mirror of https://github.com/ansible/ansible.git
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
540 lines
16 KiB
YAML
540 lines
16 KiB
YAML
---
|
|
- name: setup vpc
|
|
cs_vpc:
|
|
name: "{{ cs_resource_prefix }}_vpc"
|
|
display_text: "{{ cs_resource_prefix }}_display_text"
|
|
cidr: 10.10.0.0/16
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: vpc
|
|
- name: verify setup vpc
|
|
assert:
|
|
that:
|
|
- vpc is successful
|
|
|
|
- name: setup network acl
|
|
cs_network_acl:
|
|
name: "{{ cs_resource_prefix }}_acl"
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: acl
|
|
- name: verify setup network acl
|
|
assert:
|
|
that:
|
|
- acl is successful
|
|
|
|
- name: setup network acl rule
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
state: absent
|
|
register: acl_rule
|
|
- name: verify setup network acl rule
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
|
|
- name: test fail missing params
|
|
cs_network_acl_rule:
|
|
ignore_errors: true
|
|
register: acl_rule
|
|
- name: verify test fail missing param
|
|
assert:
|
|
that:
|
|
- acl_rule is failed
|
|
- "acl_rule.msg.startswith('missing required arguments: ')"
|
|
|
|
- name: test fail missing params for tcp
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: ingress
|
|
action_policy: allow
|
|
cidr: 0.0.0.0/0
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
ignore_errors: true
|
|
register: acl_rule
|
|
- name: verify test fail missing param for tcp
|
|
assert:
|
|
that:
|
|
- acl_rule is failed
|
|
- "acl_rule.msg == 'protocol is tcp but the following are missing: start_port, end_port'"
|
|
|
|
- name: test fail missing params for icmp
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: ingress
|
|
action_policy: allow
|
|
cidr: 0.0.0.0/0
|
|
protocol: icmp
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
ignore_errors: true
|
|
register: acl_rule
|
|
- name: verify test fail missing param for icmp
|
|
assert:
|
|
that:
|
|
- acl_rule is failed
|
|
- "acl_rule.msg == 'protocol is icmp but the following are missing: icmp_type, icmp_code'"
|
|
|
|
- name: test fail missing params for by number
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: ingress
|
|
action_policy: allow
|
|
cidr: 0.0.0.0/0
|
|
protocol: by_number
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
ignore_errors: true
|
|
register: acl_rule
|
|
- name: verify test fail missing param for by number
|
|
assert:
|
|
that:
|
|
- acl_rule is failed
|
|
- "acl_rule.msg == 'protocol is by_number but the following are missing: protocol_number'"
|
|
|
|
- name: test create network acl rule in check mode
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: ingress
|
|
action_policy: allow
|
|
port: 80
|
|
cidr: 0.0.0.0/0
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: acl_rule
|
|
check_mode: true
|
|
- name: verify test create network acl rule in check mode
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
|
|
- name: test create network acl rule
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: ingress
|
|
action_policy: allow
|
|
port: 80
|
|
cidr: 0.0.0.0/0
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: acl_rule
|
|
- name: verify test create network acl rule
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.start_port == 80
|
|
- acl_rule.end_port == 80
|
|
- acl_rule.action_policy == "allow"
|
|
- acl_rule.cidr == "0.0.0.0/0"
|
|
- acl_rule.traffic_type == "ingress"
|
|
- acl_rule.rule_position == 1
|
|
|
|
- name: test create network acl rule idempotence
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: ingress
|
|
action_policy: allow
|
|
port: 80
|
|
cidr: 0.0.0.0/0
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: acl_rule
|
|
- name: verify test create network acl idempotence
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is not changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.start_port == 80
|
|
- acl_rule.end_port == 80
|
|
- acl_rule.action_policy == "allow"
|
|
- acl_rule.cidr == "0.0.0.0/0"
|
|
- acl_rule.traffic_type == "ingress"
|
|
- acl_rule.rule_position == 1
|
|
|
|
- name: test change network acl rule in check mode
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: deny
|
|
port: 81
|
|
cidr: 0.0.0.0/0
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: acl_rule
|
|
check_mode: true
|
|
- name: verify test change network acl rule in check mode
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.start_port == 80
|
|
- acl_rule.end_port == 80
|
|
- acl_rule.action_policy == "allow"
|
|
- acl_rule.cidr == "0.0.0.0/0"
|
|
- acl_rule.traffic_type == "ingress"
|
|
- acl_rule.rule_position == 1
|
|
|
|
- name: test change network acl rule
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: deny
|
|
port: 81
|
|
protocol: udp
|
|
cidr: 0.0.0.0/0
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: acl_rule
|
|
- name: verify test change network acl rule
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.start_port == 81
|
|
- acl_rule.end_port == 81
|
|
- acl_rule.action_policy == "deny"
|
|
- acl_rule.cidr == "0.0.0.0/0"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.protocol == "udp"
|
|
- acl_rule.rule_position == 1
|
|
|
|
- name: test change network acl rule idempotence
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: deny
|
|
port: 81
|
|
protocol: udp
|
|
cidr: 0.0.0.0/0
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: acl_rule
|
|
- name: verify test change network acl idempotence
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is not changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.start_port == 81
|
|
- acl_rule.end_port == 81
|
|
- acl_rule.action_policy == "deny"
|
|
- acl_rule.cidr == "0.0.0.0/0"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.protocol == "udp"
|
|
- acl_rule.rule_position == 1
|
|
|
|
- name: test change network acl by protocol number in check mode
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: deny
|
|
protocol: by_number
|
|
protocol_number: 8
|
|
port: 81
|
|
cidr: 0.0.0.0/0
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: acl_rule
|
|
check_mode: true
|
|
- name: verify test change network acl by protocol number in check mode
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.start_port == 81
|
|
- acl_rule.end_port == 81
|
|
- acl_rule.action_policy == "deny"
|
|
- acl_rule.cidr == "0.0.0.0/0"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.protocol == "udp"
|
|
- acl_rule.rule_position == 1
|
|
|
|
- name: test change network acl by protocol number
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: deny
|
|
protocol: by_number
|
|
protocol_number: 8
|
|
port: 81
|
|
cidr: 0.0.0.0/0
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: acl_rule
|
|
- name: verify test change network acl by protocol number
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.start_port == 81
|
|
- acl_rule.end_port == 81
|
|
- acl_rule.action_policy == "deny"
|
|
- acl_rule.cidr == "0.0.0.0/0"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.protocol == "by_number"
|
|
- acl_rule.protocol_number == 8
|
|
- acl_rule.rule_position == 1
|
|
|
|
- name: test change network acl by protocol number idempotence
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: deny
|
|
protocol: by_number
|
|
protocol_number: 8
|
|
port: 81
|
|
cidr: 0.0.0.0/0
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
register: acl_rule
|
|
- name: verify test change network acl by protocol number idempotence
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is not changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.start_port == 81
|
|
- acl_rule.end_port == 81
|
|
- acl_rule.action_policy == "deny"
|
|
- acl_rule.cidr == "0.0.0.0/0"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.protocol == "by_number"
|
|
- acl_rule.protocol_number == 8
|
|
- acl_rule.rule_position == 1
|
|
|
|
|
|
- name: test create 2nd network acl rule in check mode
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 2
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: allow
|
|
cidr: 10.23.12.0/24
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
protocol: all
|
|
register: acl_rule
|
|
check_mode: true
|
|
- name: verify test create 2nd network acl rule in check mode
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
|
|
- name: test create 2nd network acl rule
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 2
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: allow
|
|
cidr: 10.23.12.0/24
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
protocol: all
|
|
register: acl_rule
|
|
- name: verify test create 2nd network acl rule
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.action_policy == "allow"
|
|
- acl_rule.cidr == "10.23.12.0/24"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.protocol == "all"
|
|
- acl_rule.rule_position == 2
|
|
|
|
- name: test create 2nd network acl rule idempotence
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 2
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: allow
|
|
cidr: 10.23.12.0/24
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
protocol: all
|
|
register: acl_rule
|
|
- name: verify test create 2nd network acl rule idempotence
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is not changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.action_policy == "allow"
|
|
- acl_rule.cidr == "10.23.12.0/24"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.protocol == "all"
|
|
- acl_rule.rule_position == 2
|
|
|
|
- name: test update 2nd network acl rule to icmp
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 2
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: allow
|
|
cidr: 10.23.12.0/24
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
protocol: icmp
|
|
icmp_type: 0
|
|
icmp_code: 8
|
|
register: acl_rule
|
|
- name: verify test create 2nd network acl rule
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.action_policy == "allow"
|
|
- acl_rule.cidr == "10.23.12.0/24"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.protocol == "icmp"
|
|
- acl_rule.icmp_type == 0
|
|
- acl_rule.icmp_code == 8
|
|
- acl_rule.rule_position == 2
|
|
|
|
- name: test update 2nd network acl rule to icmp idempotence
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 2
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
traffic_type: egress
|
|
action_policy: allow
|
|
cidr: 10.23.12.0/24
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
protocol: icmp
|
|
icmp_type: 0
|
|
icmp_code: 8
|
|
register: acl_rule
|
|
- name: verify test create 2nd network acl rule idempotence
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is not changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.action_policy == "allow"
|
|
- acl_rule.cidr == "10.23.12.0/24"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.protocol == "icmp"
|
|
- acl_rule.icmp_type == 0
|
|
- acl_rule.icmp_code == 8
|
|
- acl_rule.rule_position == 2
|
|
|
|
- name: test absent network acl rule in check mode
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
state: absent
|
|
register: acl_rule
|
|
check_mode: true
|
|
- name: verify test absent network acl rule in check mode
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.start_port == 81
|
|
- acl_rule.end_port == 81
|
|
- acl_rule.action_policy == "deny"
|
|
- acl_rule.cidr == "0.0.0.0/0"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.rule_position == 1
|
|
|
|
- name: test absent network acl rule
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
state: absent
|
|
register: acl_rule
|
|
- name: verify test absent network acl rule
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.start_port == 81
|
|
- acl_rule.end_port == 81
|
|
- acl_rule.action_policy == "deny"
|
|
- acl_rule.cidr == "0.0.0.0/0"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.rule_position == 1
|
|
|
|
- name: test absent network acl rule idempotence
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 1
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
state: absent
|
|
register: acl_rule
|
|
- name: verify test absent network acl rule idempotence
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is not changed
|
|
|
|
- name: test absent 2nd network acl rule
|
|
cs_network_acl_rule:
|
|
network_acl: "{{ cs_resource_prefix }}_acl"
|
|
rule_position: 2
|
|
vpc: "{{ cs_resource_prefix }}_vpc"
|
|
zone: "{{ cs_common_zone_adv }}"
|
|
state: absent
|
|
register: acl_rule
|
|
- name: verify test absent 2nd network acl rule
|
|
assert:
|
|
that:
|
|
- acl_rule is successful
|
|
- acl_rule is changed
|
|
- acl_rule.vpc == "{{ cs_resource_prefix }}_vpc"
|
|
- acl_rule.network_acl == "{{ cs_resource_prefix }}_acl"
|
|
- acl_rule.action_policy == "allow"
|
|
- acl_rule.cidr == "10.23.12.0/24"
|
|
- acl_rule.traffic_type == "egress"
|
|
- acl_rule.protocol == "icmp"
|
|
- acl_rule.icmp_type == 0
|
|
- acl_rule.icmp_code == 8
|
|
- acl_rule.rule_position == 2
|