inmanta-module-openstack 5.1.1__tar.gz → 5.1.2__tar.gz

{inmanta_module_openstack-5.1.1 → inmanta_module_openstack-5.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 5.1.1
+Version: 5.1.2
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-5.1.1 → inmanta_module_openstack-5.1.2}/inmanta_module_openstack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 5.1.1
+Version: 5.1.2
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-5.1.1 → inmanta_module_openstack-5.1.2}/inmanta_module_openstack.egg-info/SOURCES.txt

@@ -16,7 +16,6 @@ inmanta_plugins/openstack/common/deps.py
 inmanta_plugins/openstack/compute/__init__.py
 inmanta_plugins/openstack/compute/flavor.py
 inmanta_plugins/openstack/compute/host_aggregate.py
-inmanta_plugins/openstack/compute/host_port.py
 inmanta_plugins/openstack/compute/virtual_machine.py
 inmanta_plugins/openstack/identity/__init__.py
 inmanta_plugins/openstack/identity/group.py
@@ -47,10 +46,10 @@ tests/test_dependency_handling.py
 tests/test_examples.py
 tests/test_flavor.py
 tests/test_host_aggregate.py
-tests/test_host_port_fixed_ips.py
-tests/test_host_port_security_groups.py
 tests/test_image.py
 tests/test_keystone.py
+tests/test_network_port_fixed_ips.py
+tests/test_network_port_security_groups.py
 tests/test_neutron.py
 tests/test_nova.py
 tests/test_quota.py

{inmanta_module_openstack-5.1.1 → inmanta_module_openstack-5.1.2}/inmanta_plugins/openstack/common/deps.py

@@ -32,7 +32,7 @@ MANAGED_DEPENDENCIES = {
     "openstack::Router",
     "openstack::Subnet",
     "openstack::VirtualMachine",
-    "openstack::HostPort",
+    "openstack::NetworkPort",
     "openstack::FloatingIP",
     "openstack::SecurityGroup",
 }
@@ -66,15 +66,21 @@ def set_dependencies_on_purged_resources(collector: ResourceCollector) -> None:
     Set the dependencies between purged VMs/ports and the security groups they reference.
     """
     vms = collector.get("openstack::VirtualMachine", {})
-    ports = collector.get("openstack::HostPort", {})
+    ports = collector.get("openstack::NetworkPort", {})
     sgs = collector.get("openstack::SecurityGroup", {})
 
     # When the VM is purged, all its purged ports should be deployed first
     for vm in vms.values():
         for vm_port in vm.ports:
             if vm_port["name"] in ports:
-                port_id = ports[vm_port["name"]].id
-                vm.requires.add(port_id)
+                port = ports[vm_port["name"]]
+                if port.is_trunk_parent:
+                    # The vm boots on (and binds) its trunk parent port, so the vm must be
+                    # torn down before the port. This mirrors the create-time inversion and
+                    # avoids a cycle with the trunk (which is deleted before its parent).
+                    port.requires.add(vm.id)
+                else:
+                    vm.requires.add(port.id)
 
     # When a security group is purged, every port referencing it must be removed (or have the
     # reference dropped) before the group itself can be deleted.
@@ -90,7 +96,7 @@ def set_dependencies_on_non_purged_resources(collector: ResourceCollector) -> No
     routers = collector.get("openstack::Router", {})
     subnets = collector.get("openstack::Subnet", {})
     vms = collector.get("openstack::VirtualMachine", {})
-    ports = collector.get("openstack::HostPort", {})
+    ports = collector.get("openstack::NetworkPort", {})
     fips = collector.get("openstack::FloatingIP", {})
     sgs = collector.get("openstack::SecurityGroup", {})
     router_map = {}
@@ -143,7 +149,14 @@ def set_dependencies_on_non_purged_resources(collector: ResourceCollector) -> No
             port.requires.add(subnets[port.network].id)
 
         if port.host in vms:
-            port.requires.add(vms[port.host].id)
+            if port.is_trunk_parent:
+                # A trunk parent must exist (unbound) before its vm: the trunk is built
+                # on it and the vm then boots on the pre-created port. Ordering the port
+                # after the vm would both bind it too early (neutron rejects a trunk on a
+                # bound port) and cycle with the trunk (vm -> trunk -> parent port).
+                vms[port.host].requires.add(port.id)
+            else:
+                port.requires.add(vms[port.host].id)
 
         for sg_name in port.security_groups:
             if sg_name in sgs:

{inmanta_module_openstack-5.1.1 → inmanta_module_openstack-5.1.2}/inmanta_plugins/openstack/compute/virtual_machine.py

@@ -183,7 +183,9 @@ class VirtualMachineHandler(OpenStackHandler):
     @cache(timeout=10, cache_none=False)
     def _port_id(self, port_name):
         ports = self._connection.network.ports(name=port_name)
-        return self.require_single_item(ports)
+        port = self.require_single_item(ports)
+        # Nova expects the port id (a string) in the boot NIC, not the port object.
+        return port.id if port is not None else None
 
     @cache(timeout=10, cache_none=False)
     def _get_subnet_id(self, subnet_name):
@@ -204,7 +206,7 @@ class VirtualMachineHandler(OpenStackHandler):
                 raise SkipResource(f"Network {port['network']} not found")
             nic = {"uuid": network}
             # A boot NIC carries a single fixed_ip. A dual-stack port boots with its
-            # IPv4 here (preserving its port_index slot); the HostPort handler adds the
+            # IPv4 here (preserving its port_index slot); the NetworkPort handler adds the
             # IPv6 to the same port afterwards via update_port, which keeps the slot.
             if port["address"] is not None:
                 nic["fixed_ip"] = port["address"]

{inmanta_module_openstack-5.1.1 → inmanta_module_openstack-5.1.2}/inmanta_plugins/openstack/model/_init.cf

@@ -345,47 +345,6 @@ implement RouterPort using providerRequire
 
 RouterPort.subnet [1] -- Subnet.routers [0:]
 
-entity HostPort extends Port:
-    """
-        A port attached to a VM
-
-        :param name: The name of the host port.
-        :param address: An optional fixed IPv4 to request. When omitted neutron assigns one; leave unset
-                        for an IPv6-only port. Ignored when dhcp is true.
-        :param address_v6: An optional fixed IPv6 to request from an IPv6 subnet on the port's network.
-                           When omitted no IPv6 is requested. Ignored when dhcp is true.
-        :param portsecurity: Enable or disable port security (security groups and spoofing filters)
-        :param dhcp: Enable dhcp for this port or not for this port
-        :param port_index: The index of the port. This determines the order of the interfaces on the virtual machine. 0 means no specific order.
-        :param retries: A hostport can only be attached to a VM when it is in an active state. The handler will skip this port when the VM is not ready. To
-                        speed up deployments, the handler can retry this number of times before skipping the resource.
-        :param wait: The number of seconds to wait between retries.
-    """
-    std::ipv4_address? address = null
-    std::ipv6_address? address_v6 = null
-    bool portsecurity=true
-    bool dhcp=true
-    int port_index=0
-    int retries=20
-    int wait=5
-end
-
-implementation noSecurityGroupsWhenPortSecurityDisabled for HostPort:
-    # Security groups can only be enforced on a port when port security is enabled.
-    std::assert(
-        std::count(self.security_groups) == 0,
-        "HostPort '{{name}}' cannot have security_groups assigned while portsecurity is disabled."
-    )
-end
-
-implement HostPort using providerRequire
-implement HostPort using noSecurityGroupsWhenPortSecurityDisabled when not self.portsecurity
-
-HostPort.subnet [1] -- SubnetBase.host_ports [0:]
-HostPort.vm [1] -- VirtualMachine.ports [0:]
-
-index HostPort(provider, vm, name)
-
 entity SubnetBase extends OpenStackResource:
     """
         A neutron subnet
@@ -507,32 +466,66 @@ implement QoSPolicy using providerRequire
 
 entity NetworkPort extends Port:
     """
-        A standalone neutron port, managed directly on a network and not bound
-        to a router or a virtual machine. This mirrors the
-        ``openstack port create --network <network> <name>`` command and is
-        suitable as the parent port of a :py:class:`TrunkNetwork`.
-
+        A neutron port. By default it is a standalone port, managed directly on a
+        network and not bound to a virtual machine -- this mirrors the
+        ``openstack port create --network <network> <name>`` command and is suitable
+        as the parent port of a :py:class:`TrunkNetwork`. Setting the ``vm`` relation
+        instead attaches the port to that virtual machine.
+
+        The port lives on an explicit ``network`` or, when only a ``subnet`` is given,
+        on that subnet's network.
+
+        :attr address: An optional fixed IPv4 to request. When omitted neutron assigns one; leave
+                       unset for an IPv6-only port. Ignored on a vm-attached port when dhcp is true
+                       (a standalone port always takes the address it is given).
+        :attr address_v6: An optional fixed IPv6 to request from an IPv6 subnet on the port's
+                          network. When omitted no IPv6 is requested. Ignored when dhcp is true.
+        :attr mac_address: An optional MAC address for the port. When omitted, neutron assigns one.
+                       It is typed as a plain string (not the ``mac_addr`` typedef) so it can hold a
+                       fact reference resolved at deploy time, e.g.
+                       ``future::std::create_fact_reference(parent_port, "mac_address")`` to make a
+                       trunk sub-port share its parent port's MAC. Set only at creation; neutron does
+                       not allow changing it afterwards.
         :attr portsecurity: Enable or disable port security (security groups and spoofing filters).
-        :attr address: An optional fixed ip address for the port. When omitted, neutron
-                       assigns one from the network. When set, a subnet must be provided.
-        :attr mac_address: An optional MAC address for the port. When omitted, neutron
-                       assigns one. It is typed as a plain string (not the ``mac_addr``
-                       typedef) so it can hold a fact reference resolved at deploy time,
-                       e.g. ``future::std::create_fact_reference(parent_port, "mac_address")``
-                       to make a trunk sub-port share its parent port's MAC. Set only at
-                       creation; neutron does not allow changing it afterwards.
+        :attr dhcp: Enable dhcp for this port or not. Only relevant when the port is attached to a vm.
+        :attr port_index: The index of the port. This determines the order of the interfaces on the
+                          virtual machine. 0 means no specific order. Only relevant when the port is
+                          attached to a vm.
+        :attr retries: A port attached to a vm can only be attached when the vm is in an active state.
+                       The handler will skip this port when the vm is not ready. To speed up
+                       deployments, the handler can retry this number of times before skipping.
+        :attr wait: The number of seconds to wait between retries.
     """
+    std::ipv4_address? address = null
+    std::ipv6_address? address_v6 = null
+    string? mac_address = null
     bool portsecurity=true
-    std::ipv4_address? address=null
-    string? mac_address=null
+    bool dhcp=true
+    int port_index=0
+    int retries=20
+    int wait=5
 end
 
-index NetworkPort(project, name)
-
-NetworkPort.network [1] -- Network.network_ports [0:]
-NetworkPort.subnet [0:1] -- Subnet.network_ports [0:]
+implementation noSecurityGroupsWhenPortSecurityDisabled for NetworkPort:
+    # Security groups can only be enforced on a port when port security is enabled.
+    std::assert(
+        std::count(self.security_groups) == 0,
+        "NetworkPort '{{name}}' cannot have security_groups assigned while portsecurity is disabled."
+    )
+end
 
 implement NetworkPort using providerRequire
+implement NetworkPort using noSecurityGroupsWhenPortSecurityDisabled when not self.portsecurity
+
+index NetworkPort(project, name)
+
+# The port lives on an explicit network, or derives it from its subnet when only the
+# subnet is given.
+NetworkPort.network [0:1] -- Network.network_ports [0:]
+NetworkPort.subnet [0:1] -- SubnetBase.network_ports [0:]
+# When set, the port is attached to this virtual machine. Left unset, the port is a
+# standalone port (e.g. the parent port of a trunk).
+NetworkPort.vm [0:1] -- VirtualMachine.ports [0:]
 
 
 entity TrunkNetwork extends OpenStackResource:
@@ -541,9 +534,11 @@ entity TrunkNetwork extends OpenStackResource:
         subports (see :py:class:`TrunkPort`) so that a single VM interface can
         carry traffic for multiple networks using VLAN tagging.
 
-        The trunk is built on top of an existing parent port. That port can be a
-        standalone :py:class:`NetworkPort` or a :py:class:`HostPort` attached to
-        a virtual machine. The parent port is managed separately.
+        The trunk is built on top of an existing parent port (a
+        :py:class:`NetworkPort`). Neutron only accepts a parent port that is not yet
+        bound to a virtual machine, so when the trunk parent is attached to a vm the
+        port must be created (and the trunk built on it) before the vm boots on it.
+        The parent port is managed separately.
 
         :attr name: The name of the trunk. Must be unique per project.
         :attr description: An optional human-readable description.
@@ -565,8 +560,8 @@ implement TrunkNetwork using providerRequire
 
 entity TrunkPort extends OpenStackResource:
     """
-        A subport of a :py:class:`TrunkNetwork`. It attaches an existing port
-        (a :py:class:`NetworkPort` or :py:class:`HostPort`) to the trunk with the
+        A subport of a :py:class:`TrunkNetwork`. It attaches an existing
+        :py:class:`NetworkPort` to the trunk with the
         configured segmentation type and id (typically a VLAN). The referenced
         port is managed separately; this resource only manages the trunk
         subport attachment, not the port itself.
@@ -639,7 +634,7 @@ end
 SecurityGroup.provider [1] -- Provider.security_groups [0:]
 SecurityGroup.project [1] -- Project.security_groups [0:]
 SecurityGroup.virtual_machines [0:] -- VirtualMachine.security_groups [0:]
-HostPort.security_groups [0:] -- SecurityGroup
+NetworkPort.security_groups [0:] -- SecurityGroup
 """
 :rel security_groups: The security groups to enforce on this port. When left empty (the default), the
     port's security groups are left unmanaged for backward compatibility: existing groups (including the
@@ -698,7 +693,7 @@ implement FloatingIP using fipAddr when not force_ip
 FloatingIP.project [1] -- Project.floating_ips [0:]
 FloatingIP.provider [1] -- Provider.floating_ips [0:]
 FloatingIP.external_network [1] -- Network.floating_ips [0:]
-FloatingIP.port [1] -- HostPort.floating_ips [0:]
+FloatingIP.port [1] -- NetworkPort.floating_ips [0:]
 
 entity VMAttributes:
     """
@@ -727,7 +722,7 @@ end
 
 index VirtualMachine(provider, name)
 
-VirtualMachine.eth0_port [1] -- HostPort
+VirtualMachine.eth0_port [1] -- NetworkPort
 VirtualMachine.key_pair [1] -- ssh::Key
 VirtualMachine.project [1] -- Project
 VirtualMachine.provider [1] -- Provider.virtual_machines [0:]
@@ -762,7 +757,7 @@ Host.provider [1] -- Provider
 Host.security_groups [0:] -- SecurityGroup
 
 implementation eth0Port for Host:
-    port = HostPort(provider=provider, vm=self.vm, subnet=subnet, name="{{name}}_eth0", address=std::getfact(self.vm, "ip_address"),
+    port = NetworkPort(provider=provider, vm=self.vm, subnet=subnet, name="{{name}}_eth0", address=std::getfact(self.vm, "ip_address"),
                     project=project, port_index=1, purged=purged, purge_on_delete=self.purge_on_delete)
     self.vm.eth0_port = port
 end