Skip to content

Commit 8f718d5

Browse files
markgoddardmarkgoddard
authored
Merge pull request #7 from stackhpc/networks
Add os_networks role
2 parents 1419963 + 62fc8bc commit 8f718d5

File tree

8 files changed

+490
-0
lines changed

8 files changed

+490
-0
lines changed

‎roles/os_networks/README.md‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
OpenStack Networks
2+
==================
3+
4+
This role can be used to register networks, subnets and routers in neutron
5+
using the `openstack.cloud.network`, `openstack.cloud.subnet` and
6+
`openstack.cloud.router` modules.
7+
8+
Requirements
9+
------------
10+
11+
The OpenStack neutron API should be accessible from the target host.
12+
13+
Role Variables
14+
--------------
15+
16+
`os_networks_venv` is a path to a directory in which to create a virtualenv.
17+
18+
`os_networks_auth_type` is an authentication type compatible with the
19+
`auth_type` argument of `openstack.cloud` Ansible modules.
20+
21+
`os_networks_auth` is a dict containing authentication information
22+
compatible with the `auth` argument of `openstack.cloud` Ansible modules.
23+
24+
`os_networks_cacert` is an optional path to a CA certificate bundle.
25+
26+
`os_networks_cloud` is an optional name of a cloud in `clouds.yaml`.
27+
28+
`os_networks_interface` is the endpoint URL type to fetch from the service
29+
catalog. Maybe be one of `public`, `admin`, or `internal`.
30+
31+
`os_networks` is a list of networks to register. Each item should be a
32+
dict containing the following items:
33+
34+
- `name`: Name of the neutron network.
35+
- `provider_network_type`: Provider type of the neutron network.
36+
- `provider_physical_network`: Provider physical network of the neutron
37+
network.
38+
- `provider_segmentation_id`: Provider segmentation ID of the neutron network.
39+
- `shared`: Whether the neutron network is shared.
40+
- `external`: Whether the neutron network is external.
41+
- `project`: Optionally create this network for a project other than the
42+
authenticating project.
43+
- `state`: Optional state of the network, default is `present`.
44+
- `mtu`: The maximum transmission unit (MTU) value to address fragmentation.
45+
Network will use OpenStack defaults if this option is not provided.
46+
Requires ansible >= 2.9.
47+
- `port_security_enabled`: Whether port security is enabled on the network
48+
or not. Network will use OpenStack defaults if this option is not utilised.
49+
Boolean, true to enable, false otherwise. Requires ansible >= 2.8.
50+
- `dns_domain`: The DNS domain value to set. Network will use Openstack
51+
defaults if this option is not provided. Requires ansible >= 2.9.
52+
- `subnets`: A list of subnets to create in this network. Each item should
53+
be a dict containing the following items:
54+
- `name`: Name of the neutron subnet.
55+
- `cidr`: CIDR representation of the neutron subnet's IP network.
56+
- `dns_nameservers`: A list of DNS nameservers for the subnet.
57+
- `extra_specs`: Optional Dictionary with extra key/value pairs
58+
passed to the API. Requires ansible >= 2.7.
59+
- `gateway_ip`: IP address of the neutron subnet's gateway.
60+
- `no_gateway_ip`: Optional boolean, whether to omit a gateway IP. If unset,
61+
this will be `true` if `gateway_ip` is specified, and `false` otherwise.
62+
- `enable_dhcp`: Whether to enable DHCP on the subnet.
63+
- `allocation_pool_start`: Start of the neutron subnet's IP allocation
64+
pool.
65+
- `allocation_pool_end`: End of the neutron subnet's IP allocation pool.
66+
- `host_routes`: A list of classless static routes to supply to hosts
67+
connected to this subnet. A list of dicts of `destination`
68+
(destination network in CIDR encoding) and `nexthop`
69+
(router IP on this subnet) must be supplied.
70+
- `ip_version`: Optional IP version for the subnet.
71+
- `ipv6_address_mode`: Optional IPv6 address mode for the subnet.
72+
- `ipv6_ra_mode`: Optional IPv6 router advertisement mode for the subnet.
73+
- `use_default_subnetpool`: Optional boolean, whether to use the default
74+
subnet pool for the IP version.
75+
- `project`: Optionally create this subnet for a project other than the
76+
authenticating project.
77+
- `state`: Optional state of the subnet, default is `present`.
78+
79+
`os_networks_routers` is a list of routers to create. Each item should be a
80+
dict containing the following items:
81+
82+
- `name`: Name of the neutron router.
83+
- `interfaces`: List of names of subnets to attach to the router
84+
internal interface.
85+
- `network`: Unique name or ID of the external gateway network.
86+
- `external_fixed_ips`: Optional list of IP address parameters for the
87+
external gateway network. Each is a dictionary with the subnet name or
88+
subnet ID and the IP address to assign on the subnet.
89+
- `project`: Optionally create this router for a project other than the
90+
authenticating project.
91+
- `state`: Optional state of the router, default is `present`.
92+
93+
94+
`os_networks_security_groups`: List of security groups to create.
95+
Each item should be a dict containing the following items:
96+
- `name`: Name of the security group.
97+
- `description`: Optional description of the security group.
98+
- `project`: Optional project in which to register the security group.
99+
- `state`: Optional state of the security group, default is `present`.
100+
- `rules`: Optional list of rules to add to the security group. Each item
101+
should be a dict containing the following items:
102+
- `direction`: Optional direction of the rule, default is `ingress`.
103+
- `ethertype`: Optional Ethertype of the rule, default is `IPv4`
104+
- `port_range_min`: Optional starting port.
105+
- `port_range_max`: Optional ending port.
106+
- `protocol`: Optional IP protocol of the rule.
107+
- `remote_group`: Optional name or ID of the security group to link.
108+
- `remote_ip_prefix`: Optional source IP address prefix in CIDR notation.
109+
- `state`: Optional state of the rule, default is `present`.
110+
111+
`os_networks_rbac` is a list of role-based access control
112+
shares for named networks and projects. See the [Neutron RBAC admin
113+
guide](https://docs.openstack.org/neutron/latest/admin/config-rbac.html#sharing-a-network-with-specific-projects)
114+
for details. Each entry in the list is a dictionary containing the
115+
following items:
116+
117+
- `network`: The name of the network to share. This network is normally
118+
owned by the `admin` project and not `shared` or `external`.
119+
- `access`: The mode of sharing with the target project(s). Valid options
120+
are `access_as_external` and `access_as_shared`
121+
- `projects`: A list of project names for sharing the named network
122+
in the designated way.
123+
124+
*NOTE*: RBAC assignments cannot be modified after they are created.
125+
126+
Dependencies
127+
------------
128+
129+
This role depends on the `stackhpc.openstack.os_openstacksdk` role.
130+
131+
Example Playbook
132+
----------------
133+
134+
The following playbook registers a neutron network, subnet and router.
135+
A classless static route is defined to access another subnet through a
136+
different gateway.
137+
138+
---
139+
- name: Ensure networks, subnets and routers are registered
140+
hosts: localhost
141+
roles:
142+
- role: stackhpc.openstack.os_networks
143+
os_networks_venv: "~/os-networks-venv"
144+
os_networks_auth_type: "password"
145+
os_networks_auth:
146+
project_name: <keystone project>
147+
username: <keystone user>
148+
password: <keystone password>
149+
auth_url: <keystone auth URL>
150+
os_networks:
151+
- name: net1
152+
provider_network_type: vlan
153+
provider_physical_network: physnet1
154+
provider_segmentation_id: 1234
155+
shared: true
156+
external: false
157+
subnets:
158+
- name: subnet1
159+
cidr: 10.0.0.0/24
160+
gateway_ip: 10.0.0.1
161+
allocation_pool_start: 10.0.0.2
162+
allocation_pool_end: 10.0.0.254
163+
host_routes:
164+
- destination: 10.0.1.0/24
165+
nexthop: 10.0.0.254
166+
os_networks_routers:
167+
- name: router1
168+
interfaces:
169+
- subnet1
170+
network: net1
171+
os_networks_security_groups:
172+
- name: secgroup1
173+
rules:
174+
- protocol: icmp
175+
176+
Author Information
177+
------------------
178+
179+
- Mark Goddard (<[email protected]>)

‎roles/os_networks/defaults/main.yml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
---
2+
# Path to virtualenv in which to install openstacksdk and its dependencies.
3+
os_networks_venv:
4+
5+
# Authentication type compatible with the 'os_network' Ansible module's
6+
# auth_type argument.
7+
os_networks_auth_type:
8+
9+
# Authentication parameters compatible with the 'os_network' Ansible module's
10+
# auth argument.
11+
os_networks_auth: {}
12+
13+
# Endpoint URL type to fetch from the service catalog. Maybe be one of:
14+
# public, admin, or internal.
15+
os_networks_interface:
16+
17+
# List of networks to create. Each item should be a dict containing the
18+
# following items:
19+
# - 'name': Name of the neutron network.
20+
# - 'provider_network_type': Provider type of the neutron network.
21+
# - 'provider_physical_network': Provider physical network of the neutron network.
22+
# - 'provider_segmentation_id': Provider segmentation ID of the neutron network.
23+
# - 'shared': Whether the neutron network is shared.
24+
# - 'external': Whether the neutron network is external.
25+
# - 'project': Optional project in which to register the network.
26+
# - 'state': Optional state of the network, default is 'present'.
27+
# - 'mtu': The maximum transmission unit (MTU) value to address fragmentation.
28+
# Network will use OpenStack defaults if this option is not provided.
29+
# Requires ansible >= 2.9.
30+
# - 'port_security_enabled': Whether port security is enabled on the network
31+
# or not. Network will use OpenStack defaults if this option is not utilised.
32+
# Boolean, true to enable, false otherwise. Requires ansible >= 2.8.
33+
# - 'dns_domain': The DNS domain value to set. Network will use Openstack
34+
# defaults if this option is not provided. Requires ansible >= 2.9.
35+
# - 'subnets': A list of subnets to create in this network. Each item should
36+
# be a dict containing the following items:
37+
# - 'name: Name of the neutron subnet.
38+
# - 'cidr': CIDR representation of the neutron subnet's IP network.
39+
# - 'dns_nameservers': A list of DNS nameservers for the subnet.
40+
# - 'extra_specs': Optional Dictionary with extra key/value pairs
41+
# passed to the API.
42+
# - 'gateway_ip': IP address of the neutron subnet's gateway.
43+
# - 'no_gateway_ip': Optional boolean, whether to omit a gateway IP. If
44+
# unset, this will be `true` if `gateway_ip` is specified, and `false`
45+
# otherwise.
46+
# - 'allocation_pool_start': Start of the neutron subnet's IP allocation
47+
# pool.
48+
# - 'allocation_pool_end': End of the neutron subnet's IP allocation pool.
49+
# - 'host_routes': list of dicts of destination and nexthop for classless
50+
# static routes to supply to hosts connected to this subnet.
51+
# - 'ip_version': Optional IP version for the subnet.
52+
# - 'ipv6_address_mode': Optional IPv6 address mode for the subnet.
53+
# - 'ipv6_ra_mode': Optional IPv6 router advertisement mode for the subnet.
54+
# - 'use_default_subnetpool': Optional boolean, whether to use the default
55+
# subnet pool.
56+
# - 'project': Optional project in which to register the subnet.
57+
# - 'state': Optional state of the subnet, default is 'present'.
58+
os_networks: [] # noqa var-naming[no-role-prefix]
59+
60+
# List of routers to create. Each item should be a dict containing the
61+
# following items:
62+
# - 'name': Name of the neutron router.
63+
# - 'interfaces': List of names of subnets to attach to the router
64+
# internal interface.
65+
# - 'network': Unique name or ID of the external gateway network.
66+
# - `external_fixed_ips`: Optional list of IP address parameters for the
67+
# external gateway network. Each is a dictionary with the subnet name or
68+
# subnet ID and the IP address to assign on the subnet.
69+
# - 'project': Optional project in which to register the router.
70+
# - 'state': Optional state of the router, default is 'present'.
71+
os_networks_routers: []
72+
73+
# List of security groups to create. Each item should be a dict containing the
74+
# following items:
75+
# - 'name': Name of the security group.
76+
# - 'description': Optional description of the security group.
77+
# - 'state': Optional state of the security group, default is 'present'.
78+
# - 'project': Optional project in which to register the security group.
79+
# - 'rules': Optional list of rules to add to the security group. Each item
80+
# should be a dict containing the following items:
81+
# - 'direction': Optional direction of the rule, default is 'ingress'.
82+
# - 'ethertype': Optional Ethertype of the rule, default is 'IPv4'
83+
# - 'port_range_min': Optional starting port.
84+
# - 'port_range_max': Optional ending port.
85+
# - 'protocol': Optional IP protocol of the rule.
86+
# - 'remote_group': Optional name or ID of the security group to link.
87+
# - 'remote_ip_prefix': Optional source IP address prefix in CIDR notation.
88+
# - 'state': Optional state of the rule, default is 'present'.
89+
os_networks_security_groups: []
90+
91+
# Role-Based Access Control (RBAC)
92+
# List of role-based access control shares for named networks and projects.
93+
# See https://docs.openstack.org/neutron/latest/admin/config-rbac.html
94+
# for details. Each entry in the list is a dictionary containing the
95+
# following items:
96+
# - `network`: The name of the network to share. This network is normally
97+
# owned by the `admin` project and not `shared` or `external`.
98+
# - `access`: The mode of sharing with the target project(s). Valid options
99+
# are `access_as_external` and `access_as_shared`
100+
# - `projects`: A list of project names for sharing the named network
101+
# in the designated way.
102+
os_networks_rbac: []
103+
104+
# Upper constraints file for installation of Python dependencies.
105+
os_networks_upper_constraints_file: https://releases.openstack.org/constraints/upper/2023.1

‎roles/os_networks/meta/main.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
dependencies:
3+
- role: stackhpc.openstack.os_openstacksdk
4+
os_openstacksdk_venv: "{{ os_networks_venv }}"
5+
os_openstacksdk_upper_constraints_file: "{{ os_networks_upper_constraints_file | default(None) }}"

‎roles/os_networks/tasks/main.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
- name: Import networks.yml
3+
ansible.builtin.import_tasks: networks.yml
4+
vars:
5+
ansible_python_interpreter: "{{ os_networks_venv }}/bin/python"
6+
environment:
7+
OS_IDENTITY_API_VERSION: "3"

0 commit comments

Comments
 (0)