@ -1,23 +1,19 @@
---
# A Note about ec2 environment variable name preference:
# - EC2_URL -> AWS_URL
# - EC2_ACCESS_KEY -> AWS_ACCESS_KEY_ID -> AWS_ACCESS_KEY
# - EC2_SECRET_KEY -> AWS_SECRET_ACCESS_KEY -> AWX_SECRET_KEY
# - EC2_REGION -> AWS_REGION
#
# - include: ../../setup_ec2/tasks/common.yml module_name: ec2_vpc_subnet
- block:
- name : set up aws connection info
- module_defaults:
group/aws:
aws_access_key : "{{ aws_access_key }}"
aws_secret_key : "{{ aws_secret_key }}"
security_token : "{{ security_token | default(omit) }}"
region : "{{ aws_region }}"
block:
- name : list available AZs
aws_az_info:
register : region_azs
- name : pick an AZ for testing
set_fact:
aws_connection_info : &aws_connection_info
aws_access_key : "{{ aws_access_key }}"
aws_secret_key : "{{ aws_secret_key }}"
security_token : "{{ security_token }}"
region : "{{ aws_region }}"
no_log : yes
subnet_az : "{{ region_azs.availability_zones[0].zone_name }}"
# ============================================================
- name : create a VPC
@ -25,7 +21,6 @@
name : "{{ resource_prefix }}-vpc"
state : present
cidr_block : "10.232.232.128/26"
<< : *aws_connection_info
tags:
Name : "{{ resource_prefix }}-vpc"
Description : "Created by ansible-test"
@ -35,12 +30,11 @@
- name : create subnet (expected changed=true) (CHECK MODE)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
<< : *aws_connection_info
state : present
check_mode : true
register : vpc_subnet_create
@ -48,17 +42,16 @@
- name : assert creation would happen
assert:
that:
- vpc_subnet_create . changed
- vpc_subnet_create is changed
- name : create subnet (expected changed=true)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
<< : *aws_connection_info
state : present
register : vpc_subnet_create
@ -73,12 +66,11 @@
- name : recreate subnet (expected changed=false) (CHECK MODE)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
<< : *aws_connection_info
state : present
check_mode : true
register : vpc_subnet_recreate
@ -86,36 +78,34 @@
- name : assert recreation changed nothing (expected changed=false)
assert:
that:
- 'not vpc_subnet_recreate.changed'
- vpc_subnet_recreate is not changed
- name : recreate subnet (expected changed=false)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
<< : *aws_connection_info
state : present
register : vpc_subnet_recreate
- name : assert recreation changed nothing (expected changed=false)
assert:
that:
- 'not vpc_subnet_recreate.changed'
- vpc_subnet_recreate is not changed
- 'vpc_subnet_recreate.subnet == vpc_subnet_create.subnet'
# ============================================================
- name : update subnet so instances launched in it are assigned an IP (CHECK MODE)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
<< : *aws_connection_info
state : present
map_public : true
check_mode : true
@ -124,17 +114,16 @@
- name : assert subnet changed
assert:
that:
- vpc_subnet_modify . changed
- vpc_subnet_modify is changed
- name : update subnet so instances launched in it are assigned an IP
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
<< : *aws_connection_info
state : present
map_public : true
register : vpc_subnet_modify
@ -142,20 +131,19 @@
- name : assert subnet changed
assert:
that:
- vpc_subnet_modify . changed
- vpc_subnet_modify is changed
- vpc_subnet_modify.subnet.map_public_ip_on_launch
# ============================================================
- name : add invalid ipv6 block to subnet (expected failed)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
ipv6_cidr : 2001 : db8::/64
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
<< : *aws_connection_info
state : present
register : vpc_subnet_ipv6_failed
ignore_errors : yes
@ -163,20 +151,19 @@
- name : assert failure happened (expected failed)
assert:
that:
- 'vpc_subnet_ipv6_failed.failed'
- vpc_subnet_ipv6_failed is failed
- "'Couldn\\'t associate ipv6 cidr' in vpc_subnet_ipv6_failed.msg"
# ============================================================
- name : add a tag (expected changed=true) (CHECK MODE)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
AnotherTag : SomeValue
<< : *aws_connection_info
state : present
check_mode : true
register : vpc_subnet_add_a_tag
@ -184,25 +171,24 @@
- name : assert tag addition happened (expected changed=true)
assert:
that:
- 'vpc_subnet_add_a_tag.changed'
- vpc_subnet_add_a_tag is changed
- name : add a tag (expected changed=true)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
AnotherTag : SomeValue
<< : *aws_connection_info
state : present
register : vpc_subnet_add_a_tag
- name : assert tag addition happened (expected changed=true)
assert:
that:
- 'vpc_subnet_add_a_tag.changed'
- vpc_subnet_add_a_tag is changed
- '"Name" in vpc_subnet_add_a_tag.subnet.tags and vpc_subnet_add_a_tag.subnet.tags["Name"] == ec2_vpc_subnet_name'
- '"Description" in vpc_subnet_add_a_tag.subnet.tags and vpc_subnet_add_a_tag.subnet.tags["Description"] == ec2_vpc_subnet_description'
- '"AnotherTag" in vpc_subnet_add_a_tag.subnet.tags and vpc_subnet_add_a_tag.subnet.tags["AnotherTag"] == "SomeValue"'
@ -211,11 +197,10 @@
- name : remove tags with default purge_tags=true (expected changed=true) (CHECK MODE)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
AnotherTag : SomeValue
<< : *aws_connection_info
state : present
check_mode : true
register : vpc_subnet_remove_tags
@ -223,23 +208,22 @@
- name : assert tag removal happened (expected changed=true)
assert:
that:
- 'vpc_subnet_remove_tags.changed'
- vpc_subnet_remove_tags is changed
- name : remove tags with default purge_tags=true (expected changed=true)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
AnotherTag : SomeValue
<< : *aws_connection_info
state : present
register : vpc_subnet_remove_tags
- name : assert tag removal happened (expected changed=true)
assert:
that:
- 'vpc_subnet_remove_tags.changed'
- vpc_subnet_remove_tags is changed
- '"Name" not in vpc_subnet_remove_tags.subnet.tags'
- '"Description" not in vpc_subnet_remove_tags.subnet.tags'
- '"AnotherTag" in vpc_subnet_remove_tags.subnet.tags and vpc_subnet_remove_tags.subnet.tags["AnotherTag"] == "SomeValue"'
@ -248,12 +232,11 @@
- name : change tags with purge_tags=false (expected changed=true) (CHECK MODE)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
<< : *aws_connection_info
state : present
purge_tags : false
check_mode : true
@ -262,17 +245,16 @@
- name : assert tag addition happened (expected changed=true)
assert:
that:
- 'vpc_subnet_change_tags.changed'
- vpc_subnet_change_tags is changed
- name : change tags with purge_tags=false (expected changed=true)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
az : "{{ aws_region }}a "
az : "{{ subnet_az }} "
vpc_id : "{{ vpc_result.vpc.id }}"
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
<< : *aws_connection_info
state : present
purge_tags : false
register : vpc_subnet_change_tags
@ -280,7 +262,7 @@
- name : assert tag addition happened (expected changed=true)
assert:
that:
- 'vpc_subnet_change_tags.changed'
- vpc_subnet_change_tags is changed
- '"Name" in vpc_subnet_change_tags.subnet.tags and vpc_subnet_change_tags.subnet.tags["Name"] == ec2_vpc_subnet_name'
- '"Description" in vpc_subnet_change_tags.subnet.tags and vpc_subnet_change_tags.subnet.tags["Description"] == ec2_vpc_subnet_description'
- '"AnotherTag" in vpc_subnet_change_tags.subnet.tags and vpc_subnet_change_tags.subnet.tags["AnotherTag"] == "SomeValue"'
@ -291,27 +273,25 @@
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
state : absent
<< : *aws_connection_info
check_mode : true
register : result
- name : assert state=absent (expected changed=true)
assert:
that:
- 'result.changed'
- result is changed
- name : test state=absent (expected changed=true)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
state : absent
<< : *aws_connection_info
register : result
- name : assert state=absent (expected changed=true)
assert:
that:
- 'result.changed'
- result is changed
# ============================================================
- name : test state=absent (expected changed=false) (CHECK MODE)
@ -319,27 +299,25 @@
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
state : absent
<< : *aws_connection_info
check_mode : true
register : result
- name : assert state=absent (expected changed=false)
assert:
that:
- 'not result.changed'
- result is not changed
- name : test state=absent (expected changed=false)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
state : absent
<< : *aws_connection_info
register : result
- name : assert state=absent (expected changed=false)
assert:
that:
- 'not result.changed'
- result is not changed
# ============================================================
- name : create subnet without AZ (CHECK MODE)
@ -347,27 +325,25 @@
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
state : present
<< : *aws_connection_info
check_mode : true
register : subnet_without_az
- name : check that subnet without AZ works fine
assert:
that:
- 'subnet_without_az.changed'
- subnet_without_az is changed
- name : create subnet without AZ
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
state : present
<< : *aws_connection_info
register : subnet_without_az
- name : check that subnet without AZ works fine
assert:
that:
- 'subnet_without_az.changed'
- subnet_without_az is changed
# ============================================================
- name : remove subnet without AZ (CHECK MODE)
@ -375,51 +351,51 @@
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
state : absent
<< : *aws_connection_info
check_mode : true
register : result
- name : assert state=absent (expected changed=true)
assert:
that:
- 'result.changed'
- result is changed
- name : remove subnet without AZ
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
state : absent
<< : *aws_connection_info
register : result
- name : assert state=absent (expected changed=true)
assert:
that:
- 'result.changed'
- result is changed
# ============================================================
# FIXME - Replace by creating IPv6 enabled VPC once ec2_vpc_net module supports it.
# See Also https://github.com/ansible/ansible/pull/60983
- name:
set_fact:
aws_connection_env:
AWS_ACCESS_KEY_ID : "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY : "{{ aws_secret_key }}"
AWS_SESSION_TOKEN : "{{ security_token | default(omit) }}"
AWS_DEFAULT_REGION : "{{ aws_region }}"
no_log : yes
- name : install aws cli - FIXME temporary this should go for a lighterweight solution
command : pip install awscli
- name : Assign an Amazon provided IPv6 CIDR block to the VPC
command : aws ec2 associate-vpc-cidr-block --amazon-provided-ipv6-cidr-block --vpc-id '{{ vpc_result.vpc.id }}'
environment:
AWS_ACCESS_KEY_ID : '{{aws_access_key}}'
AWS_SECRET_ACCESS_KEY : '{{aws_secret_key}}'
AWS_SESSION_TOKEN : '{{security_token}}'
AWS_DEFAULT_REGION : '{{aws_region}}'
environment : '{{ aws_connection_env }}'
- name : wait for the IPv6 CIDR to be assigned
command : sleep 5
- name : Get the assigned IPv6 CIDR
command : aws ec2 describe-vpcs --vpc-ids '{{ vpc_result.vpc.id }}'
environment:
AWS_ACCESS_KEY_ID : '{{aws_access_key}}'
AWS_SECRET_ACCESS_KEY : '{{aws_secret_key}}'
AWS_SESSION_TOKEN : '{{security_token}}'
AWS_DEFAULT_REGION : '{{aws_region}}'
environment : '{{ aws_connection_env }}'
register : vpc_ipv6
- set_fact:
@ -433,7 +409,6 @@
ipv6_cidr : "{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}"
assign_instances_ipv6 : true
state : present
<< : *aws_connection_info
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
@ -443,7 +418,7 @@
- name : assert creation with IPv6 happened (expected changed=true)
assert:
that:
- 'vpc_subnet_ipv6_create.changed'
- vpc_subnet_ipv6_create is changed
- name : create subnet with IPv6 (expected changed=true)
ec2_vpc_subnet:
@ -452,7 +427,6 @@
ipv6_cidr : "{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}"
assign_instances_ipv6 : true
state : present
<< : *aws_connection_info
tags:
Name : '{{ec2_vpc_subnet_name}}'
Description : '{{ec2_vpc_subnet_description}}'
@ -461,7 +435,7 @@
- name : assert creation with IPv6 happened (expected changed=true)
assert:
that:
- 'vpc_subnet_ipv6_create'
- vpc_subnet_ipv6_create is changed
- 'vpc_subnet_ipv6_create.subnet.id.startswith("subnet-")'
- "vpc_subnet_ipv6_create.subnet.ipv6_cidr_block == '{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}'"
- '"Name" in vpc_subnet_ipv6_create.subnet.tags and vpc_subnet_ipv6_create.subnet.tags["Name"] == ec2_vpc_subnet_name'
@ -475,7 +449,6 @@
vpc_id : "{{ vpc_result.vpc.id }}"
ipv6_cidr : "{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}"
assign_instances_ipv6 : true
<< : *aws_connection_info
state : present
tags:
Name : '{{ec2_vpc_subnet_name}}'
@ -486,7 +459,7 @@
- name : assert recreation changed nothing (expected changed=false)
assert:
that:
- 'not vpc_subnet_ipv6_recreate.changed'
- vpc_subnet_ipv6_recreate is not changed
- name : recreate subnet (expected changed=false)
ec2_vpc_subnet:
@ -494,7 +467,6 @@
vpc_id : "{{ vpc_result.vpc.id }}"
ipv6_cidr : "{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}"
assign_instances_ipv6 : true
<< : *aws_connection_info
state : present
tags:
Name : '{{ec2_vpc_subnet_name}}'
@ -504,7 +476,7 @@
- name : assert recreation changed nothing (expected changed=false)
assert:
that:
- 'not vpc_subnet_ipv6_recreate.changed'
- vpc_subnet_ipv6_recreate is not changed
- 'vpc_subnet_ipv6_recreate.subnet == vpc_subnet_ipv6_create.subnet'
# ============================================================
@ -514,7 +486,6 @@
vpc_id : "{{ vpc_result.vpc.id }}"
ipv6_cidr : "{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}"
assign_instances_ipv6 : false
<< : *aws_connection_info
state : present
purge_tags : false
check_mode : true
@ -523,7 +494,7 @@
- name : assert assign_instances_ipv6 attribute changed (expected changed=true)
assert:
that:
- 'vpc_change_attribute.changed'
- vpc_change_attribute is changed
- name : change subnet ipv6 attribute (expected changed=true)
ec2_vpc_subnet:
@ -531,7 +502,6 @@
vpc_id : "{{ vpc_result.vpc.id }}"
ipv6_cidr : "{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}"
assign_instances_ipv6 : false
<< : *aws_connection_info
state : present
purge_tags : false
register : vpc_change_attribute
@ -539,7 +509,7 @@
- name : assert assign_instances_ipv6 attribute changed (expected changed=true)
assert:
that:
- 'vpc_change_attribute.changed'
- vpc_change_attribute is changed
- 'not vpc_change_attribute.subnet.assign_ipv6_address_on_creation'
# ============================================================
@ -548,7 +518,6 @@
cidr : "10.232.232.144/28"
vpc_id : "{{ vpc_result.vpc.id }}"
ipv6_cidr : "{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}"
<< : *aws_connection_info
state : present
purge_tags : false
register : vpc_add_duplicate_ipv6
@ -557,7 +526,7 @@
- name : assert graceful failure (expected failed)
assert:
that:
- 'vpc_add_duplicate_ipv6.failed'
- vpc_add_duplicate_ipv6 is failed
- "'The IPv6 CIDR \\'{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}\\' conflicts with another subnet' in vpc_add_duplicate_ipv6.msg"
# ============================================================
@ -565,7 +534,6 @@
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
<< : *aws_connection_info
state : present
purge_tags : false
check_mode : true
@ -574,13 +542,12 @@
- name : assert subnet ipv6 cidr removed (expected changed=true)
assert:
that:
- 'vpc_remove_ipv6_cidr.changed'
- vpc_remove_ipv6_cidr is changed
- name : remove subnet ipv6 cidr (expected changed=true)
ec2_vpc_subnet:
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
<< : *aws_connection_info
state : present
purge_tags : false
register : vpc_remove_ipv6_cidr
@ -588,7 +555,7 @@
- name : assert subnet ipv6 cidr removed (expected changed=true)
assert:
that:
- 'vpc_remove_ipv6_cidr.changed'
- vpc_remove_ipv6_cidr is changed
- "vpc_remove_ipv6_cidr.subnet.ipv6_cidr_block == ''"
- 'not vpc_remove_ipv6_cidr.subnet.assign_ipv6_address_on_creation'
@ -601,14 +568,13 @@
purge_tags : false
tags:
looks_like_boolean : true
<< : *aws_connection_info
check_mode : true
register : vpc_subnet_info
- name : assert a tag was added
assert:
that:
- 'vpc_subnet_info.changed'
- vpc_subnet_info is changed
- name : test adding a tag that looks like a boolean to the subnet
ec2_vpc_subnet:
@ -618,13 +584,12 @@
purge_tags : false
tags:
looks_like_boolean : true
<< : *aws_connection_info
register : vpc_subnet_info
- name : assert a tag was added
assert:
that:
- 'vpc_subnet_info.changed'
- vpc_subnet_info is changed
- 'vpc_subnet_info.subnet.tags.looks_like_boolean == "True"'
# ============================================================
@ -636,14 +601,13 @@
purge_tags : false
tags:
looks_like_boolean : true
<< : *aws_connection_info
check_mode : true
register : vpc_subnet_info
- name : assert a tag was add ed
- name : assert tags haven't chang ed
assert:
that:
- 'not vpc_subnet_info.changed'
- vpc_subnet_info is not changed
- name : test idempotence adding a tag that looks like a boolean
ec2_vpc_subnet:
@ -653,13 +617,12 @@
purge_tags : false
tags:
looks_like_boolean : true
<< : *aws_connection_info
register : vpc_subnet_info
- name : assert a tag was add ed
- name : assert tags haven't chang ed
assert:
that:
- 'not vpc_subnet_info.changed'
- vpc_subnet_info is not changed
always:
@ -672,11 +635,9 @@
cidr : "10.232.232.128/28"
vpc_id : "{{ vpc_result.vpc.id }}"
state : absent
<< : *aws_connection_info
- name : tidy up VPC
ec2_vpc_net:
name : "{{ resource_prefix }}-vpc"
state : absent
cidr_block : "10.232.232.128/26"
<< : *aws_connection_info