Bug fixes for gcp_compute_firewall (#42807)

lib/ansible/modules/cloud/google/gcp_compute_firewall.py

@@ -88,11 +88,10 @@ options:
         required: false
     network:
         description:
-            - 'URL of the network resource for this firewall rule. If not
+            - 'URL of the network resource for this firewall rule. If not specified when creating
-              specified when creating a firewall rule, the default network is
+              a firewall rule, the default network is used: global/networks/default If you choose to
-              used: global/networks/default If you choose to specify this
+              specify this property, you can specify the network as a full or partial URL. For
-              property, you can specify the network as a full or partial URL.
+              example, the following are all valid URLs:
-              For example, the following are all valid URLs:
               U(https://www.googleapis.com/compute/v1/projects/myproject/global/)
               networks/my-network projects/myproject/global/networks/my-network
               global/networks/default .'
@@ -130,21 +129,19 @@ extends_documentation_fragment: gcp
 EXAMPLES = '''
 - name: create a firewall
   gcp_compute_firewall:
-      name: testObject
+      name: "test_object"
       allowed:
-        - ip_protocol: 'tcp'
+      - ip_protocol: tcp
         ports:
-            - "22"
+        - '22'
       target_tags:
       - test-ssh-server
       - staging-ssh-server
       source_tags:
       - test-ssh-clients
-      project: testProject
+      project: "test_project"
-      auth_kind: service_account
+      auth_kind: "service_account"
-      service_account_file: /tmp/auth.pem
+      service_account_file: "/tmp/auth.pem"
-      scopes:
-        - https://www.googleapis.com/auth/compute
       state: present
 '''
 
@@ -199,11 +196,10 @@ RETURN = '''
         type: str
     network:
         description:
-            - 'URL of the network resource for this firewall rule. If not
+            - 'URL of the network resource for this firewall rule. If not specified when creating
-              specified when creating a firewall rule, the default network is
+              a firewall rule, the default network is used: global/networks/default If you choose to
-              used: global/networks/default If you choose to specify this
+              specify this property, you can specify the network as a full or partial URL. For
-              property, you can specify the network as a full or partial URL.
+              example, the following are all valid URLs:
-              For example, the following are all valid URLs:
               U(https://www.googleapis.com/compute/v1/projects/myproject/global/)
               networks/my-network projects/myproject/global/networks/my-network
               global/networks/default .'
@@ -273,6 +269,9 @@ def main():
         )
     )
 
+    if not module.params['scopes']:
+        module.params['scopes'] = ['https://www.googleapis.com/auth/compute']
+
     state = module.params['state']
     kind = 'compute#firewall'
 
@@ -416,7 +415,7 @@ def async_op_url(module, extra_data=None):
 def wait_for_operation(module, response):
     op_result = return_if_object(module, response, 'compute#operation')
     if op_result is None:
-        return None
+        return {}
     status = navigate_hash(op_result, ['status'])
     wait_done = wait_for_completion(status, op_result, module)
     return fetch_resource(module, navigate_hash(wait_done, ['targetLink']), 'compute#firewall')

test/integration/targets/gcp_compute_firewall/tasks/main.yml

@@ -17,9 +17,9 @@
   gcp_compute_firewall:
       name: "{{ resource_name }}"
       allowed:
-        - ip_protocol: 'tcp'
+      - ip_protocol: tcp
         ports:
-            - "22"
+        - '22'
       target_tags:
       - test-ssh-server
       - staging-ssh-server
@@ -28,17 +28,15 @@
       project: "{{ gcp_project }}"
       auth_kind: "{{ gcp_cred_kind }}"
       service_account_file: "{{ gcp_cred_file }}"
-      scopes:
-        - https://www.googleapis.com/auth/compute
       state: absent
 #----------------------------------------------------------
 - name: create a firewall
   gcp_compute_firewall:
       name: "{{ resource_name }}"
       allowed:
-        - ip_protocol: 'tcp'
+      - ip_protocol: tcp
         ports:
-            - "22"
+        - '22'
       target_tags:
       - test-ssh-server
       - staging-ssh-server
@@ -47,8 +45,6 @@
       project: "{{ gcp_project }}"
       auth_kind: "{{ gcp_cred_kind }}"
       service_account_file: "{{ gcp_cred_file }}"
-      scopes:
-        - https://www.googleapis.com/auth/compute
       state: present
   register: result
 - name: assert changed is true
@@ -57,21 +53,27 @@
       - result.changed == true
       - "result.kind == 'compute#firewall'"
 - name: verify that firewall was created
-  shell: |
+  gcp_compute_firewall_facts:
-    gcloud compute firewall-rules describe  --project="{{ gcp_project}}"  "{{ resource_name }}"
+      filters:
+         - name = {{ resource_name }}
+      project: "{{ gcp_project }}"
+      auth_kind: "{{ gcp_cred_kind }}"
+      service_account_file: "{{ gcp_cred_file }}"
+      scopes:
+        - https://www.googleapis.com/auth/compute
   register: results
 - name: verify that command succeeded
   assert:
     that:
-      - results.rc == 0
+      - results['items'] | length == 1
 # ----------------------------------------------------------------------------
 - name: create a firewall that already exists
   gcp_compute_firewall:
       name: "{{ resource_name }}"
       allowed:
-        - ip_protocol: 'tcp'
+      - ip_protocol: tcp
         ports:
-            - "22"
+        - '22'
       target_tags:
       - test-ssh-server
       - staging-ssh-server
@@ -80,8 +82,6 @@
       project: "{{ gcp_project }}"
       auth_kind: "{{ gcp_cred_kind }}"
       service_account_file: "{{ gcp_cred_file }}"
-      scopes:
-        - https://www.googleapis.com/auth/compute
       state: present
   register: result
 - name: assert changed is false
@@ -94,9 +94,9 @@
   gcp_compute_firewall:
       name: "{{ resource_name }}"
       allowed:
-        - ip_protocol: 'tcp'
+      - ip_protocol: tcp
         ports:
-            - "22"
+        - '22'
       target_tags:
       - test-ssh-server
       - staging-ssh-server
@@ -105,8 +105,6 @@
       project: "{{ gcp_project }}"
       auth_kind: "{{ gcp_cred_kind }}"
       service_account_file: "{{ gcp_cred_file }}"
-      scopes:
-        - https://www.googleapis.com/auth/compute
       state: absent
   register: result
 - name: assert changed is true
@@ -115,23 +113,27 @@
       - result.changed == true
       - result.has_key('kind') == False
 - name: verify that firewall was deleted
-  shell: |
+  gcp_compute_firewall_facts:
-    gcloud compute firewall-rules describe  --project="{{ gcp_project}}"  "{{ resource_name }}"
+      filters:
+         - name = {{ resource_name }}
+      project: "{{ gcp_project }}"
+      auth_kind: "{{ gcp_cred_kind }}"
+      service_account_file: "{{ gcp_cred_file }}"
+      scopes:
+        - https://www.googleapis.com/auth/compute
   register: results
-  failed_when: results.rc == 0
 - name: verify that command succeeded
   assert:
     that:
-      - results.rc == 1
+      - results['items'] | length == 0
-      - "\"'projects/{{ gcp_project }}/global/firewalls/{{ resource_name }}' was not found\" in results.stderr"
 # ----------------------------------------------------------------------------
 - name: delete a firewall that does not exist
   gcp_compute_firewall:
       name: "{{ resource_name }}"
       allowed:
-        - ip_protocol: 'tcp'
+      - ip_protocol: tcp
         ports:
-            - "22"
+        - '22'
       target_tags:
       - test-ssh-server
       - staging-ssh-server
@@ -140,8 +142,6 @@
       project: "{{ gcp_project }}"
       auth_kind: "{{ gcp_cred_kind }}"
       service_account_file: "{{ gcp_cred_file }}"
-      scopes:
-        - https://www.googleapis.com/auth/compute
       state: absent
   register: result
 - name: assert changed is false