Merge branch 'master' into master

.ansible-lint

@@ -1,10 +1,10 @@
 ---
+profile: production
 parseable: true
 skip_list:
   - ANSIBLE0010
 use_default_rules: true
 verbosity: 1
 exclude_paths:
-  - ./roles/gcp_http_lb/
+  # Ignore submodule https://github.com/GoogleCloudPlatform/google-cloud-ops-agents-ansible
-  - ./tests/
+  - roles/google_cloud_ops_agents/
-  - ./plugins

.github/workflows/ansible-integration-tests.yml

@@ -0,0 +1,73 @@
+---
+name: Run integration tests for the cloud.google collection
+on:
+  pull_request: {}
+  push:
+    branches: master
+env:
+  GCP_SERVICE_ACCOUNT: github-ci@ansible-gcp-ci.iam.gserviceaccount.com
+  GCP_PROJECT: ansible-gcp-ci
+  GCP_FOLDER_ID: "542027184392"
+jobs:
+  integration:
+    # NOTE: GitHub does not allow secrets to be used
+    # in PRs sent from forks. As such, this configuration is for
+    # PRs that the maintainers would like to send to test.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ansible_collections/google/cloud
+    strategy:
+      max-parallel: 1
+      matrix:
+        # Our current version strategy is to support both supported versions of ansible-core
+        # and test against the minimum version of Python supported by both. If/when we change
+        # the integration tests to support parallelism we can revisit.
+        ansible_version:
+          - stable-2.16
+          - stable-2.17
+    steps:
+      - name: check out code
+        uses: actions/checkout@v4
+        with:
+          path: ansible_collections/google/cloud
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'  # this is the minimum version required for Ansible 2.16
+      - name: Install dependencies
+        run: pip install -r requirements.txt
+      - name: Install ansible-base (${{ matrix.ansible_version }})
+        run: pip install https://github.com/ansible/ansible/archive/${{ matrix.ansible_version }}.tar.gz --disable-pip-version-check
+      # bootstrap integration env
+      - name: Write integration-test configuration files
+        env:
+          CI_SERVICE_ACCOUNT_FILE_CONTENTS: ${{ secrets.CI_SERVICE_ACCOUNT_FILE_CONTENTS }}
+        run: |
+          echo "$CI_SERVICE_ACCOUNT_FILE_CONTENTS" > /tmp/service-account-key.json
+          echo "[default]
+          gcp_project: $GCP_PROJECT
+          gcp_cred_file: /tmp/service-account-key.json
+          gcp_cred_kind: serviceaccount
+          gcp_cred_email: $GCP_SERVICE_ACCOUNT
+          gcp_folder_id: $GCP_FOLDER_ID
+          " > ./tests/integration/cloud-config-gcp.ini
+      # cleanup test environment
+      - name: Auth to Gcloud
+        uses: google-github-actions/auth@v1
+        env:
+          CI_SERVICE_ACCOUNT_FILE_CONTENTS: ${{ secrets.CI_SERVICE_ACCOUNT_FILE_CONTENTS }}
+        with:
+          service_account: $GCP_SERVICE_ACCOUNT
+          credentials_json: ${{ secrets.CI_SERVICE_ACCOUNT_FILE_CONTENTS }}
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@v1
+      - name: Run cleanup
+        run: |
+          ./scripts/bootstrap-project.sh $GCP_PROJECT $GCP_SERVICE_ACCOUNT
+          ./scripts/cleanup-project.sh $GCP_PROJECT $GCP_FOLDER_ID
+      # run tests
+      - name: Run integration tests
+        # Add the -vvv flag to print out more output
+        run: ansible-test integration -v --color --python 3.10 --venv-system-site-packages

.github/workflows/ansible-test.yml

@@ -0,0 +1,71 @@
+---
+name: Run tests for the cloud.google collection
+on: [pull_request]
+jobs:
+  sanity-and-lint:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ansible_collections/google/cloud
+    strategy:
+      matrix:
+        # Our version strategy is to test against the current and previous version
+        # of ansible-core and each major version of Python supported by both.
+        # https://docs.ansible.com/ansible/latest/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix
+        ansible_version:
+          - stable-2.16
+          - stable-2.17
+        python_version:
+          - '3.10'
+          - '3.11'
+          - '3.12'
+    steps:
+      - name: check out code
+        uses: actions/checkout@v4
+        with:
+          path: ansible_collections/google/cloud
+          submodules: 'true'
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ matrix.python_version }}
+      - name: Install ansible-base (${{ matrix.ansible_version }})
+        run: pip install https://github.com/ansible/ansible/archive/${{ matrix.ansible_version }}.tar.gz --disable-pip-version-check
+      - name: Run ansible-test sanity
+        # validate-modules cannot be turned on until #498 is resolved.
+        run: ansible-test sanity -v --color --skip validate-modules
+      - name: Install ansible-lint
+        run: pip install ansible-lint==24.7.0
+      - name: Run ansible-lint
+        run: ansible-lint --exclude roles/google_cloud_ops_agents/
+  unit:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ansible_collections/google/cloud
+    strategy:
+      matrix:
+        ansible_version:
+          - stable-2.16
+          - stable-2.17
+        python_version:
+          - '3.10'
+          - '3.11'
+          - '3.12'
+    steps:
+      - name: check out code
+        uses: actions/checkout@v4
+        with:
+          path: ansible_collections/google/cloud
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ matrix.python_version }}
+      - name: Install dependencies
+        run: pip install -r requirements.txt
+      - name: Install test dependencies
+        run: pip install -r requirements-test.txt
+      - name: Install ansible-base (${{ matrix.ansible_version }})
+        run: pip install https://github.com/ansible/ansible/archive/${{ matrix.ansible_version }}.tar.gz --disable-pip-version-check
+      - name: Run unit tests
+        run: ansible-test units -v --color --python "${{ matrix.python_version }}"

.github/workflows/automationhub.yml

@@ -1,16 +1,16 @@
+---
 name: Upload release to Automation Hub
 
 on:
   release:
     types: [created]
-
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v4
     - name: Set up Python
-      uses: actions/setup-python@v1
+      uses: actions/setup-python@v4
       with:
         python-version: '3.x'
     - name: Install dependencies
@@ -22,4 +22,4 @@ jobs:
         ANSIBLE_AUTOMATION_HUB_API_KEY: ${{ secrets.ANSIBLE_AUTOMATION_HUB_API_KEY }}
       run: |
         ansible-galaxy collection build .
-        ansible-galaxy collection publish *.tar.gz --api-key=$ANSIBLE_GALAXY_API_KEY -s=https://cloud.redhat.com/api/automation-hub/
+        ansible-galaxy collection publish *.tar.gz --api-key=$ANSIBLE_AUTOMATION_HUB_API_KEY -s=https://cloud.redhat.com/api/automation-hub/

.github/workflows/gcloud.yml

@@ -1,18 +1,19 @@
-name: "google.cloud.gcloud"
+---
+name: google.cloud.gcloud
 on:
   push:
     paths:
-      - 'roles/gcloud/**'
+      - roles/gcloud/**
-      - '.github/workflows/gcloud.yml'
+      - .github/workflows/gcloud.yml
-      - 'molecule/gcloud/**'
+      - molecule/gcloud/**
   pull_request:
     paths:
-      - 'roles/gcloud/**'
+      - roles/gcloud/**
-      - '.github/workflows/gcloud.yml'
+      - .github/workflows/gcloud.yml
-      - 'molecule/gcloud/**'
+      - molecule/gcloud/**
 jobs:
   molecule:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
@@ -22,41 +23,38 @@ jobs:
         molecule_playbook:
           - archive_playbook.yml
           - package_playbook.yml
-        molecule_distro:
-          - distro: centos:7
-            command: /usr/sbin/init
-          - distro: centos:8
-            command: /usr/sbin/init
-          - distro: ubuntu:16.04
-            command: /sbin/init
-          - distro: ubuntu:18.04
-            command: /lib/systemd/systemd
-          - distro: debian:9
-            command: /lib/systemd/systemd
         collection_role:
           - gcloud
     steps:
       - name: Check out code
-        uses: actions/checkout@v1
+        uses: actions/checkout@v4
         with:
           path: ansible_collections/google/cloud
 
-      - name: Set up Python 3.8
+      - name: Set up Python 3.10
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: '3.10'
 
       - name: Install dependencies
         run: |
-          sudo apt install docker
+          sudo apt-get install -y apt-transport-https ca-certificates curl gnupg \
+            lsb-release
+          curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg \
+            --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
+          echo \
+            "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
+            $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+          sudo apt-get update
+          sudo apt-get install -y docker-ce docker-ce-cli containerd.io
           python -m pip install --upgrade pip
-          pip install molecule yamllint ansible-lint docker
+          pip install molecule-plugins[docker] yamllint ansible ansible-lint docker
 
       - name: Run role test
+        working-directory: ansible_collections/google/cloud
         run: >-
           molecule --version &&
           ansible --version &&
-          MOLECULE_COMMAND=${{ matrix.molecule_distro.command }}
-          MOLECULE_DISTRO=${{ matrix.molecule_distro.distro }}
           MOLECULE_PLAYBOOK=${{ matrix.molecule_playbook }}
+          MOLECULE_NO_LOG="false"
           molecule --debug test -s ${{ matrix.collection_role }}

.github/workflows/gcsfuse.yml

@@ -1,4 +1,5 @@
-name: "google.cloud.gcsfuse"
+---
+name: google.cloud.gcsfuse
 on:
   push:
     paths:
@@ -10,43 +11,44 @@ on:
       - .github/workflows/gcsfuse.yml
 jobs:
   gcsfuse:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1
     strategy:
       fail-fast: false
       matrix:
-        molecule_distro:
-          - distro: ubuntu:16.04
-            command: /sbin/init
-          - distro: ubuntu:18.04
-            command: /lib/systemd/systemd
-          - distro: debian:9
-            command: /lib/systemd/systemd
         collection_role:
           - gcsfuse
     steps:
       - name: Check out code
-        uses: actions/checkout@v1
+        uses: actions/checkout@v4
         with:
           path: ansible_collections/google/cloud
 
-      - name: Set up Python 3.8
+      - name: Set up Python 3.10
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: '3.10'
 
       - name: Install dependencies
         run: |
-          sudo apt install docker
+          sudo apt-get install -y apt-transport-https ca-certificates curl gnupg \
+            lsb-release
+          curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg \
+            --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
+          echo \
+            "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
+            $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+          sudo apt-get update
+          sudo apt-get install -y docker-ce docker-ce-cli containerd.io
           python -m pip install --upgrade pip
-          pip install molecule yamllint ansible-lint docker
+          pip install molecule-plugins[docker] yamllint ansible ansible-lint docker
 
       - name: Run role test
+        working-directory: ansible_collections/google/cloud
         run: >-
           molecule --version &&
           ansible --version &&
-          MOLECULE_COMMAND=${{ matrix.molecule_distro.command }}
+          MOLECULE_NO_LOG="false"
-          MOLECULE_DISTRO=${{ matrix.molecule_distro.distro }}
           molecule --debug test -s ${{ matrix.collection_role }}

.github/workflows/pythonpublish.yml

@@ -1,16 +1,16 @@
+---
 name: Upload release to Galaxy
 
 on:
   release:
     types: [created]
-
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v4
     - name: Set up Python
-      uses: actions/setup-python@v1
+      uses: actions/setup-python@v4
       with:
         python-version: '3.x'
     - name: Install dependencies

.gitignore

@@ -0,0 +1,10 @@
+# personal credentials are added here: do not check in.
+tests/integration/cloud-config-gcp.ini
+ansible.cfg
+# running ansible integration tests adds files here.
+tests/integration/inventory
+tests/output/
+__pycache__
+*.tar.gz
+venv/
+changelogs/.plugin-cache.yaml

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "esbonio.sphinx.confDir": ""
+}

CHANGELOG.rst

@@ -0,0 +1,110 @@
+==========================
+Google.Cloud Release Notes
+==========================
+
+.. contents:: Topics
+
+v1.4.1
+======
+
+Bugfixes
+--------
+
+- gcp_kms_filters - add DOCUMENTATION string
+- gcp_secret_manager - make an f-string usage backward compatible
+
+v1.4.0
+======
+
+Minor Changes
+-------------
+
+- ansible - 2.16.0 is now the minimum version supported
+- ansible - 3.10 is now the minimum Python version
+- ansible-test - integration tests are now run against 2.16.0 and 2.17.0
+- gcloud role - use dnf instead of yum on RHEL
+- gcp_secret_manager - add as a module and lookup plugin (https://github.com/ansible-collections/google.cloud/pull/578)
+- gcp_secret_manager - support more than 10 versions (https://github.com/ansible-collections/google.cloud/pull/634)
+- restore google_cloud_ops_agents submodule (https://github.com/ansible-collections/google.cloud/pull/594)
+
+Bugfixes
+--------
+
+- ansible-lint - remove jinja templates from test assertions
+
+v1.3.0
+======
+
+Minor Changes
+-------------
+
+- anisble-test - integration tests are now run against 2.14.0 and 2.15.0
+- ansible - 2.14.0 is now the minimum version supported
+- ansible-lint - fixed over a thousand reported errors
+- ansible-lint - upgraded to 6.22
+- ansible-test - add support for GCP application default credentials (https://github.com/ansible-collections/google.cloud/issues/359).
+- gcp_serviceusage_service - added backoff when checking for operation completion.
+- gcp_serviceusage_service - use alloyb API for the integration test as spanner conflicts with other tests
+- gcp_sql_ssl_cert - made sha1_fingerprint optional, which enables resource creation
+- gcp_storage_default_object_acl - removed non-existent fields; the resource is not usable.
+
+v1.2.0
+======
+
+Minor Changes
+-------------
+
+- Add DataPlane V2 Support.
+- Add auth support for GCP access tokens (#574).
+- Add support for ip_allocation_policy->stack_type.
+
+Bugfixes
+--------
+
+- Use default service account if `service_account_email` is unset.
+
+v1.1.3
+======
+
+Bugfixes
+--------
+
+- gcp_compute_instance_info: fix incorrect documentation for filter which incorrectly pointed to the gcloud filter logic rather than the API (fixes #549)
+
+v1.1.2
+======
+
+Bugfixes
+--------
+
+- fix `gcp_compute` no longer being a valid name of the inventory plugin
+
+v1.1.1
+======
+
+Bugfixes
+--------
+
+- fix collection to work with Python 2.7
+
+v1.1.0
+======
+
+Minor Changes
+-------------
+
+- GCE inventory plugin - a new option ``name_suffix``, to add a suffix to the name parameter.
+
+Bugfixes
+--------
+
+- Disk has been fixed to send the sourceSnapshot parameter.
+- gcp_cloudtasks_queue - was not functional before, and is now functional.
+- gcp_compute_* - these resources use the correct selflink (www.googleapis.com) as the domain, no longer erroneously reporting changes after an execution.
+- gcp_compute_backend_service - no longer erroneously reports changes after an execution for ``capacity_scaler``.
+- gcp_container_cluster - support GKE clusters greater than 1.19+, which cannot use basic-auth.
+- gcp_crypto_key - skip_initial_version_creation defaults to the correct value.
+- gcp_iam_role - now properly undeletes and recognizes soft deleted roles as absent.
+- gcp_iam_role - update of a role is functional (GitHub
+- gcp_spanner_database - recognize a non-existent resource as absent.
+- gcp_storage_object - fix for correct version of dependency requirement.

CONTRIBUTING.md

@@ -0,0 +1,159 @@
+# Contributing to the google.cloud collection
+
+## Workflow summary
+
+1. [Clone the repository](#cloning).
+1. Make the desired code change.
+1. Add a [changelog fragment](https://docs.ansible.com/ansible/devel/community/development_process.html#changelogs-how-to) to describe your change.
+1. [Run integration tests locally and ensure they pass](running-integration-tests).
+1. Create a PR.
+
+## Cloning
+
+The `ansible-test` command expects that the repository is in a directory that matches it's collection,
+under a directory `ansible_collections`. Clone ensuring that hierarchy:
+
+```shell
+mkdir -p $TARGET_DIR/ansible_collections/google
+git clone <url> $TARGET_DIR/ansible_collections/google/cloud
+```
+
+Then set up your Python virtual environment:
+
+```shell
+cd $TARGET_DIR/ansible_collections/google/cloud
+python3 -m venv venv
+. ./venv/bin/activate
+pip3 install -r requirements.txt
+pip3 install -r requirements-test.txt
+pip3 install ansible
+```
+
+## Running tests
+
+### Prequisites for all tests
+
+- Install `gcloud` following [these instructions](https://cloud.google.com/sdk/docs/install).
+- Install the `ansible` package.
+- Some container runtime is necessary (e.g. `podman` or `docker`). The instructions use podman.
+
+## Running integration tests
+
+### Integration testing prequisites
+
+#### Authentication with personal GCP credentials
+
+If you are running the integration tests locally the easiest way to
+authenticate to GCP is using [application default credentials](https://cloud.google.com/sdk/docs/authorizing#adc).
+Once you have installed `gcloud` and performed basic initialization (via `gcloud init`) run:
+
+```shell
+gcloud auth application-default login
+```
+
+#### Authentication with service account credentials
+
+A service account may also be used to run the integration tests. You can create one using `gcloud`:
+
+```shell
+gcloud iam service-accounts create ansible-test-account \
+    --description="For running Anisble integration tests" \
+    --display-name="Ansible Test Account"
+```
+
+You'll also need to export a key file. Here and below `$SERVICE_ACCOUNT_NAME`
+is the full email address of the service account, in the form
+`EMAIL@PROJECT_ID.iam.gserviceaccount.com`, e.g., if you used the
+account name `ansible-test-account` as suggested above and your project
+ID is `my-test-project`, use `ansible-test-account@my-test-project.iam.gserviceaccount.com`.
+
+```shell
+gcloud iam service-accounts keys create /path/to/cred/file.json \
+    --iam-account=ansible-test-account@my-test-project.iam.gserviceaccount.com
+chmod 0600 /path/to/cred/file.json
+```
+
+Read the [best practices for managing service account keys](https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys)
+to learn how to keep your service account key and your GCP resources safe.
+
+#### Configuring test credentials
+
+The integration tests for this module require the use of real GCP credentials, and must provide
+ansible-test those values. They can be added by creating the file `tests/integration/cloud-config-gcp.ini`.
+
+If you are using personal (i.e., application default) credentials, add:
+
+```
+[default]
+gcp_project: $PROJECT_ID
+gcp_cred_kind: application
+gcp_folder_id: $TEST_FOLDER (to create test projects)
+```
+
+If you are using a service account for credentials, add:
+
+```
+[default]
+gcp_project: $PROJECT_ID
+gcp_cred_file: /path/to/cred/file.json
+gcp_cred_kind: serviceaccount
+gcp_folder_id: $TEST_FOLDER (to create test projects)
+```
+
+#### Setting up the project for testing
+
+Some of the setup of the project itself is done outside of the test,
+and is expected to be configured beforehand.
+
+For convenience, a bootstrap script is provided.
+
+NOTE: running this script will make irreversible changes in your
+GCP project (e.g. create an AppEngine project). You can omit
+`$SERVICE_ACCOUNT_NAME` is you are using application default credentials.
+
+```bash
+bash ./scripts/bootstrap-project.sh $PROJECT_ID $SERVICE_ACCOUNT_NAME
+```
+
+### Running
+
+Run `ansible-test integration`. Currently some tests are disabled as [test are being verified and added](https://github.com/ansible-collections/google.cloud/issues/499).
+
+## Role tests
+
+### Prequisites for role tests
+
+If you would like to use podman, you must
+install the `molecule-plugins[podman]` package in PyPI:
+
+```
+pip install --upgrade molecule-plugins[podman]
+```
+
+### Running role tests
+
+Ansible roles are tested via molecule.
+
+```sh
+module debug --test -s ${ROLE}
+```
+
+Role is the name of the role (e.g. gcloud, gcsfuse).
+
+Add `-d podman` if you would like to use the podman driver.
+
+If the linting fails, that is generally due to `ansible-lint`, which can be run directly:
+
+```
+ansible-lint
+```
+
+## Specific Tasks
+
+The following enumerates detailed documentation for specific tasks related to
+the codebase.
+
+### Updating the supported ansible-core version
+
+1. modify the [ansible-integration-tests.yaml](.github/workflows/ansible-integration-tests.yml) to the version of ansible-core that you would like to test against.
+1. (optional) update the version of ansible-core version required in [meta/runtime.yaml](meta/runtime.yml).

MAINTAINING.md

@@ -0,0 +1,84 @@
+# Maintainer Documentation
+
+## See CONTRIBUTING.md for more tasks
+
+[CONTRIBUTING.md](./CONTRIBUTING.md) contains more instructions that could
+apply to contributors and not just maintainers (e.g. update ansible-core version).
+
+## CI GCP Project Configuration
+
+To enable running integration tests, a test GCP project must be provided.
+
+There is a Google-maintained CI project, `ansible-gcp-ci`, that is used for this purpose. For any questions or modification to this project, please contact a maintainer who is employed by Google.
+
+## Reviewing PRs
+
+### Merging PRs
+
+Since running the full set of integration tests requires the usage of GCP
+credentials which are stored as a secret, maintainers must verify that tests pass the integration test run that runs on push to the master branch after accepting a change.
+
+## Release Process
+
+### Overview
+
+The process is as follows:
+
+1. Update the version of the collection.
+1. Update the changelog.
+2. Create a GitHub release to tag the repo and begin the publishing process.
+
+### Steps
+
+#### Update Collection Version
+
+Modify the [galaxy.yaml](./galaxy.yml) file to the desired collection version:
+
+```yaml
+version: {NEW_VERSION}
+```
+
+Ansible collection versions [must follow SEMVER](https://docs.ansible.com/ansible/devel/dev_guide/developing_collections_distributing.html#collection-versions).
+
+Alpha / beta releases are optional.
+
+#### Update the changelog
+
+Providing a valid [CHANGELOG.rst](./CHANGELOG.rst) is required for a certifiable
+collection release.
+
+Use the [antsibull-changelog](https://github.com/ansible-community/antsibull-changelog)
+tool to generate the changelog:
+
+```sh
+pip install antsibull-changelog
+antsibull-changelog release
+```
+
+This will remove all the changelog fragments from ./changelogs/fragments and
+merge them into CHANGELOG.rst.
+
+### Send a PR and merge
+
+Send a PR with these changes and merge them.
+
+### Create a new GitHub release
+
+Creating
+
+- [publish to Ansible Galaxy](./.github/workflows/pythonpublish.yml).
+
+### Publish to Automation Hub
+
+*note*: As automation Hub only accepts production releases, this step
+is only required for new full releases.
+
+This step does not use GitHub actions, as API keys for Automation Hub
+expire after 30 days of no use, and a maintainer may find themselves
+refreshing tokens every time anyway.
+
+Steps:
+
+1. Build the package locally: `ansible-galaxy collection build .`
+1. [Go to the Automation Hub my-namespaces page, then click on Google](https://console.redhat.com/ansible/automation-hub/repo/published/my-namespaces/google/)
+1. Publish the package

README.md

@@ -1,7 +1,18 @@
 # Google Cloud Platform Ansible Collection
 This collection provides a series of Ansible modules and plugins for interacting with the [Google Cloud Platform](https://cloud.google.com)
 
-This collection works with Ansible 2.9+
+This collection works with Ansible 2.16+
+
+# Communication
+
+* Join the Ansible forum:
+  * [Get Help](https://forum.ansible.com/c/help/6): get help or help others. Please use appropriate tags, for example `cloud`.
+  * [Social Spaces](https://forum.ansible.com/c/chat/4): gather and interact with fellow enthusiasts.
+  * [News & Announcements](https://forum.ansible.com/c/news/5): track project-wide announcements including social events.
+
+* The Ansible [Bullhorn newsletter](https://docs.ansible.com/ansible/devel/community/communication.html#the-bullhorn): used to announce releases and important changes.
+
+For more information about communication, see the [Ansible communication guide](https://docs.ansible.com/ansible/devel/community/communication.html).
 
 # Installation
 ```bash
@@ -9,89 +20,90 @@ ansible-galaxy collection install google.cloud
 ```
 
 # Resources Supported
-  * App Engine FirewallRule (gcp_appengine_firewall_rule, gcp_appengine_firewall_rule_facts)
+  * App Engine FirewallRule (gcp_appengine_firewall_rule, gcp_appengine_firewall_rule_info)
-  * BigQuery Dataset (gcp_bigquery_dataset, gcp_bigquery_dataset_facts)
+  * BigQuery Dataset (gcp_bigquery_dataset, gcp_bigquery_dataset_info)
-  * BigQuery Table (gcp_bigquery_table, gcp_bigquery_table_facts)
+  * BigQuery Table (gcp_bigquery_table, gcp_bigquery_table_info)
-  * Cloud Bigtable Instance (gcp_bigtable_instance, gcp_bigtable_instance_facts)
+  * Cloud Bigtable Instance (gcp_bigtable_instance, gcp_bigtable_instance_info)
-  * Cloud Build Trigger (gcp_cloudbuild_trigger, gcp_cloudbuild_trigger_facts)
+  * Cloud Build Trigger (gcp_cloudbuild_trigger, gcp_cloudbuild_trigger_info)
-  * Cloud Functions CloudFunction (gcp_cloudfunctions_cloud_function, gcp_cloudfunctions_cloud_function_facts)
+  * Cloud Functions CloudFunction (gcp_cloudfunctions_cloud_function, gcp_cloudfunctions_cloud_function_info)
-  * Cloud Scheduler Job (gcp_cloudscheduler_job, gcp_cloudscheduler_job_facts)
+  * Cloud Scheduler Job (gcp_cloudscheduler_job, gcp_cloudscheduler_job_info)
-  * Cloud Tasks Queue (gcp_cloudtasks_queue, gcp_cloudtasks_queue_facts)
+  * Cloud Tasks Queue (gcp_cloudtasks_queue, gcp_cloudtasks_queue_info)
-  * Compute Engine Address (gcp_compute_address, gcp_compute_address_facts)
+  * Compute Engine Address (gcp_compute_address, gcp_compute_address_info)
-  * Compute Engine Autoscaler (gcp_compute_autoscaler, gcp_compute_autoscaler_facts)
+  * Compute Engine Autoscaler (gcp_compute_autoscaler, gcp_compute_autoscaler_info)
-  * Compute Engine BackendBucket (gcp_compute_backend_bucket, gcp_compute_backend_bucket_facts)
+  * Compute Engine BackendBucket (gcp_compute_backend_bucket, gcp_compute_backend_bucket_info)
-  * Compute Engine BackendService (gcp_compute_backend_service, gcp_compute_backend_service_facts)
+  * Compute Engine BackendService (gcp_compute_backend_service, gcp_compute_backend_service_info)
-  * Compute Engine RegionBackendService (gcp_compute_region_backend_service, gcp_compute_region_backend_service_facts)
+  * Compute Engine RegionBackendService (gcp_compute_region_backend_service, gcp_compute_region_backend_service_info)
-  * Compute Engine Disk (gcp_compute_disk, gcp_compute_disk_facts)
+  * Compute Engine Disk (gcp_compute_disk, gcp_compute_disk_info)
-  * Compute Engine Firewall (gcp_compute_firewall, gcp_compute_firewall_facts)
+  * Compute Engine Firewall (gcp_compute_firewall, gcp_compute_firewall_info)
-  * Compute Engine ForwardingRule (gcp_compute_forwarding_rule, gcp_compute_forwarding_rule_facts)
+  * Compute Engine ForwardingRule (gcp_compute_forwarding_rule, gcp_compute_forwarding_rule_info)
-  * Compute Engine GlobalAddress (gcp_compute_global_address, gcp_compute_global_address_facts)
+  * Compute Engine GlobalAddress (gcp_compute_global_address, gcp_compute_global_address_info)
-  * Compute Engine GlobalForwardingRule (gcp_compute_global_forwarding_rule, gcp_compute_global_forwarding_rule_facts)
+  * Compute Engine GlobalForwardingRule (gcp_compute_global_forwarding_rule, gcp_compute_global_forwarding_rule_info)
-  * Compute Engine HttpHealthCheck (gcp_compute_http_health_check, gcp_compute_http_health_check_facts)
+  * Compute Engine HttpHealthCheck (gcp_compute_http_health_check, gcp_compute_http_health_check_info)
-  * Compute Engine HttpsHealthCheck (gcp_compute_https_health_check, gcp_compute_https_health_check_facts)
+  * Compute Engine HttpsHealthCheck (gcp_compute_https_health_check, gcp_compute_https_health_check_info)
-  * Compute Engine HealthCheck (gcp_compute_health_check, gcp_compute_health_check_facts)
+  * Compute Engine HealthCheck (gcp_compute_health_check, gcp_compute_health_check_info)
-  * Compute Engine InstanceTemplate (gcp_compute_instance_template, gcp_compute_instance_template_facts)
+  * Compute Engine InstanceTemplate (gcp_compute_instance_template, gcp_compute_instance_template_info)
-  * Compute Engine Image (gcp_compute_image, gcp_compute_image_facts)
+  * Compute Engine Image (gcp_compute_image, gcp_compute_image_info)
-  * Compute Engine Instance (gcp_compute_instance, gcp_compute_instance_facts)
+  * Compute Engine Instance (gcp_compute_instance, gcp_compute_instance_info)
-  * Compute Engine InstanceGroup (gcp_compute_instance_group, gcp_compute_instance_group_facts)
+  * Compute Engine InstanceGroup (gcp_compute_instance_group, gcp_compute_instance_group_info)
-  * Compute Engine InstanceGroupManager (gcp_compute_instance_group_manager, gcp_compute_instance_group_manager_facts)
+  * Compute Engine InstanceGroupManager (gcp_compute_instance_group_manager, gcp_compute_instance_group_manager_info)
-  * Compute Engine RegionInstanceGroupManager (gcp_compute_region_instance_group_manager, gcp_compute_region_instance_group_manager_facts)
+  * Compute Engine RegionInstanceGroupManager (gcp_compute_region_instance_group_manager, gcp_compute_region_instance_group_manager_info)
-  * Compute Engine InterconnectAttachment (gcp_compute_interconnect_attachment, gcp_compute_interconnect_attachment_facts)
+  * Compute Engine InterconnectAttachment (gcp_compute_interconnect_attachment, gcp_compute_interconnect_attachment_info)
-  * Compute Engine Network (gcp_compute_network, gcp_compute_network_facts)
+  * Compute Engine Network (gcp_compute_network, gcp_compute_network_info)
-  * Compute Engine NetworkEndpointGroup (gcp_compute_network_endpoint_group, gcp_compute_network_endpoint_group_facts)
+  * Compute Engine NetworkEndpointGroup (gcp_compute_network_endpoint_group, gcp_compute_network_endpoint_group_info)
-  * Compute Engine NodeGroup (gcp_compute_node_group, gcp_compute_node_group_facts)
+  * Compute Engine NodeGroup (gcp_compute_node_group, gcp_compute_node_group_info)
-  * Compute Engine NodeTemplate (gcp_compute_node_template, gcp_compute_node_template_facts)
+  * Compute Engine NodeTemplate (gcp_compute_node_template, gcp_compute_node_template_info)
-  * Compute Engine RegionAutoscaler (gcp_compute_region_autoscaler, gcp_compute_region_autoscaler_facts)
+  * Compute Engine RegionAutoscaler (gcp_compute_region_autoscaler, gcp_compute_region_autoscaler_info)
-  * Compute Engine RegionDisk (gcp_compute_region_disk, gcp_compute_region_disk_facts)
+  * Compute Engine RegionDisk (gcp_compute_region_disk, gcp_compute_region_disk_info)
-  * Compute Engine RegionUrlMap (gcp_compute_region_url_map, gcp_compute_region_url_map_facts)
+  * Compute Engine RegionUrlMap (gcp_compute_region_url_map, gcp_compute_region_url_map_info)
-  * Compute Engine RegionHealthCheck (gcp_compute_region_health_check, gcp_compute_region_health_check_facts)
+  * Compute Engine RegionHealthCheck (gcp_compute_region_health_check, gcp_compute_region_health_check_info)
-  * Compute Engine ResourcePolicy (gcp_compute_resource_policy, gcp_compute_resource_policy_facts)
+  * Compute Engine ResourcePolicy (gcp_compute_resource_policy, gcp_compute_resource_policy_info)
-  * Compute Engine Route (gcp_compute_route, gcp_compute_route_facts)
+  * Compute Engine Route (gcp_compute_route, gcp_compute_route_info)
-  * Compute Engine Router (gcp_compute_router, gcp_compute_router_facts)
+  * Compute Engine Router (gcp_compute_router, gcp_compute_router_info)
-  * Compute Engine Snapshot (gcp_compute_snapshot, gcp_compute_snapshot_facts)
+  * Compute Engine Snapshot (gcp_compute_snapshot, gcp_compute_snapshot_info)
-  * Compute Engine SslCertificate (gcp_compute_ssl_certificate, gcp_compute_ssl_certificate_facts)
+  * Compute Engine SslCertificate (gcp_compute_ssl_certificate, gcp_compute_ssl_certificate_info)
-  * Compute Engine Reservation (gcp_compute_reservation, gcp_compute_reservation_facts)
+  * Compute Engine Reservation (gcp_compute_reservation, gcp_compute_reservation_info)
-  * Compute Engine SslPolicy (gcp_compute_ssl_policy, gcp_compute_ssl_policy_facts)
+  * Compute Engine SslPolicy (gcp_compute_ssl_policy, gcp_compute_ssl_policy_info)
-  * Compute Engine Subnetwork (gcp_compute_subnetwork, gcp_compute_subnetwork_facts)
+  * Compute Engine Subnetwork (gcp_compute_subnetwork, gcp_compute_subnetwork_info)
-  * Compute Engine TargetHttpProxy (gcp_compute_target_http_proxy, gcp_compute_target_http_proxy_facts)
+  * Compute Engine TargetHttpProxy (gcp_compute_target_http_proxy, gcp_compute_target_http_proxy_info)
-  * Compute Engine TargetHttpsProxy (gcp_compute_target_https_proxy, gcp_compute_target_https_proxy_facts)
+  * Compute Engine TargetHttpsProxy (gcp_compute_target_https_proxy, gcp_compute_target_https_proxy_info)
-  * Compute Engine RegionTargetHttpProxy (gcp_compute_region_target_http_proxy, gcp_compute_region_target_http_proxy_facts)
+  * Compute Engine RegionTargetHttpProxy (gcp_compute_region_target_http_proxy, gcp_compute_region_target_http_proxy_info)
-  * Compute Engine RegionTargetHttpsProxy (gcp_compute_region_target_https_proxy, gcp_compute_region_target_https_proxy_facts)
+  * Compute Engine RegionTargetHttpsProxy (gcp_compute_region_target_https_proxy, gcp_compute_region_target_https_proxy_info)
-  * Compute Engine TargetInstance (gcp_compute_target_instance, gcp_compute_target_instance_facts)
+  * Compute Engine TargetInstance (gcp_compute_target_instance, gcp_compute_target_instance_info)
-  * Compute Engine TargetPool (gcp_compute_target_pool, gcp_compute_target_pool_facts)
+  * Compute Engine TargetPool (gcp_compute_target_pool, gcp_compute_target_pool_info)
-  * Compute Engine TargetSslProxy (gcp_compute_target_ssl_proxy, gcp_compute_target_ssl_proxy_facts)
+  * Compute Engine TargetSslProxy (gcp_compute_target_ssl_proxy, gcp_compute_target_ssl_proxy_info)
-  * Compute Engine TargetTcpProxy (gcp_compute_target_tcp_proxy, gcp_compute_target_tcp_proxy_facts)
+  * Compute Engine TargetTcpProxy (gcp_compute_target_tcp_proxy, gcp_compute_target_tcp_proxy_info)
-  * Compute Engine TargetVpnGateway (gcp_compute_target_vpn_gateway, gcp_compute_target_vpn_gateway_facts)
+  * Compute Engine TargetVpnGateway (gcp_compute_target_vpn_gateway, gcp_compute_target_vpn_gateway_info)
-  * Compute Engine UrlMap (gcp_compute_url_map, gcp_compute_url_map_facts)
+  * Compute Engine UrlMap (gcp_compute_url_map, gcp_compute_url_map_info)
-  * Compute Engine VpnTunnel (gcp_compute_vpn_tunnel, gcp_compute_vpn_tunnel_facts)
+  * Compute Engine VpnTunnel (gcp_compute_vpn_tunnel, gcp_compute_vpn_tunnel_info)
-  * Google Kubernetes Engine Cluster (gcp_container_cluster, gcp_container_cluster_facts)
+  * Google Kubernetes Engine Cluster (gcp_container_cluster, gcp_container_cluster_info)
-  * Google Kubernetes Engine NodePool (gcp_container_node_pool, gcp_container_node_pool_facts)
+  * Google Kubernetes Engine NodePool (gcp_container_node_pool, gcp_container_node_pool_info)
-  * Cloud DNS ManagedZone (gcp_dns_managed_zone, gcp_dns_managed_zone_facts)
+  * Cloud DNS ManagedZone (gcp_dns_managed_zone, gcp_dns_managed_zone_info)
-  * Cloud DNS ResourceRecordSet (gcp_dns_resource_record_set, gcp_dns_resource_record_set_facts)
+  * Cloud DNS ResourceRecordSet (gcp_dns_resource_record_set, gcp_dns_resource_record_set_info)
-  * Filestore Instance (gcp_filestore_instance, gcp_filestore_instance_facts)
+  * Filestore Instance (gcp_filestore_instance, gcp_filestore_instance_info)
-  * Cloud IAM Role (gcp_iam_role, gcp_iam_role_facts)
+  * Cloud IAM Role (gcp_iam_role, gcp_iam_role_info)
-  * Cloud IAM ServiceAccount (gcp_iam_service_account, gcp_iam_service_account_facts)
+  * Cloud IAM ServiceAccount (gcp_iam_service_account, gcp_iam_service_account_info)
-  * Cloud IAM ServiceAccountKey (gcp_iam_service_account_key, gcp_iam_service_account_key_facts)
+  * Cloud IAM ServiceAccountKey (gcp_iam_service_account_key, gcp_iam_service_account_key_info)
-  * Cloud Key Management Service KeyRing (gcp_kms_key_ring, gcp_kms_key_ring_facts)
+  * Cloud Key Management Service KeyRing (gcp_kms_key_ring, gcp_kms_key_ring_info)
-  * Cloud Key Management Service CryptoKey (gcp_kms_crypto_key, gcp_kms_crypto_key_facts)
+  * Cloud Key Management Service CryptoKey (gcp_kms_crypto_key, gcp_kms_crypto_key_info)
-  * Cloud (Stackdriver) Logging Metric (gcp_logging_metric, gcp_logging_metric_facts)
+  * Cloud (Stackdriver) Logging Metric (gcp_logging_metric, gcp_logging_metric_info)
-  * ML Engine Model (gcp_mlengine_model, gcp_mlengine_model_facts)
+  * ML Engine Model (gcp_mlengine_model, gcp_mlengine_model_info)
-  * ML Engine Version (gcp_mlengine_version, gcp_mlengine_version_facts)
+  * ML Engine Version (gcp_mlengine_version, gcp_mlengine_version_info)
-  * Cloud Pub/Sub Topic (gcp_pubsub_topic, gcp_pubsub_topic_facts)
+  * Cloud Pub/Sub Topic (gcp_pubsub_topic, gcp_pubsub_topic_info)
-  * Cloud Pub/Sub Subscription (gcp_pubsub_subscription, gcp_pubsub_subscription_facts)
+  * Cloud Pub/Sub Subscription (gcp_pubsub_subscription, gcp_pubsub_subscription_info)
-  * Memorystore (Redis) Instance (gcp_redis_instance, gcp_redis_instance_facts)
+  * Memorystore (Redis) Instance (gcp_redis_instance, gcp_redis_instance_info)
-  * Resource Manager Project (gcp_resourcemanager_project, gcp_resourcemanager_project_facts)
+  * Resource Manager Project (gcp_resourcemanager_project, gcp_resourcemanager_project_info)
-  * Runtime Configurator Config (gcp_runtimeconfig_config, gcp_runtimeconfig_config_facts)
+  * Runtime Configurator Config (gcp_runtimeconfig_config, gcp_runtimeconfig_config_info)
-  * Runtime Configurator Variable (gcp_runtimeconfig_variable, gcp_runtimeconfig_variable_facts)
+  * Runtime Configurator Variable (gcp_runtimeconfig_variable, gcp_runtimeconfig_variable_info)
-  * Service Usage Service (gcp_serviceusage_service, gcp_serviceusage_service_facts)
+  * Service Usage Service (gcp_serviceusage_service, gcp_serviceusage_service_info)
-  * Cloud Source Repositories Repository (gcp_sourcerepo_repository, gcp_sourcerepo_repository_facts)
+  * Cloud Source Repositories Repository (gcp_sourcerepo_repository, gcp_sourcerepo_repository_info)
-  * Cloud Spanner Instance (gcp_spanner_instance, gcp_spanner_instance_facts)
+  * Cloud Spanner Instance (gcp_spanner_instance, gcp_spanner_instance_info)
-  * Cloud Spanner Database (gcp_spanner_database, gcp_spanner_database_facts)
+  * Cloud Spanner Database (gcp_spanner_database, gcp_spanner_database_info)
-  * Cloud SQL Instance (gcp_sql_instance, gcp_sql_instance_facts)
+  * Cloud SQL Instance (gcp_sql_instance, gcp_sql_instance_info)
-  * Cloud SQL Database (gcp_sql_database, gcp_sql_database_facts)
+  * Cloud SQL Database (gcp_sql_database, gcp_sql_database_info)
-  * Cloud SQL User (gcp_sql_user, gcp_sql_user_facts)
+  * Cloud SQL User (gcp_sql_user, gcp_sql_user_info)
-  * Cloud SQL SslCert (gcp_sql_ssl_cert, gcp_sql_ssl_cert_facts)
+  * Cloud SQL SslCert (gcp_sql_ssl_cert, gcp_sql_ssl_cert_info)
-  * Cloud Storage Bucket (gcp_storage_bucket, gcp_storage_bucket_facts)
+  * Cloud Storage Bucket (gcp_storage_bucket, gcp_storage_bucket_info)
-  * Cloud Storage BucketAccessControl (gcp_storage_bucket_access_control, gcp_storage_bucket_access_control_facts)
+  * Cloud Storage BucketAccessControl (gcp_storage_bucket_access_control, gcp_storage_bucket_access_control_info)
-  * Cloud Storage DefaultObjectACL (gcp_storage_default_object_acl, gcp_storage_default_object_acl_facts)
+  * Cloud Storage DefaultObjectACL (gcp_storage_default_object_acl, gcp_storage_default_object_acl_info)
-  * Cloud TPU Node (gcp_tpu_node, gcp_tpu_node_facts)
+  * Cloud TPU Node (gcp_tpu_node, gcp_tpu_node_info)
+  * Secret Manager (gcp_secret_manager)

changelogs/changelog.yaml

@@ -0,0 +1,102 @@
+ancestor: null
+releases:
+  1.1.0:
+    changes:
+      bugfixes:
+      - Disk has been fixed to send the sourceSnapshot parameter.
+      - gcp_cloudtasks_queue - was not functional before, and is now functional.
+      - gcp_compute_* - these resources use the correct selflink (www.googleapis.com)
+        as the domain, no longer erroneously reporting changes after an execution.
+      - gcp_compute_backend_service - no longer erroneously reports changes after
+        an execution for ``capacity_scaler``.
+      - gcp_container_cluster - support GKE clusters greater than 1.19+, which cannot
+        use basic-auth.
+      - gcp_crypto_key - skip_initial_version_creation defaults to the correct value.
+      - gcp_iam_role - now properly undeletes and recognizes soft deleted roles as
+        absent.
+      - gcp_iam_role - update of a role is functional (GitHub
+      - gcp_spanner_database - recognize a non-existent resource as absent.
+      - gcp_storage_object - fix for correct version of dependency requirement.
+      minor_changes:
+      - GCE inventory plugin - a new option ``name_suffix``, to add a suffix to the
+        name parameter.
+    fragments:
+    - 0001_disk.yml
+    - bugfixes.yaml
+    release_date: '2022-12-16'
+  1.1.1:
+    changes:
+      bugfixes:
+      - fix collection to work with Python 2.7
+    fragments:
+    - fix-2.7.yml
+    release_date: '2022-12-16'
+  1.1.2:
+    changes:
+      bugfixes:
+      - fix `gcp_compute` no longer being a valid name of the inventory plugin
+    fragments:
+    - fix-inventory-plugin.yml
+    release_date: '2022-12-21'
+  1.1.3:
+    changes:
+      bugfixes:
+      - 'gcp_compute_instance_info: fix incorrect documentation for filter which incorrectly
+        pointed to the gcloud filter logic rather than the API (fixes #549)'
+    fragments:
+    - gce-changelog.yaml
+    release_date: '2023-03-04'
+  1.2.0:
+    changes:
+      bugfixes:
+      - Use default service account if `service_account_email` is unset.
+      minor_changes:
+      - Add DataPlane V2 Support.
+      - Add auth support for GCP access tokens (#574).
+      - Add support for ip_allocation_policy->stack_type.
+    release_date: '2023-07-07'
+  1.3.0:
+    changes:
+      minor_changes:
+      - anisble-test - integration tests are now run against 2.14.0 and 2.15.0
+      - ansible - 2.14.0 is now the minimum version supported
+      - ansible-lint - fixed over a thousand reported errors
+      - ansible-lint - upgraded to 6.22
+      - ansible-test - add support for GCP application default credentials (https://github.com/ansible-collections/google.cloud/issues/359).
+      - gcp_serviceusage_service - added backoff when checking for operation completion.
+      - gcp_serviceusage_service - use alloyb API for the integration test as spanner
+        conflicts with other tests
+      - gcp_sql_ssl_cert - made sha1_fingerprint optional, which enables resource
+        creation
+      - gcp_storage_default_object_acl - removed non-existent fields; the resource
+        is not usable.
+    fragments:
+    - app-default-creds.yml
+    - gcp_serviceusage_service.yml
+    - gcp_sql_ssl_cert.yml
+    - gcp_storage_default_object_acl.yml
+    - upgrade-versions.yml
+    release_date: '2023-11-22'
+  1.4.0:
+    changes:
+      bugfixes:
+      - ansible-lint - remove jinja templates from test assertions
+      minor_changes:
+      - ansible - 2.16.0 is now the minimum version supported
+      - ansible - 3.10 is now the minimum Python version
+      - ansible-test - integration tests are now run against 2.16.0 and 2.17.0
+      - gcloud role - use dnf instead of yum on RHEL
+      - gcp_secret_manager - add as a module and lookup plugin (https://github.com/ansible-collections/google.cloud/pull/578)
+      - gcp_secret_manager - support more than 10 versions (https://github.com/ansible-collections/google.cloud/pull/634)
+      - restore google_cloud_ops_agents submodule (https://github.com/ansible-collections/google.cloud/pull/594)
+    fragments:
+    - release-1-4-0.yml
+    release_date: '2024-08-21'
+  1.4.1:
+    changes:
+      bugfixes:
+      - gcp_kms_filters - add DOCUMENTATION string
+      - gcp_secret_manager - make an f-string usage backward compatible
+    fragments:
+    - release-1-4-1.yml
+    release_date: '2024-08-22'

changelogs/config.yaml

@@ -0,0 +1,33 @@
+---
+changelog_filename_template: ../CHANGELOG.rst
+changelog_filename_version_depth: 0
+changes_file: changelog.yaml
+changes_format: combined
+ignore_other_fragment_extensions: true
+keep_fragments: false
+mention_ancestor: true
+new_plugins_after_name: removed_features
+notesdir: fragments
+prelude_section_name: release_summary
+prelude_section_title: Release Summary
+sanitize_changelog: true
+sections:
+  - - major_changes
+    - Major Changes
+  - - minor_changes
+    - Minor Changes
+  - - breaking_changes
+    - Breaking Changes / Porting Guide
+  - - deprecated_features
+    - Deprecated Features
+  - - removed_features
+    - Removed Features (previously deprecated)
+  - - security_fixes
+    - Security Fixes
+  - - bugfixes
+    - Bugfixes
+  - - known_issues
+    - Known Issues
+title: Google.Cloud
+trivial_section_name: trivial
+use_fqcn: true

changelogs/fragments/0001_disk.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - Disk has been fixed to send the sourceSnapshot parameter.

galaxy.yml

@@ -1,3 +1,4 @@
+---
 ### REQUIRED
 
 # The namespace of the collection. This can be a company/brand/organization or product namespace under which all
@@ -9,7 +10,7 @@ namespace: google
 name: cloud
 
 # The version of the collection. Must be compatible with semantic versioning
-version: 1.0.2
+version: 1.4.1
 
 # The path to the Markdown (.md) readme file. This path is relative to the root of the collection
 readme: README.md
@@ -17,8 +18,8 @@ readme: README.md
 # A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
 # @nicks:irc/im.site#channel'
 authors:
-- Google <alexstephen@google.com>
+  - Google <alexstephen@google.com>
-
+  - Google <hawk@google.com>
 
 ### OPTIONAL but strongly recommended
 
@@ -28,7 +29,7 @@ description: The Google Cloud Platform collection.
 # Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
 # accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
 license:
-- GPL-2.0-or-later
+  - GPL-2.0-or-later
 
 # The path to the license file for the collection. This path is relative to the root of the collection. This key is
 # mutually exclusive with 'license'
@@ -37,11 +38,11 @@ license:
 # A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
 # requirements as 'namespace' and 'name'
 tags:
-    - cloud
+  - cloud
-    - gcsfuse
+  - gcsfuse
-    - stackdriver
+  - stackdriver
-    - logging
+  - logging
-    - monitoring
+  - monitoring
 
 # Collections that this collection requires to be installed for it to be usable. The key of the dict is the
 # collection label 'namespace.name'. The value is a version range
@@ -60,3 +61,6 @@ homepage: http://cloud.google.com
 
 # The URL to the collection issue tracker
 issues: https://github.com/ansible-collections/google.cloud/issues
+
+build_ignore:
+  - venv

meta/runtime.yml

@@ -1,5 +1,5 @@
 ---
-requires_ansible: '>=2.9'
+requires_ansible: ">=2.16.0"
 
 action_groups:
   gcp:
@@ -152,6 +152,7 @@ action_groups:
     - gcp_runtimeconfig_config_info
     - gcp_runtimeconfig_variable
     - gcp_runtimeconfig_variable_info
+    - gcp_secret_manager
     - gcp_serviceusage_service
     - gcp_serviceusage_service_info
     - gcp_sourcerepo_repository

molecule/gcloud/archive_playbook.yml

@@ -3,10 +3,10 @@
   hosts: all
   pre_tasks:
     - name: Install gpg for apt_key
-      apt:
+      ansible.builtin.apt:
         name: gnupg
         update_cache: true
-      when: ansible_os_family|lower == "debian"
+      when: ansible_os_family | lower == "debian"
   roles:
     - role: google.cloud.gcloud
       gcloud_install_type: archive

molecule/gcloud/converge.yml

@@ -3,21 +3,24 @@
   hosts: all
   pre_tasks:
     - name: Update package cache
-      package: update_cache=yes
+      ansible.builtin.package:
+        update_cache: "yes"
       changed_when: false
       register: task_result
       until: task_result is success
       retries: 10
       delay: 2
-    - name: create containerd folder
+    - name: Create containerd folder
-      file:
+      ansible.builtin.file:
         path: /etc/systemd/system/containerd.service.d
         state: directory
+        mode: "0755"
       when: ansible_service_mgr == "systemd"
-    - name: override file for containerd
+    - name: Override file for containerd
-      copy:
+      ansible.builtin.copy:
         src: files/override.conf
         dest: /etc/systemd/system/containerd.service.d/override.conf
+        mode: "0644"
       when: ansible_service_mgr == "systemd"
   roles:
     - role: google.cloud.gcloud

molecule/gcloud/molecule.yml

@@ -9,9 +9,15 @@ lint: |
   ansible-lint
 platforms:
   - name: instance
-    image: ${MOLECULE_DISTRO:-ubuntu:xenial}
+    image: ubuntu:20.04
     privileged: true
-    command: ${MOLECULE_COMMAND:-"sleep infinity"}
+    ansible.builtin.command: /lib/systemd/systemd
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+  - name: instance
+    image: debian:10
+    privileged: true
+    ansible.builtin.command: /lib/systemd/systemd
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:ro
 provisioner:

molecule/gcloud/package_playbook.yml

@@ -3,10 +3,10 @@
   hosts: all
   pre_tasks:
     - name: Install gpg for apt_key
-      apt:
+      ansible.builtin.apt:
         name: gnupg
         update_cache: true
-      when: ansible_os_family|lower == "debian"
+      when: ansible_os_family | lower == "debian"
   roles:
     - role: google.cloud.gcloud
       gcloud_additional_components:

molecule/gcloud/verify.yml

@@ -4,6 +4,6 @@
 - name: Verify
   hosts: all
   tasks:
-  - name: Example assertion
+    - name: Example assertion
-    assert:
+      ansible.builtin.assert:
-      that: true
+        that: true

molecule/gcsfuse/converge.yml

@@ -2,23 +2,13 @@
 - name: Converge
   hosts: all
   pre_tasks:
-    - name: Using apt update the packages
+    - name: Update package cache
-      apt:
+      ansible.builtin.package:
-        update_cache: yes
+        update_cache: "yes"
-      when: ansible_os_family == "Debian"
+      changed_when: false
-    - name: Using apt update the packages
+      register: task_result
-      yum:
+      until: task_result is success
-        update_cache: yes
+      retries: 10
-      when: ansible_os_family == "RedHat"
+      delay: 2
-    - name: create containerd folder
-      file:
-        path: /etc/systemd/system/containerd.service.d
-        state: directory
-      when: ansible_service_mgr == "systemd"
-    - name: override file for containerd
-      copy:
-        src: files/override.conf
-        dest: /etc/systemd/system/containerd.service.d/override.conf
-      when: ansible_service_mgr == "systemd"
   roles:
     - role: google.cloud.gcsfuse

molecule/gcsfuse/molecule.yml

@@ -9,9 +9,15 @@ lint: |
   ansible-lint
 platforms:
   - name: instance
-    image: ${MOLECULE_DISTRO:-ubuntu:xenial}
+    image: ubuntu:20.04
     privileged: true
-    command: ${MOLECULE_COMMAND:-"sleep infinity"}
+    ansible.builtin.command: /lib/systemd/systemd
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+  - name: instance
+    image: debian:10
+    privileged: true
+    ansible.builtin.command: /lib/systemd/systemd
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:ro
 provisioner:

molecule/gcsfuse/verify.yml

@@ -4,6 +4,6 @@
 - name: Verify
   hosts: all
   tasks:
-  - name: Example assertion
+    - name: Example assertion
-    assert:
+      ansible.builtin.assert:
-      that: true
+        that: true

plugins/doc_fragments/gcp.py

@@ -47,7 +47,7 @@ options:
         type: str
 notes:
   - for authentication, you can set service_account_file using the
-    c(gcp_service_account_file) env variable.
+    c(GCP_SERVICE_ACCOUNT_FILE) env variable.
   - for authentication, you can set service_account_contents using the
     c(GCP_SERVICE_ACCOUNT_CONTENTS) env variable.
   - For authentication, you can set service_account_email using the

plugins/filter/gcp_kms_filters.py

@@ -13,6 +13,15 @@
 from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
+DOCUMENTATION = '''
+    author:
+    - Eric Anderson <eric.sysmin@gmail.com>
+    name: gcp_kms_filters
+    short_description: Support auth tokens as a Filter plugin
+    description:
+    - Enables the 'accesstoken' authentication choice.
+'''
+
 from ansible.errors import AnsibleError
 from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import GcpSession
 
@@ -39,6 +48,7 @@ class GcpKmsFilter():
             'auth_kind': kwargs.get('auth_kind', None),
             'service_account_file': kwargs.get('service_account_file', None),
             'service_account_email': kwargs.get('service_account_email', None),
+            'access_token': kwargs.get('access_token', None),
         }
         if not params['scopes']:
             params['scopes'] = ['https://www.googleapis.com/auth/cloudkms']

plugins/inventory/gcp_compute.py

@@ -22,7 +22,7 @@ DOCUMENTATION = """
         plugin:
             description: token that ensures this is a source file for the 'gcp_compute' plugin.
             required: True
-            choices: ['google.cloud.gcp_compute']
+            choices: ['google.cloud.gcp_compute', 'gcp_compute']
         zones:
           description: A list of regions in which to describe GCE instances.
                        If none provided, it defaults to all zones available to a given project.
@@ -39,7 +39,7 @@ DOCUMENTATION = """
           description: >
             A list of filter value pairs. Available filters are listed here
             U(https://cloud.google.com/compute/docs/reference/rest/v1/instances/aggregatedList).
-            Each additional filter in the list will act be added as an AND condition
+            Each additional filter in the list will be added as an AND condition
             (filter1 and filter2)
           type: list
         hostnames:
@@ -48,30 +48,31 @@ DOCUMENTATION = """
               'public_ip', 'private_ip', 'name' or 'labels.vm_name'.
           default: ['public_ip', 'private_ip', 'name']
           type: list
+        name_suffix:
+          description: Custom domain suffix. If set, this string will be appended to all hosts.
+          default: ""
+          type: string
+          required: False
         auth_kind:
             description:
                 - The type of credential used.
             required: True
-            choices: ['application', 'serviceaccount', 'machineaccount']
+            choices: ['application', 'serviceaccount', 'machineaccount', 'accesstoken']
             env:
                 - name: GCP_AUTH_KIND
-                  version_added: "2.8.2"
         scopes:
             description: list of authentication scopes
             type: list
             default: ['https://www.googleapis.com/auth/compute']
             env:
                 - name: GCP_SCOPES
-                  version_added: "2.8.2"
         service_account_file:
             description:
                 - The path of a Service Account JSON file if serviceaccount is selected as type.
             type: path
             env:
                 - name: GCP_SERVICE_ACCOUNT_FILE
-                  version_added: "2.8.2"
                 - name: GCE_CREDENTIALS_FILE_PATH
-                  version_added: "2.8"
         service_account_contents:
             description:
                 - A string representing the contents of a Service Account JSON file. This should not be passed in as a dictionary,
@@ -79,14 +80,17 @@ DOCUMENTATION = """
             type: string
             env:
                 - name: GCP_SERVICE_ACCOUNT_CONTENTS
-            version_added: "2.8.2"
         service_account_email:
             description:
                 - An optional service account email address if machineaccount is selected
                   and the user does not wish to use the default email.
             env:
                 - name: GCP_SERVICE_ACCOUNT_EMAIL
-                  version_added: "2.8.2"
+        access_token:
+            description:
+                - An OAuth2 access token if credential type is accesstoken.
+            env:
+                - name: GCP_ACCESS_TOKEN
         vars_prefix:
             description: prefix to apply to host variables, does not include facts nor params
             default: ''
@@ -100,7 +104,6 @@ DOCUMENTATION = """
               which group names end up being used as.
           type: bool
           default: False
-          version_added: '2.8'
         retrieve_image_info:
           description:
             - Populate the C(image) host fact for the instances returned with the GCP image name
@@ -109,7 +112,6 @@ DOCUMENTATION = """
             - Unless this option is enabled, the C(image) host variable will be C(null)
           type: bool
           default: False
-          version_added: '2.8'
 """
 
 EXAMPLES = """
@@ -120,8 +122,8 @@ projects:
   - gcp-prod-gke-100
   - gcp-cicd-101
 filters:
-  - machineType = n1-standard-1
+  - status = RUNNING
-  - scheduling.automaticRestart = true AND machineType = n1-standard-1
+  - scheduling.automaticRestart = true AND status = RUNNING
 service_account_file: /tmp/service_account.json
 auth_kind: serviceaccount
 scopes:
@@ -131,6 +133,7 @@ keyed_groups:
   # Create groups from GCE labels
   - prefix: gcp
     key: labels
+name_suffix: .example.com
 hostnames:
   # List host by name instead of the default public ip
   - name
@@ -164,9 +167,12 @@ class GcpMockModule(object):
 
 
 class GcpInstance(object):
-    def __init__(self, json, hostname_ordering, project_disks, should_format=True):
+    def __init__(
+        self, json, hostname_ordering, project_disks, should_format=True, name_suffix=""
+    ):
         self.hostname_ordering = hostname_ordering
         self.project_disks = project_disks
+        self.name_suffix = name_suffix
         self.json = json
         if should_format:
             self.convert()
@@ -203,8 +209,8 @@ class GcpInstance(object):
 
     def _format_network_info(self, address):
         """
-            :param address: A GCP network address
+        :param address: A GCP network address
-            :return a dict with network shortname and region
+        :return a dict with network shortname and region
         """
         split = address.split("/")
         region = ""
@@ -216,8 +222,8 @@ class GcpInstance(object):
 
     def _format_metadata(self, metadata):
         """
-            :param metadata: A list of dicts where each dict has keys "key" and "value"
+        :param metadata: A list of dicts where each dict has keys "key" and "value"
-            :return a dict with key/value pairs for each in list.
+        :return a dict with key/value pairs for each in list.
         """
         new_metadata = {}
         for pair in metadata:
@@ -226,7 +232,7 @@ class GcpInstance(object):
 
     def hostname(self):
         """
-            :return the hostname of this instance
+        :return the hostname of this instance
         """
         for order in self.hostname_ordering:
             name = None
@@ -238,7 +244,7 @@ class GcpInstance(object):
             elif order == "private_ip":
                 name = self._get_privateip()
             elif order == "name":
-                name = self.json[u"name"]
+                name = self.json["name"] + self.name_suffix
             else:
                 raise AnsibleParserError("%s is not a valid hostname precedent" % order)
 
@@ -249,20 +255,20 @@ class GcpInstance(object):
 
     def _get_publicip(self):
         """
-            :return the publicIP of this instance or None
+        :return the publicIP of this instance or None
         """
         # Get public IP if exists
         for interface in self.json["networkInterfaces"]:
             if "accessConfigs" in interface:
                 for accessConfig in interface["accessConfigs"]:
                     if "natIP" in accessConfig:
-                        return accessConfig[u"natIP"]
+                        return accessConfig["natIP"]
         return None
 
     def _get_image(self):
         """
-            :param instance: A instance response from GCP
+        :param instance: A instance response from GCP
-            :return the image of this instance or None
+        :return the image of this instance or None
         """
         image = None
         if self.project_disks and "disks" in self.json:
@@ -273,13 +279,13 @@ class GcpInstance(object):
 
     def _get_privateip(self):
         """
-            :param item: A host response from GCP
+        :param item: A host response from GCP
-            :return the privateIP of this instance or None
+        :return the privateIP of this instance or None
         """
         # Fallback: Get private IP
-        for interface in self.json[u"networkInterfaces"]:
+        for interface in self.json["networkInterfaces"]:
             if "networkIP" in interface:
-                return interface[u"networkIP"]
+                return interface["networkIP"]
 
 
 class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
@@ -297,7 +303,7 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
 
     def _populate_host(self, item):
         """
-            :param item: A GCP instance
+        :param item: A GCP instance
         """
         hostname = item.hostname()
         self.inventory.add_host(hostname)
@@ -315,8 +321,8 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
 
     def verify_file(self, path):
         """
-            :param path: the path to the inventory config file
+        :param path: the path to the inventory config file
-            :return the contents of the config file
+        :return the contents of the config file
         """
         if super(InventoryModule, self).verify_file(path):
             if path.endswith(("gcp.yml", "gcp.yaml")):
@@ -327,10 +333,10 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
 
     def fetch_list(self, params, link, query):
         """
-            :param params: a dict containing all of the fields relevant to build URL
+        :param params: a dict containing all of the fields relevant to build URL
-            :param link: a formatted URL
+        :param link: a formatted URL
-            :param query: a formatted query string
+        :param query: a formatted query string
-            :return the JSON response containing a list of instances.
+        :return the JSON response containing a list of instances.
         """
         lists = []
         resp = self._return_if_object(
@@ -343,7 +349,10 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
                     self.fake_module,
                     self.auth_session.get(
                         link,
-                        params={"filter": query, "pageToken": resp.get("nextPageToken")},
+                        params={
+                            "filter": query,
+                            "pageToken": resp.get("nextPageToken"),
+                        },
                     ),
                 )
                 lists.append(resp.get("items"))
@@ -364,8 +373,8 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
 
     def _get_query_options(self, filters):
         """
-            :param config_data: contents of the inventory config file
+        :param config_data: contents of the inventory config file
-            :return A fully built query string
+        :return A fully built query string
         """
         if not filters:
             return ""
@@ -385,9 +394,9 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
 
     def _return_if_object(self, module, response):
         """
-            :param module: A GcpModule
+        :param module: A GcpModule
-            :param response: A Requests response object
+        :param response: A Requests response object
-            :return JSON response
+        :return JSON response
         """
         # If not found, return nothing.
         if response.status_code == 404:
@@ -412,9 +421,9 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
 
     def _add_hosts(self, items, config_data, format_items=True, project_disks=None):
         """
-            :param items: A list of hosts
+        :param items: A list of hosts
-            :param config_data: configuration data
+        :param config_data: configuration data
-            :param format_items: format items or not
+        :param format_items: format items or not
         """
         if not items:
             return
@@ -423,9 +432,11 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
         if self.get_option("hostnames"):
             hostname_ordering = self.get_option("hostnames")
 
+        name_suffix = self.get_option("name_suffix")
+
         for host_json in items:
             host = GcpInstance(
-                host_json, hostname_ordering, project_disks, format_items
+                host_json, hostname_ordering, project_disks, format_items, name_suffix
             )
             self._populate_host(host)
 
@@ -442,7 +453,7 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
 
     def _get_project_disks(self, config_data, query):
         """
-            project space disk images
+        project space disk images
         """
 
         try:
@@ -508,20 +519,20 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
 
     def fetch_projects(self, params, link, query):
         module = GcpMockModule(params)
-        auth = GcpSession(module, 'cloudresourcemanager')
+        auth = GcpSession(module, "cloudresourcemanager")
-        response = auth.get(link, params={'filter': query})
+        response = auth.get(link, params={"filter": query})
         return self._return_if_object(module, response)
 
     def projects_for_folder(self, config_data, folder):
-        link = 'https://cloudresourcemanager.googleapis.com/v1/projects'.format()
+        link = "https://cloudresourcemanager.googleapis.com/v1/projects"
-        query = 'parent.id = {0}'.format(folder)
+        query = "parent.id = {0}".format(folder)
         projects = []
-        config_data['scopes'] = ['https://www.googleapis.com/auth/cloud-platform']
+        config_data["scopes"] = ["https://www.googleapis.com/auth/cloud-platform"]
         projects_response = self.fetch_projects(config_data, link, query)
 
-        if 'projects' in projects_response:
+        if "projects" in projects_response:
-            for item in projects_response.get('projects'):
+            for item in projects_response.get("projects"):
-                projects.append(item['projectId'])
+                projects.append(item["projectId"])
         return projects
 
     def parse(self, inventory, loader, path, cache=True):
@@ -553,6 +564,7 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
             "service_account_file": self.get_option("service_account_file"),
             "service_account_contents": self.get_option("service_account_contents"),
             "service_account_email": self.get_option("service_account_email"),
+            "access_token": self.get_option("access_token"),
         }
 
         self.fake_module = GcpMockModule(params)

plugins/lookup/gcp_secret_manager.py

@@ -0,0 +1,246 @@
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+DOCUMENTATION = '''
+    author:
+    - Dave Costakos <dcostako@redhat.com>
+    name: gcp_secret_manager
+    short_description: Get Secrets from Google Cloud as a Lookup plugin
+    description:
+    - retrieve secret keys in Secret Manager for use in playbooks
+    - see https://cloud.google.com/iam/docs/service-account-creds for details on creating
+      credentials for Google Cloud and the format of such credentials
+    - once a secret value is retreived, it is returned decoded.  It is up to the developer
+      to maintain secrecy of this value once returned.
+
+    options:
+        key:
+            description:
+            - the name of the secret to look up in Secret Manager
+            type: str
+            required: True
+            aliases:
+            - name
+            - secret
+            - secret_id
+        project:
+            description:
+            - The name of the google cloud project
+            - defaults to OS env variable GCP_PROJECT if not present
+            type: str
+        auth_kind:
+            description:
+            - the type of authentication to use with Google Cloud (i.e. serviceaccount or machineaccount)
+            - defaults to OS env variable GCP_AUTH_KIND if not present
+            type: str
+        version:
+            description:
+            - the version name of your secret to retrieve
+            type: str
+            default: latest
+            required: False
+        service_account_email:
+            description:
+            - email associated with the service account
+            - defaults to OS env variable GCP_SERVICE_ACCOUNT_EMAIL if not present
+            type: str
+            required: False
+        service_account_file:
+            description:
+            - JSON Credential file obtained from Google Cloud
+            - defaults to OS env variable GCP_SERVICE_ACCOUNT_FILE if not present
+            - see https://cloud.google.com/iam/docs/service-account-creds for details
+            type: str
+            required: False
+        service_account_info:
+            description:
+            - JSON Object representing the contents of a service_account_file obtained from Google Cloud
+            - defaults to OS env variable GCP_SERVICE_ACCOUNT_INFO if not present
+            type: jsonarg
+            required: False
+        access_token:
+            description:
+            - support for GCP Access Token
+            - defaults to OS env variable GCP_ACCESS_TOKEN if not present
+            type: str
+            required: False
+        on_error:
+            description:
+            - how to handle errors
+            - strict means raise an exception
+            - warn means warn, and return none
+            - ignore means just return none
+            type: str
+            required: False
+            choices:
+            - 'strict'
+            - 'warn'
+            - 'ignore'
+            default: 'strict'
+        scopes:
+            description:
+            - Authenticaiton scopes for Google Secret Manager
+            type: list
+            default: ["https://www.googleapis.com/auth/cloud-platform"]
+'''
+
+EXAMPLES = '''
+- name: Test secret using env variables for credentials
+  ansible.builtin.debug:
+    msg: "{{ lookup('google.cloud.gcp_secret_manager', key='secret_key') }}"
+
+- name: Test secret using explicit credentials
+  ansible.builtin.debug:
+    msg: "{{ lookup('google.cloud.gcp_secret_manager', key='secret_key', project='project', auth_kind='serviceaccount', service_account_file='file.json') }}"
+
+- name: Test getting specific version of a secret (old version)
+  ansible.builtin.debug:
+    msg: "{{ lookup('google.cloud.gcp_secret_manager', key='secret_key', version='1') }}"
+
+- name: Test getting specific version of a secret (new version)
+  ansible.builtin.debug:
+    msg: "{{ lookup('google.cloud.gcp_secret_manager', key='secret_key', version='2') }}"
+'''
+
+RETURN = '''
+    _raw:
+        description: the contents of the secret requested (please use "no_log" to not expose this secret)
+        type: list
+        elements: str
+'''
+
+################################################################################
+# Imports
+################################################################################
+
+import os
+import base64
+
+from ansible.plugins.lookup import LookupBase
+from ansible.errors import AnsibleError
+from ansible.utils.display import Display
+
+try:
+    import requests
+    HAS_REQUESTS = True
+except ImportError:
+    HAS_REQUESTS = False
+
+try:
+    from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
+        GcpSession,
+    )
+    HAS_GOOGLE_CLOUD_COLLECTION = True
+except ImportError:
+    HAS_GOOGLE_CLOUD_COLLECTION = False
+
+
+class GcpLookupException(Exception):
+    pass
+
+
+class GcpMockModule(object):
+    def __init__(self, params):
+        self.params = params
+
+    def fail_json(self, *args, **kwargs):
+        raise AnsibleError(kwargs["msg"])
+
+    def raise_for_status(self, response):
+        try:
+            response.raise_for_status()
+        except getattr(requests.exceptions, "RequestException"):
+            self.fail_json(msg="GCP returned error: %s" % response.json())
+
+
+class LookupModule(LookupBase):
+    def run(self, terms=None, variables=None, **kwargs):
+        self._display = Display()
+        if not HAS_GOOGLE_CLOUD_COLLECTION:
+            raise AnsibleError(
+                """gcp_secret lookup needs a supported version of the google.cloud
+                collection installed. Use `ansible-galaxy collection install google.cloud`
+                to install it"""
+            )
+        self.set_options(var_options=variables, direct=kwargs)
+        params = {
+            "key": self.get_option("key"),
+            "version": self.get_option("version"),
+            "access_token": self.get_option("access_token"),
+            "scopes": self.get_option("scopes"),
+            "on_error": self.get_option("on_error")
+        }
+
+        params['name'] = params['key']
+
+        # support GCP_* env variables for some parameters
+        for param in ["project", "auth_kind", "service_account_file", "service_account_info", "service_account_email", "access_token"]:
+            params[param] = self.fallback_from_env(param)
+
+        self._display.vvv(msg=f"Module Parameters: {params}")
+        fake_module = GcpMockModule(params)
+        result = self.get_secret(fake_module)
+        return [base64.b64decode(result)]
+
+    def fallback_from_env(self, arg):
+        if self.get_option(arg):
+            return self.get_option(arg)
+        else:
+            env_name = f"GCP_{arg.upper()}"
+            if env_name in os.environ:
+                self.set_option(arg, os.environ[env_name])
+            return self.get_option(arg)
+
+    # set version to the latest version because
+    # we can't be sure that "latest" is always going
+    # to be set if secret versions get disabled
+    # see https://issuetracker.google.com/issues/286489671
+    def get_latest_version(self, module, auth):
+        url = "https://secretmanager.googleapis.com/v1/projects/{project}/secrets/{name}/versions?filter=state:ENABLED".format(
+            **module.params
+        )
+        response = auth.get(url)
+        self._display.vvv(msg=f"List Version Response: {response.status_code} for {response.request.url}: {response.json()}")
+        if response.status_code != 200:
+            self.raise_error(module, f"unable to list versions of secret {response.status_code}")
+        version_list = response.json()
+        if "versions" in version_list:
+            versions_numbers = []
+            for version in version_list['versions']:
+                versions_numbers.append(version['name'].split('/')[-1])
+            return sorted(versions_numbers, key=int)[-1]
+        else:
+            self.raise_error(module, f"Unable to list secret versions via {response.request.url}: {response.json()}")
+
+    def raise_error(self, module, msg):
+        if module.params['on_error'] == 'strict':
+            raise GcpLookupException(msg)
+        elif module.params['on_error'] == 'warn':
+            self._display.warning(msg)
+
+        return None
+
+    def get_secret(self, module):
+        auth = GcpSession(module, "secretmanager")
+        if module.params['version'] == "latest":
+            module.params['calc_version'] = self.get_latest_version(module, auth)
+        else:
+            module.params['calc_version'] = module.params['version']
+
+        # there was an error listing secret versions
+        if module.params['calc_version'] is None:
+            return ''
+
+        url = "https://secretmanager.googleapis.com/v1/projects/{project}/secrets/{name}/versions/{calc_version}:access".format(
+            **module.params
+        )
+        response = auth.get(url)
+        self._display.vvv(msg=f"Response: {response.status_code} for {response.request.url}: {response.json()}")
+        if response.status_code != 200:
+            self.raise_error(module, f"Failed to lookup secret value via {response.request.url} {response.status_code}")
+            return ''
+
+        return response.json()['payload']['data']

plugins/module_utils/gcp_utils.py

@@ -5,7 +5,6 @@ from __future__ import (absolute_import, division, print_function)
 
 __metaclass__ = type
 
-import ast
 import os
 import json
 
@@ -18,15 +17,14 @@ except ImportError:
 try:
     import google.auth
     import google.auth.compute_engine
-    from google.oauth2 import service_account
+    from google.oauth2 import service_account, credentials as oauth2
     from google.auth.transport.requests import AuthorizedSession
     HAS_GOOGLE_LIBRARIES = True
 except ImportError:
     HAS_GOOGLE_LIBRARIES = False
 
 from ansible.module_utils.basic import AnsibleModule, env_fallback
-from ansible.module_utils.six import string_types
+from ansible.module_utils._text import to_text
-from ansible.module_utils._text import to_text, to_native
 
 
 def navigate_hash(source, path, default=None):
@@ -107,12 +105,12 @@ class GcpSession(object):
         kwargs = {'json': body}
         return self.full_delete(url, **kwargs)
 
-    def put(self, url, body=None):
+    def put(self, url, body=None, params=None):
         """
         This method should be avoided in favor of full_put
         """
         kwargs = {'json': body}
-        return self.full_put(url, **kwargs)
+        return self.full_put(url, params=params, **kwargs)
 
     def patch(self, url, body=None, **kwargs):
         """
@@ -213,29 +211,56 @@ class GcpSession(object):
                 msg="Service Account File only works with Service Account-based authentication"
             )
 
+        if self.module.params.get('access_token') is not None and self.module.params['auth_kind'] != 'accesstoken':
+            self.module.fail_json(
+                msg='Supplying access_token requires auth_kind set to accesstoken'
+            )
+
     def _credentials(self):
         cred_type = self.module.params['auth_kind']
+
         if cred_type == 'application':
             credentials, project_id = google.auth.default(scopes=self.module.params['scopes'])
             return credentials
-        if cred_type == 'serviceaccount' and self.module.params.get('service_account_file'):
+
-            path = os.path.realpath(os.path.expanduser(self.module.params['service_account_file']))
+        if cred_type == 'serviceaccount':
-            if not os.path.exists(path):
+            service_account_file = self.module.params.get('service_account_file')
+            service_account_contents = self.module.params.get('service_account_contents')
+            if service_account_file is not None:
+                path = os.path.realpath(os.path.expanduser(service_account_file))
+                try:
+                    svc_acct_creds = service_account.Credentials.from_service_account_file(path)
+                except OSError as e:
+                    self.module.fail_json(
+                        msg="Unable to read service_account_file at %s: %s" % (path, e.strerror)
+                    )
+            elif service_account_contents is not None:
+                try:
+                    info = json.loads(service_account_contents)
+                except json.decoder.JSONDecodeError as e:
+                    self.module.fail_json(
+                        msg="Unable to decode service_account_contents as JSON: %s" % e
+                    )
+                svc_acct_creds = service_account.Credentials.from_service_account_info(info)
+            else:
                 self.module.fail_json(
-                    msg="Unable to find service_account_file at '%s'" % path
+                    msg='Service Account authentication requires setting either service_account_file or service_account_contents'
                 )
-            return service_account.Credentials.from_service_account_file(path).with_scopes(self.module.params['scopes'])
+            return svc_acct_creds.with_scopes(self.module.params['scopes'])
-        if cred_type == 'serviceaccount' and self.module.params.get('service_account_contents'):
+
-            try:
-                cred = json.loads(self.module.params.get('service_account_contents'))
-            except json.decoder.JSONDecodeError as e:
-                self.module.fail_json(
-                    msg="Unable to decode service_account_contents as JSON"
-                )
-            return service_account.Credentials.from_service_account_info(cred).with_scopes(self.module.params['scopes'])
         if cred_type == 'machineaccount':
-            return google.auth.compute_engine.Credentials(
+            email = self.module.params['service_account_email']
-                self.module.params['service_account_email'])
+            email = email if email is not None else "default"
+            return google.auth.compute_engine.Credentials(email)
+
+        if cred_type == 'accesstoken':
+            access_token = self.module.params['access_token']
+            if access_token is None:
+                self.module.fail_json(
+                    msg='An access token must be supplied when auth_kind is accesstoken'
+                )
+            return oauth2.Credentials(access_token, scopes=self.module.params['scopes'])
+
         self.module.fail_json(msg="Credential type '%s' not implemented" % cred_type)
 
     def _headers(self):
@@ -266,7 +291,7 @@ class GcpModule(AnsibleModule):
                 auth_kind=dict(
                     required=True,
                     fallback=(env_fallback, ['GCP_AUTH_KIND']),
-                    choices=['machineaccount', 'serviceaccount', 'application'],
+                    choices=['machineaccount', 'serviceaccount', 'accesstoken', 'application'],
                     type='str'),
                 service_account_email=dict(
                     required=False,
@@ -281,6 +306,11 @@ class GcpModule(AnsibleModule):
                     fallback=(env_fallback, ['GCP_SERVICE_ACCOUNT_CONTENTS']),
                     no_log=True,
                     type='jsonarg'),
+                access_token=dict(
+                    required=False,
+                    fallback=(env_fallback, ['GCP_ACCESS_TOKEN']),
+                    no_log=True,
+                    type='str'),
                 scopes=dict(
                     required=False,
                     fallback=(env_fallback, ['GCP_SCOPES']),
@@ -305,7 +335,14 @@ class GcpModule(AnsibleModule):
         try:
             response.raise_for_status()
         except getattr(requests.exceptions, 'RequestException') as inst:
-            self.fail_json(msg="GCP returned error: %s" % response.json())
+            self.fail_json(
+                msg="GCP returned error: %s" % response.json(),
+                request={
+                    "url": response.request.url,
+                    "body": response.request.body,
+                    "method": response.request.method,
+                }
+            )
 
     def _merge_dictionaries(self, a, b):
         new = a.copy()
@@ -342,7 +379,7 @@ class GcpRequest(object):
     def _compare_dicts(self, req_dict, resp_dict):
         difference = {}
         for key in req_dict:
-            if resp_dict.get(key):
+            if resp_dict.get(key) is not None:
                 difference[key] = self._compare_value(req_dict.get(key), resp_dict.get(key))
 
         # Remove all empty values from difference.
@@ -388,7 +425,7 @@ class GcpRequest(object):
         diff = None
         # If a None is found, a difference does not exist.
         # Only differing values matter.
-        if not resp_value:
+        if resp_value is None:
             return None
 
         # Can assume non-None types at this point.
@@ -424,7 +461,7 @@ class GcpRequest(object):
             # Value1 False, resp_value 'false'
             if not req_value and to_text(resp_value) == 'false':
                 return None
-            return resp_value
+            return True
 
         # to_text may throw UnicodeErrors.
         # These errors shouldn't crash Ansible and should be hidden.

plugins/modules/gcp_appengine_firewall_rule.py

@@ -87,6 +87,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -101,6 +102,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -121,6 +126,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -171,7 +178,7 @@ priority:
 # Imports
 ################################################################################
 
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest, replace_resource_dict
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
 import json
 
 ################################################################################

plugins/modules/gcp_appengine_firewall_rule_info.py

@@ -52,6 +52,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -66,6 +67,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -84,6 +89,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -134,7 +141,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_bigquery_dataset.py

@@ -224,6 +224,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -238,6 +239,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -258,6 +263,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -472,7 +479,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 

plugins/modules/gcp_bigquery_dataset_info.py

@@ -52,6 +52,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -66,6 +67,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -84,6 +89,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -295,7 +302,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_bigquery_table.py

@@ -475,6 +475,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -489,6 +490,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -994,7 +999,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 

plugins/modules/gcp_bigquery_table_info.py

@@ -57,6 +57,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -71,6 +72,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -89,6 +94,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -574,7 +581,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_bigtable_instance.py

@@ -117,6 +117,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -131,6 +132,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -235,7 +240,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import time
@@ -264,7 +268,7 @@ def main():
     )
 
     if not module.params['scopes']:
-        module.params['scopes'] = ['https://www.googleapis.com/auth/bigtable']
+        module.params['scopes'] = ['https://www.googleapis.com/auth/cloud-platform']
 
     state = module.params['state']
 

plugins/modules/gcp_bigtable_instance_info.py

@@ -52,6 +52,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -66,6 +67,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -84,6 +89,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -172,7 +179,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################
@@ -184,7 +191,7 @@ def main():
     module = GcpModule(argument_spec=dict())
 
     if not module.params['scopes']:
-        module.params['scopes'] = ['https://www.googleapis.com/auth/bigtable']
+        module.params['scopes'] = ['https://www.googleapis.com/auth/cloud-platform']
 
     return_value = {'resources': fetch_list(module, collection(module))}
     module.exit_json(**return_value)

plugins/modules/gcp_cloudbuild_trigger.py

@@ -727,6 +727,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -741,6 +742,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -761,6 +766,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -1482,7 +1489,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 

plugins/modules/gcp_cloudbuild_trigger_info.py

@@ -52,6 +52,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -66,6 +67,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -84,6 +89,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -798,7 +805,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_cloudfunctions_cloud_function.py

@@ -25,9 +25,13 @@ __metaclass__ = type
 # Documentation
 ################################################################################
 
-ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ["preview"], 'supported_by': 'community'}
+ANSIBLE_METADATA = {
+    "metadata_version": "1.1",
+    "status": ["preview"],
+    "supported_by": "community",
+}
 
-DOCUMENTATION = '''
+DOCUMENTATION = """
 ---
 module: gcp_cloudfunctions_cloud_function
 description:
@@ -69,8 +73,8 @@ options:
     type: str
   runtime:
     description:
-    - The runtime in which the function is going to run. If empty, defaults to Node.js
+    - The runtime in which to run the function. Required when deploying a new function,
-      6.
+      optional when updating an existing function.
     required: false
     type: str
   timeout:
@@ -170,6 +174,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -184,6 +189,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -195,9 +204,9 @@ options:
     - This should not be set unless you know what you're doing.
     - This only alters the User Agent string for any API requests.
     type: str
-'''
+"""
 
-EXAMPLES = '''
+EXAMPLES = """
 - name: create a cloud function
   google.cloud.gcp_cloudfunctions_cloud_function:
     name: test_object
@@ -209,9 +218,9 @@ EXAMPLES = '''
     auth_kind: serviceaccount
     service_account_file: "/tmp/auth.pem"
     state: present
-'''
+"""
 
-RETURN = '''
+RETURN = """
 name:
   description:
   - A user-defined name of the function. Function names must be unique globally and
@@ -353,7 +362,7 @@ trigger_http:
   - Use HTTP to trigger this function.
   returned: success
   type: bool
-'''
+"""
 
 ################################################################################
 # Imports
@@ -365,7 +374,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import re
@@ -381,43 +389,50 @@ def main():
 
     module = GcpModule(
         argument_spec=dict(
-            state=dict(default='present', choices=['present', 'absent'], type='str'),
+            state=dict(default="present", choices=["present", "absent"], type="str"),
-            name=dict(required=True, type='str'),
+            name=dict(required=True, type="str"),
-            description=dict(type='str'),
+            description=dict(type="str"),
-            entry_point=dict(type='str'),
+            entry_point=dict(type="str"),
-            runtime=dict(type='str'),
+            runtime=dict(type="str"),
-            timeout=dict(type='str'),
+            timeout=dict(type="str"),
-            available_memory_mb=dict(type='int'),
+            available_memory_mb=dict(type="int"),
-            labels=dict(type='dict'),
+            labels=dict(type="dict"),
-            environment_variables=dict(type='dict'),
+            environment_variables=dict(type="dict"),
-            source_archive_url=dict(type='str'),
+            source_archive_url=dict(type="str"),
-            source_upload_url=dict(type='str'),
+            source_upload_url=dict(type="str"),
-            source_repository=dict(type='dict', options=dict(url=dict(required=True, type='str'))),
+            source_repository=dict(
-            https_trigger=dict(type='dict', options=dict()),
+                type="dict", options=dict(url=dict(required=True, type="str"))
-            event_trigger=dict(
-                type='dict', options=dict(event_type=dict(required=True, type='str'), resource=dict(required=True, type='str'), service=dict(type='str'))
             ),
-            location=dict(required=True, type='str'),
+            https_trigger=dict(type="dict", options=dict()),
-            trigger_http=dict(type='bool'),
+            event_trigger=dict(
+                type="dict",
+                options=dict(
+                    event_type=dict(required=True, type="str"),
+                    resource=dict(required=True, type="str"),
+                    service=dict(type="str"),
+                ),
+            ),
+            location=dict(required=True, type="str"),
+            trigger_http=dict(type="bool"),
         )
     )
 
-    if not module.params['scopes']:
+    if not module.params["scopes"]:
-        module.params['scopes'] = ['https://www.googleapis.com/auth/cloud-platform']
+        module.params["scopes"] = ["https://www.googleapis.com/auth/cloud-platform"]
 
-    state = module.params['state']
+    state = module.params["state"]
 
     fetch = fetch_resource(module, self_link(module))
     changed = False
 
     # Need to set triggerHttps to {} if boolean true.
-    if fetch and fetch.get('httpsTrigger') and module.params['trigger_http']:
+    if fetch and fetch.get("httpsTrigger") and module.params["trigger_http"]:
-        module.params['https_trigger'] = fetch.get('httpsTrigger')
+        module.params["https_trigger"] = fetch.get("httpsTrigger")
-    elif module.params['trigger_http']:
+    elif module.params["trigger_http"]:
-        module.params['https_trigger'] = {}
+        module.params["https_trigger"] = {}
 
     if fetch:
-        if state == 'present':
+        if state == "present":
             if is_different(module, fetch):
                 update(module, self_link(module), fetch)
                 fetch = fetch_resource(module, self_link(module))
@@ -427,101 +442,115 @@ def main():
             fetch = {}
             changed = True
     else:
-        if state == 'present':
+        if state == "present":
             fetch = create(module, collection(module))
             changed = True
         else:
             fetch = {}
 
-    fetch.update({'changed': changed})
+    fetch.update({"changed": changed})
 
     module.exit_json(**fetch)
 
 
 def create(module, link):
-    auth = GcpSession(module, 'cloudfunctions')
+    auth = GcpSession(module, "cloudfunctions")
     return wait_for_operation(module, auth.post(link, resource_to_request(module)))
 
 
 def update(module, link, fetch):
-    auth = GcpSession(module, 'cloudfunctions')
+    auth = GcpSession(module, "cloudfunctions")
-    params = {'updateMask': updateMask(resource_to_request(module), response_to_hash(module, fetch))}
+    params = {
+        "updateMask": updateMask(
+            resource_to_request(module), response_to_hash(module, fetch)
+        )
+    }
     request = resource_to_request(module)
-    del request['name']
+    del request["name"]
     return wait_for_operation(module, auth.put(link, request, params=params))
 
 
 def updateMask(request, response):
     update_mask = []
-    if request.get('name') != response.get('name'):
+    if request.get("name") != response.get("name"):
-        update_mask.append('name')
+        update_mask.append("name")
-    if request.get('description') != response.get('description'):
+    if request.get("description") != response.get("description"):
-        update_mask.append('description')
+        update_mask.append("description")
-    if request.get('entryPoint') != response.get('entryPoint'):
+    if request.get("entryPoint") != response.get("entryPoint"):
-        update_mask.append('entryPoint')
+        update_mask.append("entryPoint")
-    if request.get('runtime') != response.get('runtime'):
+    if request.get("runtime") != response.get("runtime"):
-        update_mask.append('runtime')
+        update_mask.append("runtime")
-    if request.get('timeout') != response.get('timeout'):
+    if request.get("timeout") != response.get("timeout"):
-        update_mask.append('timeout')
+        update_mask.append("timeout")
-    if request.get('availableMemoryMb') != response.get('availableMemoryMb'):
+    if request.get("availableMemoryMb") != response.get("availableMemoryMb"):
-        update_mask.append('availableMemoryMb')
+        update_mask.append("availableMemoryMb")
-    if request.get('labels') != response.get('labels'):
+    if request.get("labels") != response.get("labels"):
-        update_mask.append('labels')
+        update_mask.append("labels")
-    if request.get('environmentVariables') != response.get('environmentVariables'):
+    if request.get("environmentVariables") != response.get("environmentVariables"):
-        update_mask.append('environmentVariables')
+        update_mask.append("environmentVariables")
-    if request.get('sourceArchiveUrl') != response.get('sourceArchiveUrl'):
+    if request.get("sourceArchiveUrl") != response.get("sourceArchiveUrl"):
-        update_mask.append('sourceArchiveUrl')
+        update_mask.append("sourceArchiveUrl")
-    if request.get('sourceUploadUrl') != response.get('sourceUploadUrl'):
+    if request.get("sourceUploadUrl") != response.get("sourceUploadUrl"):
-        update_mask.append('sourceUploadUrl')
+        update_mask.append("sourceUploadUrl")
-    if request.get('sourceRepository') != response.get('sourceRepository'):
+    if request.get("sourceRepository") != response.get("sourceRepository"):
-        update_mask.append('sourceRepository')
+        update_mask.append("sourceRepository")
-    if request.get('httpsTrigger') != response.get('httpsTrigger'):
+    if request.get("httpsTrigger") != response.get("httpsTrigger"):
-        update_mask.append('httpsTrigger')
+        update_mask.append("httpsTrigger")
-    if request.get('eventTrigger') != response.get('eventTrigger'):
+    if request.get("eventTrigger") != response.get("eventTrigger"):
-        update_mask.append('eventTrigger')
+        update_mask.append("eventTrigger")
-    if request.get('location') != response.get('location'):
+    if request.get("location") != response.get("location"):
-        update_mask.append('location')
+        update_mask.append("location")
-    if request.get('trigger_http') != response.get('trigger_http'):
+    if request.get("trigger_http") != response.get("trigger_http"):
-        update_mask.append('trigger_http')
+        update_mask.append("trigger_http")
-    return ','.join(update_mask)
+    return ",".join(update_mask)
 
 
 def delete(module, link):
-    auth = GcpSession(module, 'cloudfunctions')
+    auth = GcpSession(module, "cloudfunctions")
     return wait_for_operation(module, auth.delete(link))
 
 
 def resource_to_request(module):
     request = {
-        u'name': name_pattern(module.params.get('name'), module),
+        "name": name_pattern(module.params.get("name"), module),
-        u'description': module.params.get('description'),
+        "description": module.params.get("description"),
-        u'entryPoint': module.params.get('entry_point'),
+        "entryPoint": module.params.get("entry_point"),
-        u'runtime': module.params.get('runtime'),
+        "runtime": module.params.get("runtime"),
-        u'timeout': module.params.get('timeout'),
+        "timeout": module.params.get("timeout"),
-        u'availableMemoryMb': module.params.get('available_memory_mb'),
+        "availableMemoryMb": module.params.get("available_memory_mb"),
-        u'labels': module.params.get('labels'),
+        "labels": module.params.get("labels"),
-        u'environmentVariables': module.params.get('environment_variables'),
+        "environmentVariables": module.params.get("environment_variables"),
-        u'sourceArchiveUrl': module.params.get('source_archive_url'),
+        "sourceArchiveUrl": module.params.get("source_archive_url"),
-        u'sourceUploadUrl': module.params.get('source_upload_url'),
+        "sourceUploadUrl": module.params.get("source_upload_url"),
-        u'sourceRepository': CloudFunctionSourcerepository(module.params.get('source_repository', {}), module).to_request(),
+        "sourceRepository": CloudFunctionSourcerepository(
-        u'httpsTrigger': CloudFunctionHttpstrigger(module.params.get('https_trigger', {}), module).to_request(),
+            module.params.get("source_repository", {}), module
-        u'eventTrigger': CloudFunctionEventtrigger(module.params.get('event_trigger', {}), module).to_request(),
+        ).to_request(),
+        "httpsTrigger": CloudFunctionHttpstrigger(
+            module.params.get("https_trigger", {}), module
+        ).to_request(),
+        "eventTrigger": CloudFunctionEventtrigger(
+            module.params.get("event_trigger", {}), module
+        ).to_request(),
     }
     request = encode_request(request, module)
     return request
 
 
 def fetch_resource(module, link, allow_not_found=True):
-    auth = GcpSession(module, 'cloudfunctions')
+    auth = GcpSession(module, "cloudfunctions")
     return return_if_object(module, auth.get(link), allow_not_found)
 
 
 def self_link(module):
-    return "https://cloudfunctions.googleapis.com/v1/projects/{project}/locations/{location}/functions/{name}".format(**module.params)
+    return "https://cloudfunctions.googleapis.com/v1/projects/{project}/locations/{location}/functions/{name}".format(
+        **module.params
+    )
 
 
 def collection(module):
-    return "https://cloudfunctions.googleapis.com/v1/projects/{project}/locations/{location}/functions".format(**module.params)
+    return "https://cloudfunctions.googleapis.com/v1/projects/{project}/locations/{location}/functions".format(
+        **module.params
+    )
 
 
 def return_if_object(module, response, allow_not_found=False):
@@ -536,11 +565,11 @@ def return_if_object(module, response, allow_not_found=False):
     try:
         module.raise_for_status(response)
         result = response.json()
-    except getattr(json.decoder, 'JSONDecodeError', ValueError):
+    except getattr(json.decoder, "JSONDecodeError", ValueError):
         module.fail_json(msg="Invalid JSON response with error: %s" % response.text)
 
-    if navigate_hash(result, ['error', 'errors']):
+    if navigate_hash(result, ["error", "errors"]):
-        module.fail_json(msg=navigate_hash(result, ['error', 'errors']))
+        module.fail_json(msg=navigate_hash(result, ["error", "errors"]))
 
     return result
 
@@ -567,23 +596,29 @@ def is_different(module, response):
 # This is for doing comparisons with Ansible's current parameters.
 def response_to_hash(module, response):
     return {
-        u'name': response.get(u'name'),
+        "name": response.get("name"),
-        u'description': response.get(u'description'),
+        "description": response.get("description"),
-        u'status': response.get(u'status'),
+        "status": response.get("status"),
-        u'entryPoint': response.get(u'entryPoint'),
+        "entryPoint": response.get("entryPoint"),
-        u'runtime': response.get(u'runtime'),
+        "runtime": response.get("runtime"),
-        u'timeout': response.get(u'timeout'),
+        "timeout": response.get("timeout"),
-        u'availableMemoryMb': response.get(u'availableMemoryMb'),
+        "availableMemoryMb": response.get("availableMemoryMb"),
-        u'serviceAccountEmail': response.get(u'serviceAccountEmail'),
+        "serviceAccountEmail": response.get("serviceAccountEmail"),
-        u'updateTime': response.get(u'updateTime'),
+        "updateTime": response.get("updateTime"),
-        u'versionId': response.get(u'versionId'),
+        "versionId": response.get("versionId"),
-        u'labels': response.get(u'labels'),
+        "labels": response.get("labels"),
-        u'environmentVariables': response.get(u'environmentVariables'),
+        "environmentVariables": response.get("environmentVariables"),
-        u'sourceArchiveUrl': response.get(u'sourceArchiveUrl'),
+        "sourceArchiveUrl": response.get("sourceArchiveUrl"),
-        u'sourceUploadUrl': response.get(u'sourceUploadUrl'),
+        "sourceUploadUrl": response.get("sourceUploadUrl"),
-        u'sourceRepository': CloudFunctionSourcerepository(response.get(u'sourceRepository', {}), module).from_response(),
+        "sourceRepository": CloudFunctionSourcerepository(
-        u'httpsTrigger': CloudFunctionHttpstrigger(response.get(u'httpsTrigger', {}), module).from_response(),
+            response.get("sourceRepository", {}), module
-        u'eventTrigger': CloudFunctionEventtrigger(response.get(u'eventTrigger', {}), module).from_response(),
+        ).from_response(),
+        "httpsTrigger": CloudFunctionHttpstrigger(
+            response.get("httpsTrigger", {}), module
+        ).from_response(),
+        "eventTrigger": CloudFunctionEventtrigger(
+            response.get("eventTrigger", {}), module
+        ).from_response(),
     }
 
 
@@ -594,7 +629,9 @@ def name_pattern(name, module):
     regex = r"projects/.*/locations/.*/functions/.*"
 
     if not re.match(regex, name):
-        name = "projects/{project}/locations/{location}/functions/{name}".format(**module.params)
+        name = "projects/{project}/locations/{location}/functions/{name}".format(
+            **module.params
+        )
 
     return name
 
@@ -612,20 +649,20 @@ def wait_for_operation(module, response):
     op_result = return_if_object(module, response)
     if op_result is None:
         return {}
-    status = navigate_hash(op_result, ['done'])
+    status = navigate_hash(op_result, ["done"])
     wait_done = wait_for_completion(status, op_result, module)
-    raise_if_errors(wait_done, ['error'], module)
+    raise_if_errors(wait_done, ["error"], module)
-    return navigate_hash(wait_done, ['response'])
+    return navigate_hash(wait_done, ["response"])
 
 
 def wait_for_completion(status, op_result, module):
-    op_id = navigate_hash(op_result, ['name'])
+    op_id = navigate_hash(op_result, ["name"])
-    op_uri = async_op_url(module, {'op_id': op_id})
+    op_uri = async_op_url(module, {"op_id": op_id})
     while not status:
-        raise_if_errors(op_result, ['error'], module)
+        raise_if_errors(op_result, ["error"], module)
         time.sleep(1.0)
         op_result = fetch_resource(module, op_uri, False)
-        status = navigate_hash(op_result, ['done'])
+        status = navigate_hash(op_result, ["done"])
     return op_result
 
 
@@ -641,8 +678,8 @@ def encode_request(request, module):
         if v or v is False:
             return_vals[k] = v
 
-    if module.params['trigger_http'] and not return_vals.get('httpsTrigger'):
+    if module.params["trigger_http"] and not return_vals.get("httpsTrigger"):
-        return_vals['httpsTrigger'] = {}
+        return_vals["httpsTrigger"] = {}
 
     return return_vals
 
@@ -656,10 +693,10 @@ class CloudFunctionSourcerepository(object):
             self.request = {}
 
     def to_request(self):
-        return remove_nones_from_dict({u'url': self.request.get('url')})
+        return remove_nones_from_dict({"url": self.request.get("url")})
 
     def from_response(self):
-        return remove_nones_from_dict({u'url': self.request.get(u'url')})
+        return remove_nones_from_dict({"url": self.request.get("url")})
 
 
 class CloudFunctionHttpstrigger(object):
@@ -687,14 +724,22 @@ class CloudFunctionEventtrigger(object):
 
     def to_request(self):
         return remove_nones_from_dict(
-            {u'eventType': self.request.get('event_type'), u'resource': self.request.get('resource'), u'service': self.request.get('service')}
+            {
+                "eventType": self.request.get("event_type"),
+                "resource": self.request.get("resource"),
+                "service": self.request.get("service"),
+            }
         )
 
     def from_response(self):
         return remove_nones_from_dict(
-            {u'eventType': self.request.get(u'eventType'), u'resource': self.request.get(u'resource'), u'service': self.request.get(u'service')}
+            {
+                "eventType": self.request.get("eventType"),
+                "resource": self.request.get("resource"),
+                "service": self.request.get("service"),
+            }
         )
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     main()

plugins/modules/gcp_cloudfunctions_cloud_function_info.py

@@ -57,6 +57,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -71,6 +72,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -89,6 +94,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -257,7 +264,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_cloudscheduler_job.py

@@ -310,6 +310,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -324,6 +325,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -344,6 +349,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -627,7 +634,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 

plugins/modules/gcp_cloudscheduler_job_info.py

@@ -57,6 +57,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -71,6 +72,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -89,6 +94,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -363,7 +370,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_cloudtasks_queue.py

@@ -188,6 +188,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -202,6 +203,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -384,7 +389,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import re
@@ -489,7 +493,6 @@ def delete(module, link):
 
 def resource_to_request(module):
     request = {
-        u'location': module.params.get('location'),
         u'name': name_pattern(module.params.get('name'), module),
         u'appEngineRoutingOverride': QueueAppengineroutingoverride(module.params.get('app_engine_routing_override', {}), module).to_request(),
         u'rateLimits': QueueRatelimits(module.params.get('rate_limits', {}), module).to_request(),

plugins/modules/gcp_cloudtasks_queue_info.py

@@ -57,6 +57,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -71,6 +72,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -89,6 +94,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -263,7 +270,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_address.py

@@ -153,6 +153,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -167,6 +168,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -188,6 +193,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.

plugins/modules/gcp_compute_address_info.py

@@ -65,6 +65,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -79,6 +80,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -97,6 +102,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -219,7 +226,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_autoscaler.py

@@ -260,6 +260,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -274,6 +275,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -294,6 +299,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.

plugins/modules/gcp_compute_autoscaler_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -304,7 +311,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_backend_bucket.py

@@ -174,6 +174,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -188,6 +189,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -208,6 +213,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -366,7 +373,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import time

plugins/modules/gcp_compute_backend_bucket_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -236,7 +243,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_backend_service_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -746,7 +753,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_disk.py

@@ -238,6 +238,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -252,6 +253,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -272,6 +277,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.

plugins/modules/gcp_compute_disk_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -359,7 +366,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_external_vpn_gateway.py

@@ -104,6 +104,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -118,6 +119,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -137,6 +142,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -212,7 +219,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import time

plugins/modules/gcp_compute_external_vpn_gateway_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -159,7 +166,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_firewall.py

@@ -263,6 +263,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -277,6 +278,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -297,6 +302,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.

plugins/modules/gcp_compute_firewall_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -306,7 +313,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_forwarding_rule.py

@@ -237,6 +237,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -251,6 +252,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -271,6 +276,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.

plugins/modules/gcp_compute_forwarding_rule_info.py

@@ -65,6 +65,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -79,6 +80,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -97,6 +102,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -298,7 +305,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_global_address.py

@@ -124,6 +124,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -138,6 +139,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -158,6 +163,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.

plugins/modules/gcp_compute_global_address_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -189,7 +196,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_global_forwarding_rule.py

@@ -217,6 +217,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -231,6 +232,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used

plugins/modules/gcp_compute_global_forwarding_rule_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -273,7 +280,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_health_check.py

@@ -472,6 +472,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -486,6 +487,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -506,6 +511,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -916,7 +923,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import time

plugins/modules/gcp_compute_health_check_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -511,7 +518,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_http_health_check.py

@@ -125,6 +125,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -139,6 +140,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -159,6 +164,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -255,7 +262,7 @@ unhealthyThreshold:
 # Imports
 ################################################################################
 
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest, replace_resource_dict
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
 import json
 import time
 

plugins/modules/gcp_compute_http_health_check_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -188,7 +195,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_https_health_check.py

@@ -122,6 +122,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -136,6 +137,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -156,6 +161,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -252,7 +259,7 @@ unhealthyThreshold:
 # Imports
 ################################################################################
 
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest, replace_resource_dict
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
 import json
 import time
 

plugins/modules/gcp_compute_https_health_check_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -188,7 +195,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_image.py

@@ -229,6 +229,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -243,6 +244,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -263,6 +268,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.

plugins/modules/gcp_compute_image_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -335,7 +342,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_instance.py

@@ -522,6 +522,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -536,6 +537,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -827,7 +832,8 @@ metadata:
   type: dict
 machineType:
   description:
-  - A reference to a machine type which defines VM kind.
+  - A reference to a machine type which defines VM kind. See https://cloud.google.com/compute/docs/machine-types
+    for a list of current valid machine types.
   returned: success
   type: str
 minCpuPlatform:
@@ -1378,9 +1384,9 @@ def disk_type_selflink(name, params):
 def machine_type_selflink(name, params):
     if name is None:
         return
-    url = r"https://compute.googleapis.com/compute/v1/projects/.*/zones/.*/machineTypes/.*"
+    url = r"https://www.googleapis.com/compute/v1/projects/.*/zones/.*/machineTypes/.*"
     if not re.match(url, name):
-        name = "https://compute.googleapis.com/compute/v1/projects/{project}/zones/{zone}/machineTypes/%s".format(**params) % name
+        name = "https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/machineTypes/%s".format(**params) % name
     return name
 
 

plugins/modules/gcp_compute_instance_group.py

@@ -138,6 +138,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -152,6 +153,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used

plugins/modules/gcp_compute_instance_group_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -197,7 +204,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_instance_group_manager.py

@@ -136,6 +136,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -150,6 +151,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used

plugins/modules/gcp_compute_instance_group_manager_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -272,7 +279,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_instance_info.py

@@ -25,9 +25,13 @@ __metaclass__ = type
 # Documentation
 ################################################################################
 
-ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ["preview"], 'supported_by': 'community'}
+ANSIBLE_METADATA = {
+    "metadata_version": "1.1",
+    "status": ["preview"],
+    "supported_by": "community",
+}
 
-DOCUMENTATION = '''
+DOCUMENTATION = """
 ---
 module: gcp_compute_instance_info
 description:
@@ -41,7 +45,7 @@ requirements:
 options:
   filters:
     description:
-    - A list of filter value pairs. Available filters are listed here U(https://cloud.google.com/sdk/gcloud/reference/topic/filters).
+    - A list of filter value pairs. Available filters are listed here U(https://cloud.google.com/compute/docs/reference/rest/v1/instances/list)
     - Each additional filter in the list will act be added as an AND condition (filter1
       and filter2) .
     type: list
@@ -64,6 +68,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +83,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,13 +105,15 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
 - The I(service_account_email) and I(service_account_file) options are mutually exclusive.
-'''
+"""
 
-EXAMPLES = '''
+EXAMPLES = """
 - name: get info on an instance
   gcp_compute_instance_info:
     zone: us-central1-a
@@ -111,9 +122,9 @@ EXAMPLES = '''
     project: test_project
     auth_kind: serviceaccount
     service_account_file: "/tmp/auth.pem"
-'''
+"""
 
-RETURN = '''
+RETURN = """
 resources:
   description: List of resources
   returned: always
@@ -588,12 +599,16 @@ resources:
       - A reference to the zone where the machine resides.
       returned: success
       type: str
-'''
+"""
 
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
+    navigate_hash,
+    GcpSession,
+    GcpModule,
+)
 import json
 
 ################################################################################
@@ -602,27 +617,40 @@ import json
 
 
 def main():
-    module = GcpModule(argument_spec=dict(filters=dict(type='list', elements='str'), zone=dict(required=True, type='str')))
+    module = GcpModule(
+        argument_spec=dict(
+            filters=dict(type="list", elements="str"),
+            zone=dict(required=True, type="str"),
+        )
+    )
 
-    if not module.params['scopes']:
+    if not module.params["scopes"]:
-        module.params['scopes'] = ['https://www.googleapis.com/auth/compute']
+        module.params["scopes"] = ["https://www.googleapis.com/auth/compute"]
 
-    return_value = {'resources': fetch_list(module, collection(module), query_options(module.params['filters']))}
+    return_value = {
+        "resources": fetch_list(
+            module, collection(module), query_options(module.params["filters"])
+        )
+    }
     module.exit_json(**return_value)
 
 
 def collection(module):
-    return "https://compute.googleapis.com/compute/v1/projects/{project}/zones/{zone}/instances".format(**module.params)
+    return "https://compute.googleapis.com/compute/v1/projects/{project}/zones/{zone}/instances".format(
+        **module.params
+    )
 
 
 def fetch_list(module, link, query):
-    auth = GcpSession(module, 'compute')
+    auth = GcpSession(module, "compute")
-    return auth.list(link, return_if_object, array_name='items', params={'filter': query})
+    return auth.list(
+        link, return_if_object, array_name="items", params={"filter": query}
+    )
 
 
 def query_options(filters):
     if not filters:
-        return ''
+        return ""
 
     if len(filters) == 1:
         return filters[0]
@@ -630,12 +658,12 @@ def query_options(filters):
         queries = []
         for f in filters:
             # For multiple queries, all queries should have ()
-            if f[0] != '(' and f[-1] != ')':
+            if f[0] != "(" and f[-1] != ")":
-                queries.append("(%s)" % ''.join(f))
+                queries.append("(%s)" % "".join(f))
             else:
                 queries.append(f)
 
-        return ' '.join(queries)
+        return " ".join(queries)
 
 
 def return_if_object(module, response):
@@ -650,11 +678,11 @@ def return_if_object(module, response):
     try:
         module.raise_for_status(response)
         result = response.json()
-    except getattr(json.decoder, 'JSONDecodeError', ValueError) as inst:
+    except getattr(json.decoder, "JSONDecodeError", ValueError) as inst:
         module.fail_json(msg="Invalid JSON response with error: %s" % inst)
 
-    if navigate_hash(result, ['error', 'errors']):
+    if navigate_hash(result, ["error", "errors"]):
-        module.fail_json(msg=navigate_hash(result, ['error', 'errors']))
+        module.fail_json(msg=navigate_hash(result, ["error", "errors"]))
 
     return result
 

plugins/modules/gcp_compute_instance_template.py

@@ -485,6 +485,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -499,6 +500,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used

plugins/modules/gcp_compute_instance_template_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -544,7 +551,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_interconnect_attachment.py

@@ -194,6 +194,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -208,6 +209,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used

plugins/modules/gcp_compute_interconnect_attachment_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -304,7 +311,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_network.py

@@ -108,6 +108,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -122,6 +123,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -142,6 +147,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -239,7 +246,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import time

plugins/modules/gcp_compute_network_endpoint_group.py

@@ -124,6 +124,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -138,6 +139,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -158,6 +163,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.

plugins/modules/gcp_compute_network_endpoint_group_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -176,7 +183,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_network_info.py

@@ -59,6 +59,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -73,6 +74,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -91,6 +96,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -186,7 +193,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_node_group.py

@@ -141,6 +141,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -155,6 +156,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -175,6 +180,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.

plugins/modules/gcp_compute_node_group_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -203,7 +210,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_node_template.py

@@ -135,6 +135,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -149,6 +150,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -169,6 +174,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -280,7 +287,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import re

plugins/modules/gcp_compute_node_template_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -204,7 +211,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_region_autoscaler.py

@@ -237,6 +237,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -251,6 +252,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -271,6 +276,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -539,7 +546,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import time

plugins/modules/gcp_compute_region_autoscaler_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -304,7 +311,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_region_backend_service.py

@@ -718,6 +718,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -732,6 +733,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -752,6 +757,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.

plugins/modules/gcp_compute_region_backend_service_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -771,7 +778,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_region_disk.py

@@ -176,6 +176,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -190,6 +191,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -210,6 +215,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -398,7 +405,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import re

plugins/modules/gcp_compute_region_disk_info.py

@@ -64,6 +64,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -78,6 +79,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -96,6 +101,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -277,7 +284,7 @@ resources:
 ################################################################################
 # Imports
 ################################################################################
-from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule, GcpRequest
+from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import navigate_hash, GcpSession, GcpModule
 import json
 
 ################################################################################

plugins/modules/gcp_compute_region_health_check.py

@@ -472,6 +472,7 @@ options:
     - application
     - machineaccount
     - serviceaccount
+    - accesstoken
   service_account_contents:
     description:
     - The contents of a Service Account JSON file, either in a dictionary or as a
@@ -486,6 +487,10 @@ options:
     - An optional service account email address if machineaccount is selected and
       the user does not wish to use the default email.
     type: str
+  access_token:
+    description:
+    - An OAuth2 access token if credential type is accesstoken.
+    type: str
   scopes:
     description:
     - Array of scopes to be used
@@ -506,6 +511,8 @@ notes:
   env variable.
 - For authentication, you can set service_account_email using the C(GCP_SERVICE_ACCOUNT_EMAIL)
   env variable.
+- For authentication, you can set access_token using the C(GCP_ACCESS_TOKEN)
+  env variable.
 - For authentication, you can set auth_kind using the C(GCP_AUTH_KIND) env variable.
 - For authentication, you can set scopes using the C(GCP_SCOPES) env variable.
 - Environment variables values will only be used if the playbook values are not set.
@@ -922,7 +929,6 @@ from ansible_collections.google.cloud.plugins.module_utils.gcp_utils import (
     GcpModule,
     GcpRequest,
     remove_nones_from_dict,
-    replace_resource_dict,
 )
 import json
 import re