGIN CERTIFICATE-----
@@ -191,6 +195,7 @@
 - name: delete a SSL certificate that does not exist
   google.cloud.gcp_compute_ssl_certificate:
     name: "{{ resource_name }}"
+    region: us-central1
     description: A certificate for testing. Do not use this certificate in production
     certificate: |-
       -----BEGIN CERTIFICATE-----